Analysis
- user interaction
yes - max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/10/2026, 07:37
Static task
static1
Behavioral task
behavioral1
Sample
PDF_Z4R8K5_20261026110707.vhd
Resource
win10v2004-20260911-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
PDF_Z4R8K5_20261026110707.vhd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target PDF_Z4R8K5_20261026110707.vhd
- Size 8.0MB
- Sample261027-jfvb3scs7p
- SHA256 af627cd3900c4626e00159682f815fafc8560f6eae27629beff576f0e34c2c8e
- MD5 d79c8d856ef17fed4fe905f1dd36b777
- SHA1 c8c21d0cf5c8a2e20409c76de17707b67cd6de15
- SHA512 559685a1cac29fb29dcc401f11602915adbbca819a7783cd605b79b7384148e08a3ba5846eef2dd81b22e1373903487defe763838c8abe8869e39b665beebf8a
- SSDEEP 24576:r8q1L8bEuXsj6ME5pvOIogH5zpPNTKGKmmUYUsK:gIL8bdXS6MSpvOIokpVTCUYU
- TLSH T16D866D0793E902ADE0B7E13C89678906E6767C5907709ACF13A0B95A2F737E09F79311
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- DCAgent remote management tool 3 IoCs
DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor
resource yara_rule behavioral1/files/0x00070000000245d6-267.dat hacktool_dcagent behavioral1/files/0x0007000000024640-425.dat hacktool_dcagent behavioral1/files/0x00070000000246a3-593.dat hacktool_dcagent - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 29 IoCs
pid Process 4872 PDF_Z4R8K5_20261026110707.exe 5204 dcagentregister.exe 4888 7za.exe 4292 dcagentservice.exe 4452 dcrdservice.exe 4880 dcstatusutil.exe 4676 dcinventory.exe 620 dcagentservice.exe 5108 dcconfig.exe 3656 dcusbsummary.exe 2500 dcusb64.exe 628 dcstatusutil.exe 4968 dcondemand.exe 3760 dcswmeter.exe 3104 dcinventory.exe 5416 dcconfig.exe 396 metroapps.exe 1612 dcinventory.exe 2316 DCProcessMonitor.exe 2540 dcondemand.exe 4724 dcagenttrayicon.exe 2980 dcagenttrayicon.exe 5052 7za.exe 5700 7za.exe 5108 7za.exe 1064 7za.exe 4784 7za.exe 4588 7za.exe 2972 7za.exe - Loads dropped DLL 54 IoCs
pid Process 4872 PDF_Z4R8K5_20261026110707.exe 676 MsiExec.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 4292 dcagentservice.exe 4292 dcagentservice.exe 4452 dcrdservice.exe 4452 dcrdservice.exe 4880 dcstatusutil.exe 4880 dcstatusutil.exe 4880 dcstatusutil.exe 4676 dcinventory.exe 4676 dcinventory.exe 620 dcagentservice.exe 620 dcagentservice.exe 3656 dcusbsummary.exe 3656 dcusbsummary.exe 4676 dcinventory.exe 5108 dcconfig.exe 5108 dcconfig.exe 5108 dcconfig.exe 628 dcstatusutil.exe 628 dcstatusutil.exe 4968 dcondemand.exe 4968 dcondemand.exe 4968 dcondemand.exe 628 dcstatusutil.exe 3760 dcswmeter.exe 3760 dcswmeter.exe 3104 dcinventory.exe 3104 dcinventory.exe 4968 dcondemand.exe 4968 dcondemand.exe 3104 dcinventory.exe 5416 dcconfig.exe 5416 dcconfig.exe 396 metroapps.exe 396 metroapps.exe 396 metroapps.exe 1612 dcinventory.exe 1612 dcinventory.exe 1612 dcinventory.exe 5416 dcconfig.exe 4724 dcagenttrayicon.exe 4724 dcagenttrayicon.exe 2540 dcondemand.exe 2540 dcondemand.exe 2540 dcondemand.exe 2980 dcagenttrayicon.exe 2980 dcagenttrayicon.exe 2540 dcondemand.exe 2540 dcondemand.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 50 4484 msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log dcagenttrayicon.exe File created C:\Windows\SysWOW64\dcagenthttp.dll msiexec.exe File created C:\Windows\SysWOW64\dclibxml2.dll msiexec.exe File created C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF dcinventory.exe File created C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\input.PNF dcinventory.exe File created C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF dcinventory.exe File created C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF dcinventory.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log dcagenttrayicon.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ca-certs.zip 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devicescanaccess.log dcinventory.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-security-setting.json4292.tmp dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cold_normal_msghldr.gif 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcprereqhandler.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcdriverupdates.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\remind.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\Resource\participantlist.swf msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\TroubleshootingTool.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferup.log dcinventory.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\mdm-enrollment-settings.json dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\hostondemandrequest.log dcondemand.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\drvforceupdate.exe dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\config_install_alert.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log dcagentregister.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmsghandler.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\selfserviceexe.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devicepatchaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpowerreports.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\drvforceupdate.exe.gz dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Warning_icon.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\DisableEnableEthernet.vbs msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\x-icon.gif msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\DCAgentUpgraderAccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json dcagentregister.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcscreenrec.exe.config 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dpinst64.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcprocessmoniter.log DCProcessMonitor.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\processlist.conf DCProcessMonitor.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_install_all.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\maximize_icon.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\key.pem dcagentregister.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_ffffff_256x240.png 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_troubleshooting_tool.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcfilescan.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DetouredDll32.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\usbeDevicelist.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmsghandler.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcprereqhandler.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ds-server-info.xml dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\hardware.json.gz dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\messagebox_info.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\server-certificates\DMRootCA.crt dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcaddonsevaluator.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-scan-data.xml dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-edb.xml msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcswmetercollector.log dcswmeter.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Internet_Connection.log DCProcessMonitor.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\applications.xml dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcprepostaccess.csv dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\restore_icon.svg msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcSwscript.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcPrivateKeys.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\EC_icon.svg msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\rdsrunasuser.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\Resource\console.swf msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_download_all.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\Resource\talkbackwidget.rgn msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\history.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\cold_normal.gif msiexec.exe - Drops file in Windows directory 20 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e59ae69.mst msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIB4C1.tmp msiexec.exe File opened for modification C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json dcagentregister.exe File created C:\Windows\Installer\e59ae70.msi msiexec.exe File opened for modification C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File created C:\Windows\Installer\e59ae67.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIDA0.tmp msiexec.exe File created C:\Windows\Installer\e59ae68.msi msiexec.exe File created C:\Windows\Installer\e59ae69.mst msiexec.exe File created C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7} msiexec.exe File created C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File opened for modification C:\Windows\Installer\e59ae67.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIB220.tmp msiexec.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json dcagentregister.exe File opened for modification C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File opened for modification C:\Windows\Installer\e59ae68.msi msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4356 cmd.exe 4228 cmd.exe - Modifies trusted root certificate store through registry 1 TTPs 8 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\9FACC733353276098B85C33F51E5708DF216EB80\Blob = 140000000100000014000000209854f5f76c96465cf20ab2875dc57f7b61e55e0300000001000000140000009facc733353276098b85c33f51e5708df216eb800f0000000100000020000000c1252718ae6a1426668767680203b7f4504c3998a529e8f0e84ce65171aee195200000000100000029040000308204253082030da00302010202083c9104ec007b2069300d06092a864886f70d01010b05003081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d43413020170d3236303732363039303735355a180f32313236303732363039303735355a3081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100cd2c12845e4221ea2355ca7827e7725e63bd1ecd6c80140493435953de7f841672aaff7c7c5c9d6d0cac3ffba7d76d7e248554b24290e2accdf6b34c8b019c9efd7e95fe5b36990cbc9c4d0ac519e53f6efadf28ac4dbf9dce93b0aad24bb4c16a47a8f2912affe6072a8d62cff155a3a61229f742b14a96fcdac6797e7164c9a0dcc7572d39dd17cf5260efb5b0762ecfb109f8056d1e0489412187304b64bb5da9896335e4e8440c3fed76f859fd2313c22f0717c0fc117f7043295e93641c85dbbfb065d59e261c445626bed57f4b5180bebba0dec04b8c4904ae3ba63df9b4f54efd32c5632552f141819017255f7fce83d99fdf1aee43c98d0fa2e3adcf0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414209854f5f76c96465cf20ab2875dc57f7b61e55e301f0603551d23041830168014209854f5f76c96465cf20ab2875dc57f7b61e55e300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100735480e7cb6d10a40dbb46baf8238ea6888f6a6231af20167ea75bc0ee06843f58f52f9037ad3578e63274fe4f3f87fa768fbb01bd44d9872ea38bf497451abe77803afc84785f48c72a03ba46f602680b741936b70f3a945ca941b94be582d6aad510e48971abd9791b27a00b9c3ff7016f0549f879b2938bd80fe8510a3d08c29f14fc1e5077619831a2a69a221e00d477786b7fc88128c565df35620b7bc6c54298871d531a788e6be9ad42ba3a4a9be27b405e736ed69f41616f837f5f68d66dfb8c5340442cd3d3de70f56071b5b2638f5734f05d44daea1a9e1f46b0aa34ba0ca1852f0df571293e9fb948b3299fbf9452f6d83c055acdac766affe01e dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6A3810982C53205EE6C4729080ACE15B4899BA37\Blob = 1400000001000000140000007775d763b3c4a59d621a8002e83f20c3d826dd830300000001000000140000006a3810982c53205ee6c4729080ace15b4899ba370f0000000100000020000000a04ee1120656a36b4c08e1744a331f56a5c01a0542c1cd0c1c8f7aad7c04138f2000000001000000af030000308203ab30820293a00302010202087b6d10ed52179b25300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303732363038353934395a180f32313236303732363038353934395a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a3d544c3de2adc58dcc5b399332266404207e8f6ccf438316c06e6a008bfffb6332dceb43abf3532691e3ee0293e8fa2810a19df5e2e058a6df210632f7de4a1379ff2ab7eb32a800475de532cf531a1a854b7b6069241087d604f047aa1fc6c5a8302cde203f457e3eae8728b029f0e0e8e19782e35b4de0a5eb85c83578b6e0fbd7e4353c53a816759ce902c5b47587ece1ee1495052573fafadf759bc07ff4f304757349723a16e7255039ce85fd7c60a826dbc57e9682c70ce244223f3c57fc2292f6e021292e90a7d8f9c1f5da91200bd32ee00f1e213240ed20d4935f7241d6ea8bc98ee7d09dca460694c92f82f7861ac79c3ce95f50c4a8f4698791f0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e041604147775d763b3c4a59d621a8002e83f20c3d826dd83301f0603551d230418301680147775d763b3c4a59d621a8002e83f20c3d826dd83300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100108662dc93fe5faba113d9d94370cf650f5b18073b59bc89bc3102f99618a7b267d854ca8352474a7b8b33c4f6a5b42a29a5b64a5c4f3fa2e90f40829d5e6c0d3b41d54b0529a37daa72999c09a64b44912ef4a29d9d3eb2c78c845888a2f2d8194c4e5604f6b8cad95b2494d6d24f9862a291198f27ae9860a535966ca963da9f0fa5432849fa67050a914f52d71c3e59e121990db28837eb778b270689671ff219ce576b816f12b997828e15a014359e915d6faab5e0bb26f8cff11fe9929415333f2090253e13830580b33a2029985af810583eed8d8ba01c798c602f76c121d23315b390bc2c7a63535b6ace7315d0d5a0f53f1dfb4870b7ed368e724d55 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6A3810982C53205EE6C4729080ACE15B4899BA37\Blob = 04000000010000001000000013fff17049997cc1b36b8cb274d099680f0000000100000020000000a04ee1120656a36b4c08e1744a331f56a5c01a0542c1cd0c1c8f7aad7c04138f0300000001000000140000006a3810982c53205ee6c4729080ace15b4899ba371400000001000000140000007775d763b3c4a59d621a8002e83f20c3d826dd832000000001000000af030000308203ab30820293a00302010202087b6d10ed52179b25300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303732363038353934395a180f32313236303732363038353934395a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a3d544c3de2adc58dcc5b399332266404207e8f6ccf438316c06e6a008bfffb6332dceb43abf3532691e3ee0293e8fa2810a19df5e2e058a6df210632f7de4a1379ff2ab7eb32a800475de532cf531a1a854b7b6069241087d604f047aa1fc6c5a8302cde203f457e3eae8728b029f0e0e8e19782e35b4de0a5eb85c83578b6e0fbd7e4353c53a816759ce902c5b47587ece1ee1495052573fafadf759bc07ff4f304757349723a16e7255039ce85fd7c60a826dbc57e9682c70ce244223f3c57fc2292f6e021292e90a7d8f9c1f5da91200bd32ee00f1e213240ed20d4935f7241d6ea8bc98ee7d09dca460694c92f82f7861ac79c3ce95f50c4a8f4698791f0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e041604147775d763b3c4a59d621a8002e83f20c3d826dd83301f0603551d230418301680147775d763b3c4a59d621a8002e83f20c3d826dd83300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100108662dc93fe5faba113d9d94370cf650f5b18073b59bc89bc3102f99618a7b267d854ca8352474a7b8b33c4f6a5b42a29a5b64a5c4f3fa2e90f40829d5e6c0d3b41d54b0529a37daa72999c09a64b44912ef4a29d9d3eb2c78c845888a2f2d8194c4e5604f6b8cad95b2494d6d24f9862a291198f27ae9860a535966ca963da9f0fa5432849fa67050a914f52d71c3e59e121990db28837eb778b270689671ff219ce576b816f12b997828e15a014359e915d6faab5e0bb26f8cff11fe9929415333f2090253e13830580b33a2029985af810583eed8d8ba01c798c602f76c121d23315b390bc2c7a63535b6ace7315d0d5a0f53f1dfb4870b7ed368e724d55 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6A3810982C53205EE6C4729080ACE15B4899BA37\Blob = 190000000100000010000000c39d678531b73477a880b9fae8a5dbda1400000001000000140000007775d763b3c4a59d621a8002e83f20c3d826dd830300000001000000140000006a3810982c53205ee6c4729080ace15b4899ba370f0000000100000020000000a04ee1120656a36b4c08e1744a331f56a5c01a0542c1cd0c1c8f7aad7c04138f04000000010000001000000013fff17049997cc1b36b8cb274d099682000000001000000af030000308203ab30820293a00302010202087b6d10ed52179b25300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303732363038353934395a180f32313236303732363038353934395a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a3d544c3de2adc58dcc5b399332266404207e8f6ccf438316c06e6a008bfffb6332dceb43abf3532691e3ee0293e8fa2810a19df5e2e058a6df210632f7de4a1379ff2ab7eb32a800475de532cf531a1a854b7b6069241087d604f047aa1fc6c5a8302cde203f457e3eae8728b029f0e0e8e19782e35b4de0a5eb85c83578b6e0fbd7e4353c53a816759ce902c5b47587ece1ee1495052573fafadf759bc07ff4f304757349723a16e7255039ce85fd7c60a826dbc57e9682c70ce244223f3c57fc2292f6e021292e90a7d8f9c1f5da91200bd32ee00f1e213240ed20d4935f7241d6ea8bc98ee7d09dca460694c92f82f7861ac79c3ce95f50c4a8f4698791f0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e041604147775d763b3c4a59d621a8002e83f20c3d826dd83301f0603551d230418301680147775d763b3c4a59d621a8002e83f20c3d826dd83300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100108662dc93fe5faba113d9d94370cf650f5b18073b59bc89bc3102f99618a7b267d854ca8352474a7b8b33c4f6a5b42a29a5b64a5c4f3fa2e90f40829d5e6c0d3b41d54b0529a37daa72999c09a64b44912ef4a29d9d3eb2c78c845888a2f2d8194c4e5604f6b8cad95b2494d6d24f9862a291198f27ae9860a535966ca963da9f0fa5432849fa67050a914f52d71c3e59e121990db28837eb778b270689671ff219ce576b816f12b997828e15a014359e915d6faab5e0bb26f8cff11fe9929415333f2090253e13830580b33a2029985af810583eed8d8ba01c798c602f76c121d23315b390bc2c7a63535b6ace7315d0d5a0f53f1dfb4870b7ed368e724d55 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6A3810982C53205EE6C4729080ACE15B4899BA37\Blob = 5c00000001000000040000000008000004000000010000001000000013fff17049997cc1b36b8cb274d099680f0000000100000020000000a04ee1120656a36b4c08e1744a331f56a5c01a0542c1cd0c1c8f7aad7c04138f0300000001000000140000006a3810982c53205ee6c4729080ace15b4899ba371400000001000000140000007775d763b3c4a59d621a8002e83f20c3d826dd83190000000100000010000000c39d678531b73477a880b9fae8a5dbda2000000001000000af030000308203ab30820293a00302010202087b6d10ed52179b25300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303732363038353934395a180f32313236303732363038353934395a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a3d544c3de2adc58dcc5b399332266404207e8f6ccf438316c06e6a008bfffb6332dceb43abf3532691e3ee0293e8fa2810a19df5e2e058a6df210632f7de4a1379ff2ab7eb32a800475de532cf531a1a854b7b6069241087d604f047aa1fc6c5a8302cde203f457e3eae8728b029f0e0e8e19782e35b4de0a5eb85c83578b6e0fbd7e4353c53a816759ce902c5b47587ece1ee1495052573fafadf759bc07ff4f304757349723a16e7255039ce85fd7c60a826dbc57e9682c70ce244223f3c57fc2292f6e021292e90a7d8f9c1f5da91200bd32ee00f1e213240ed20d4935f7241d6ea8bc98ee7d09dca460694c92f82f7861ac79c3ce95f50c4a8f4698791f0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e041604147775d763b3c4a59d621a8002e83f20c3d826dd83301f0603551d230418301680147775d763b3c4a59d621a8002e83f20c3d826dd83300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100108662dc93fe5faba113d9d94370cf650f5b18073b59bc89bc3102f99618a7b267d854ca8352474a7b8b33c4f6a5b42a29a5b64a5c4f3fa2e90f40829d5e6c0d3b41d54b0529a37daa72999c09a64b44912ef4a29d9d3eb2c78c845888a2f2d8194c4e5604f6b8cad95b2494d6d24f9862a291198f27ae9860a535966ca963da9f0fa5432849fa67050a914f52d71c3e59e121990db28837eb778b270689671ff219ce576b816f12b997828e15a014359e915d6faab5e0bb26f8cff11fe9929415333f2090253e13830580b33a2029985af810583eed8d8ba01c798c602f76c121d23315b390bc2c7a63535b6ace7315d0d5a0f53f1dfb4870b7ed368e724d55 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\9FACC733353276098B85C33F51E5708DF216EB80\Blob = 19000000010000001000000023fadece517646da0711093c1c5be34f0f0000000100000020000000c1252718ae6a1426668767680203b7f4504c3998a529e8f0e84ce65171aee1950300000001000000140000009facc733353276098b85c33f51e5708df216eb80140000000100000014000000209854f5f76c96465cf20ab2875dc57f7b61e55e200000000100000029040000308204253082030da00302010202083c9104ec007b2069300d06092a864886f70d01010b05003081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d43413020170d3236303732363039303735355a180f32313236303732363039303735355a3081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100cd2c12845e4221ea2355ca7827e7725e63bd1ecd6c80140493435953de7f841672aaff7c7c5c9d6d0cac3ffba7d76d7e248554b24290e2accdf6b34c8b019c9efd7e95fe5b36990cbc9c4d0ac519e53f6efadf28ac4dbf9dce93b0aad24bb4c16a47a8f2912affe6072a8d62cff155a3a61229f742b14a96fcdac6797e7164c9a0dcc7572d39dd17cf5260efb5b0762ecfb109f8056d1e0489412187304b64bb5da9896335e4e8440c3fed76f859fd2313c22f0717c0fc117f7043295e93641c85dbbfb065d59e261c445626bed57f4b5180bebba0dec04b8c4904ae3ba63df9b4f54efd32c5632552f141819017255f7fce83d99fdf1aee43c98d0fa2e3adcf0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414209854f5f76c96465cf20ab2875dc57f7b61e55e301f0603551d23041830168014209854f5f76c96465cf20ab2875dc57f7b61e55e300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100735480e7cb6d10a40dbb46baf8238ea6888f6a6231af20167ea75bc0ee06843f58f52f9037ad3578e63274fe4f3f87fa768fbb01bd44d9872ea38bf497451abe77803afc84785f48c72a03ba46f602680b741936b70f3a945ca941b94be582d6aad510e48971abd9791b27a00b9c3ff7016f0549f879b2938bd80fe8510a3d08c29f14fc1e5077619831a2a69a221e00d477786b7fc88128c565df35620b7bc6c54298871d531a788e6be9ad42ba3a4a9be27b405e736ed69f41616f837f5f68d66dfb8c5340442cd3d3de70f56071b5b2638f5734f05d44daea1a9e1f46b0aa34ba0ca1852f0df571293e9fb948b3299fbf9452f6d83c055acdac766affe01e dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6A3810982C53205EE6C4729080ACE15B4899BA37\Blob = 0300000001000000140000006a3810982c53205ee6c4729080ace15b4899ba372000000001000000af030000308203ab30820293a00302010202087b6d10ed52179b25300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303732363038353934395a180f32313236303732363038353934395a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a3d544c3de2adc58dcc5b399332266404207e8f6ccf438316c06e6a008bfffb6332dceb43abf3532691e3ee0293e8fa2810a19df5e2e058a6df210632f7de4a1379ff2ab7eb32a800475de532cf531a1a854b7b6069241087d604f047aa1fc6c5a8302cde203f457e3eae8728b029f0e0e8e19782e35b4de0a5eb85c83578b6e0fbd7e4353c53a816759ce902c5b47587ece1ee1495052573fafadf759bc07ff4f304757349723a16e7255039ce85fd7c60a826dbc57e9682c70ce244223f3c57fc2292f6e021292e90a7d8f9c1f5da91200bd32ee00f1e213240ed20d4935f7241d6ea8bc98ee7d09dca460694c92f82f7861ac79c3ce95f50c4a8f4698791f0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e041604147775d763b3c4a59d621a8002e83f20c3d826dd83301f0603551d230418301680147775d763b3c4a59d621a8002e83f20c3d826dd83300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100108662dc93fe5faba113d9d94370cf650f5b18073b59bc89bc3102f99618a7b267d854ca8352474a7b8b33c4f6a5b42a29a5b64a5c4f3fa2e90f40829d5e6c0d3b41d54b0529a37daa72999c09a64b44912ef4a29d9d3eb2c78c845888a2f2d8194c4e5604f6b8cad95b2494d6d24f9862a291198f27ae9860a535966ca963da9f0fa5432849fa67050a914f52d71c3e59e121990db28837eb778b270689671ff219ce576b816f12b997828e15a014359e915d6faab5e0bb26f8cff11fe9929415333f2090253e13830580b33a2029985af810583eed8d8ba01c798c602f76c121d23315b390bc2c7a63535b6ace7315d0d5a0f53f1dfb4870b7ed368e724d55 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\9FACC733353276098B85C33F51E5708DF216EB80\Blob = 0300000001000000140000009facc733353276098b85c33f51e5708df216eb80200000000100000029040000308204253082030da00302010202083c9104ec007b2069300d06092a864886f70d01010b05003081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d43413020170d3236303732363039303735355a180f32313236303732363039303735355a3081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100cd2c12845e4221ea2355ca7827e7725e63bd1ecd6c80140493435953de7f841672aaff7c7c5c9d6d0cac3ffba7d76d7e248554b24290e2accdf6b34c8b019c9efd7e95fe5b36990cbc9c4d0ac519e53f6efadf28ac4dbf9dce93b0aad24bb4c16a47a8f2912affe6072a8d62cff155a3a61229f742b14a96fcdac6797e7164c9a0dcc7572d39dd17cf5260efb5b0762ecfb109f8056d1e0489412187304b64bb5da9896335e4e8440c3fed76f859fd2313c22f0717c0fc117f7043295e93641c85dbbfb065d59e261c445626bed57f4b5180bebba0dec04b8c4904ae3ba63df9b4f54efd32c5632552f141819017255f7fce83d99fdf1aee43c98d0fa2e3adcf0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414209854f5f76c96465cf20ab2875dc57f7b61e55e301f0603551d23041830168014209854f5f76c96465cf20ab2875dc57f7b61e55e300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100735480e7cb6d10a40dbb46baf8238ea6888f6a6231af20167ea75bc0ee06843f58f52f9037ad3578e63274fe4f3f87fa768fbb01bd44d9872ea38bf497451abe77803afc84785f48c72a03ba46f602680b741936b70f3a945ca941b94be582d6aad510e48971abd9791b27a00b9c3ff7016f0549f879b2938bd80fe8510a3d08c29f14fc1e5077619831a2a69a221e00d477786b7fc88128c565df35620b7bc6c54298871d531a788e6be9ad42ba3a4a9be27b405e736ed69f41616f837f5f68d66dfb8c5340442cd3d3de70f56071b5b2638f5734f05d44daea1a9e1f46b0aa34ba0ca1852f0df571293e9fb948b3299fbf9452f6d83c055acdac766affe01e dcagentregister.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 30 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname PDF_Z4R8K5_20261026110707.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagenttrayicon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcondemand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagentservice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcondemand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagenttrayicon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcondemand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcswmeter.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname DCProcessMonitor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain PDF_Z4R8K5_20261026110707.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcagentservice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain DCProcessMonitor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcondemand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcinventory.exe - System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcrdservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systeminfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcswmeter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCProcessMonitor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language metroapps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe - Checks SCSI registry key(s) 3 TTPs 10 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities dcusb64.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 4552 systeminfo.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe%5Cresources.pri metroapps.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CImmersiveControlPanel%5Cresources.pri metroapps.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dcstatusutil.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcstatusutil.exe - Modifies registry class 28 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\1 = "C:\\ProgramData\\Office439e\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Office439e\\" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{2F81B25E-7507-4844-BFF2-77D2CC24CED4}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\PDF_Z4R8K5_20261026110707.exe\" -ToastActivated" PDF_Z4R8K5_20261026110707.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\ProductName = "ManageEngine UEMS - Agent" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\PackageName = "UEMSAgent.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{2F81B25E-7507-4844-BFF2-77D2CC24CED4}\LocalServer32 PDF_Z4R8K5_20261026110707.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID PDF_Z4R8K5_20261026110707.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{2F81B25E-7507-4844-BFF2-77D2CC24CED4} PDF_Z4R8K5_20261026110707.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Version = "167772210" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B\DefaultFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\PackageCode = "44C40189C3AA44442AA780ED114A0026" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Transforms = "C:\\Windows\\Installer\\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\\UEMSAgent.mst" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList msiexec.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6A3810982C53205EE6C4729080ACE15B4899BA37 dcagentregister.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\9FACC733353276098B85C33F51E5708DF216EB80 dcagentregister.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4872 PDF_Z4R8K5_20261026110707.exe 4872 PDF_Z4R8K5_20261026110707.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe 5204 dcagentregister.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid 4 - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2748 7zG.exe Token: 35 2748 7zG.exe Token: SeSecurityPrivilege 2748 7zG.exe Token: SeSecurityPrivilege 2748 7zG.exe Token: SeRestorePrivilege 1140 7zG.exe Token: 35 1140 7zG.exe Token: SeSecurityPrivilege 1140 7zG.exe Token: SeSecurityPrivilege 1140 7zG.exe Token: SeShutdownPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeIncreaseQuotaPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeSecurityPrivilege 4484 msiexec.exe Token: SeCreateTokenPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeAssignPrimaryTokenPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeLockMemoryPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeIncreaseQuotaPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeMachineAccountPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeTcbPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeSecurityPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeTakeOwnershipPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeLoadDriverPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeSystemProfilePrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeSystemtimePrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeProfSingleProcessPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeIncBasePriorityPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeCreatePagefilePrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeCreatePermanentPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeBackupPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeRestorePrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeShutdownPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeDebugPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeAuditPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeSystemEnvironmentPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeChangeNotifyPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeRemoteShutdownPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeUndockPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeSyncAgentPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeEnableDelegationPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeManageVolumePrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeImpersonatePrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeCreateGlobalPrivilege 4872 PDF_Z4R8K5_20261026110707.exe Token: SeRestorePrivilege 4484 msiexec.exe Token: SeTakeOwnershipPrivilege 4484 msiexec.exe Token: SeShutdownPrivilege 5152 msiexec.exe Token: SeIncreaseQuotaPrivilege 5152 msiexec.exe Token: SeCreateTokenPrivilege 5152 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5152 msiexec.exe Token: SeLockMemoryPrivilege 5152 msiexec.exe Token: SeIncreaseQuotaPrivilege 5152 msiexec.exe Token: SeMachineAccountPrivilege 5152 msiexec.exe Token: SeTcbPrivilege 5152 msiexec.exe Token: SeSecurityPrivilege 5152 msiexec.exe Token: SeTakeOwnershipPrivilege 5152 msiexec.exe Token: SeLoadDriverPrivilege 5152 msiexec.exe Token: SeSystemProfilePrivilege 5152 msiexec.exe Token: SeSystemtimePrivilege 5152 msiexec.exe Token: SeProfSingleProcessPrivilege 5152 msiexec.exe Token: SeIncBasePriorityPrivilege 5152 msiexec.exe Token: SeCreatePagefilePrivilege 5152 msiexec.exe Token: SeCreatePermanentPrivilege 5152 msiexec.exe Token: SeBackupPrivilege 5152 msiexec.exe Token: SeRestorePrivilege 5152 msiexec.exe Token: SeShutdownPrivilege 5152 msiexec.exe Token: SeDebugPrivilege 5152 msiexec.exe Token: SeAuditPrivilege 5152 msiexec.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2748 7zG.exe 1140 7zG.exe 4872 PDF_Z4R8K5_20261026110707.exe 4872 PDF_Z4R8K5_20261026110707.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3656 dcusbsummary.exe - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 4872 wrote to memory of 5312 4872 PDF_Z4R8K5_20261026110707.exe 111 PID 4872 wrote to memory of 5152 4872 PDF_Z4R8K5_20261026110707.exe 115 PID 4484 wrote to memory of 676 4484 msiexec.exe 116 PID 4484 wrote to memory of 5204 4484 msiexec.exe 117 PID 5204 wrote to memory of 4888 5204 dcagentregister.exe 119 PID 5204 wrote to memory of 4356 5204 dcagentregister.exe 125 PID 4356 wrote to memory of 4552 4356 cmd.exe 127 PID 5204 wrote to memory of 4880 5204 dcagentregister.exe 130 PID 5204 wrote to memory of 4676 5204 dcagentregister.exe 132 PID 620 wrote to memory of 5108 620 dcagentservice.exe 136 PID 620 wrote to memory of 3656 620 dcagentservice.exe 135 PID 3656 wrote to memory of 2500 3656 dcusbsummary.exe 138 PID 620 wrote to memory of 628 620 dcagentservice.exe 140 PID 620 wrote to memory of 4968 620 dcagentservice.exe 142 PID 620 wrote to memory of 3760 620 dcagentservice.exe 143 PID 620 wrote to memory of 3104 620 dcagentservice.exe 146 PID 620 wrote to memory of 5416 620 dcagentservice.exe 149 PID 4676 wrote to memory of 396 4676 dcinventory.exe 151 PID 5416 wrote to memory of 1612 5416 dcconfig.exe 152 PID 620 wrote to memory of 2316 620 dcagentservice.exe 155 PID 620 wrote to memory of 2540 620 dcagentservice.exe 161 PID 5416 wrote to memory of 4724 5416 dcconfig.exe 162 PID 5416 wrote to memory of 2980 5416 dcconfig.exe 164 PID 5416 wrote to memory of 5052 5416 dcconfig.exe 166 PID 5416 wrote to memory of 5700 5416 dcconfig.exe 168 PID 5416 wrote to memory of 5108 5416 dcconfig.exe 170 PID 5416 wrote to memory of 1064 5416 dcconfig.exe 172 PID 5416 wrote to memory of 4784 5416 dcconfig.exe 174 PID 5416 wrote to memory of 4588 5416 dcconfig.exe 176 PID 5416 wrote to memory of 2972 5416 dcconfig.exe 178
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\PDF_Z4R8K5_20261026110707.vhd1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4228
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3500
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:5332
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\" -an -ai#7zMap32236:130:7zEvent279351⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2748
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\" -an -ai#7zMap18032:130:7zEvent303271⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1140
-
C:\Users\Admin\AppData\Local\Temp\PDF_Z4R8K5_20261026110707.exe"C:\Users\Admin\AppData\Local\Temp\PDF_Z4R8K5_20261026110707.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SYSTEM32\tar.exetar.exe -xf "C:\ProgramData\Office439e\w.zip" -C "C:\ProgramData\Office439e"2⤵PID:5312
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec /i "C:\ProgramData\Office439e\UEMSAgent.msi" /qn TRANSFORMS="C:\ProgramData\Office439e\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\ProgramData\Office439e\DMRootCA-Server.crt" DS_ROOT_CRT="C:\ProgramData\Office439e\DMRootCA.crt" /l*v "C:\ProgramData\Office439e\agent_install.log"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5152
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4016E04548EA6C8C2B9C2D11421DF3B92⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:676
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4888
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\systeminfo.exesysteminfo.exe4⤵
- System Location Discovery: System Language Discovery
- Gathers system information
PID:4552
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 223⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4880
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -i postinstallation 0 13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\metroapps.exemetroapps.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:396
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4292
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4452
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 93⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2500
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe7 0 02⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5108
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exebin\dcstatusutil.exe RequestAgentSlotFromServer2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:628
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4968
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3760
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3104
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe3 0 02⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -p processor compatibility3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1612
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4724
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -s3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2980
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5052
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5700
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5108
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1064
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4784
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4588
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2972
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exeDCProcessMonitor.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2316
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2540
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1972
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59ae6c.rbs
- Size 58KB
- SHA256 fe9638d8b559d0d09dba896c6aaf80a5c20b0fbb68c56df51f520cc2c0376a99
- MD5 8c11de6e9b1d84920a08f439d7cc3f27
- SHA1 4db9d99d0defbc727075b65b6060f7163fabfb20
- SHA512 9a3ceb052d67f3cf658df1a8019459d998ebbce3f9c81c83475c3c1e1e12c7a23e1d637e99e41d214aa50d8d7b4db9db1a029d20a0818c9fc601edffaf4a2c0f
- SSDEEP 768:0YOamH6jx6gZiypDO+uT0KeJFbQjGF62WVaFa1hiOVbG:LBsCx6xeDO+Me652WVOmi2bG
- TLSH T1BF437266DB26E2CBD1151AF633826D1806098C7B66F0C43E13186D3BD4DBB457EBF868
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59ae71.rbs
- Size 546B
- SHA256 2b6739149cc179ea7f18db5042bf44999b5252018e26f1cd011e7f9cbbc6b0a4
- MD5 2419b909f2f9ea29fad6ca060792a22f
- SHA1 689ddf0b1e6d516f7882a6560623cfd2134ba027
- SHA512 05516f51165f418a72a7d16581db1083cea72f73035aad1e4322690ce1416d1d9d03eb9512246b99c57c0d67d3a5f797251e06c6bbdca22a64c1d3348790dba9
- TLSH T163F09E93A70841D2D6A06E3617036F551E3BE53E955447762D846338BD1620B5FFF0CD
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
- Size 1002B
- SHA256 be76b2da6f43f17d0a0aa8f682134f7974ef09dd47eb2918b9df0260f9a5a860
- MD5 891a55c92871000929fa07c23b77684e
- SHA1 e25b38aca3bc4756ca0193117cb5e2930f6053c3
- SHA512 3e3adb57add49f16f2bfd3bf92e3afd1f04ae6834bb32f5dac5815388d84d79b38ce23c671938d3413515090ed5078f16d6c7383ee8a095710f207695fa0f314
- TLSH T1F9113276BA6E88607F5BC8FAF65C83033451D3171A5821AF6691698B094521F70AC8EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
- Size 802KB
- SHA256 f00836a63be7ebf14e1b8c40100c59777fe3432506b330927ea1f1b7fd47ee44
- MD5 8f57948e69c82bf98704f129c5460576
- SHA1 33e277af0cea397252c23d310961f803be5cdf2b
- SHA512 628cf68c9436721b874a87e1bff711d3b6fe5d4bd9b02411890059a7d32078a9592fc48e6e53761d17bdbd72c5eb66593b841470157a3e8b38f0b67525d73bc9
- SSDEEP 24576:L48I9t/zu2QSM0TMzOCkY+we/86W5gXKxZ5:Le71MzuiehWIKxZ
- TLSH T1C9059E22BAE5D07BD2421132CA1C7BF591F9976D0B2048C763808F6D7B359D1DA3AE1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
- Size 2.3MB
- SHA256 7627f75435af64ab72991eb93996df3f61101e7b57cdf5a9d8d2e06d75b76aad
- MD5 2843aac7409fc7e54722c6238342f660
- SHA1 3e40879eacf10473127386816c24e0cf245410f6
- SHA512 f8a6e689f3b0c6761aa84f29d717d192fc0b34767a06d551a3937827a95f0cf740baada2a151b4ef6138a0fa626a93c94d45e34c235de63e265cebf32c9e70c2
- SSDEEP 49152:8P5i/uH8WK6WK0Lh8tRjd4b39T9+LoSaEYLUzSPrBsFwZkmTbk8iE8phYhlJFxI:8P5i/uH8WK6WK0WtRU9TAodE0UzirBsH
- TLSH T17CB5BF23EA808032E4CE053692FD5BB65D3E9A10132CA9D3ABD53DB45E755E2663C34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe.config
- Size 174B
- SHA256 832208e81fb2ccabfa2ef289f89d47a2665b451a9550d597821b7d6f39373159
- MD5 c98570a2004587ccac5ac6de21859690
- SHA1 0726125790986ab8034cc4bfb6c87e48f6d908e3
- SHA512 5ca2548e689e32a22b4f12f578dc1309783d9834d82aaa82d489f3cf727e6e6ea2712b1c848452af50f39416eed6cb07d525a158a1a95102a56efb283228baba
- TLSH T1DBC08C6A4634F92F6C021F632B2006412FF502E12068A00CE0CF3F00161004FE30A306
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
- Size 250KB
- SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
- MD5 a2fb219c999a8fa6b95ad7c24890072e
- SHA1 d0a396e49e4a5cca88e454e3463b7b6b4d57cddb
- SHA512 aca3eaa61261f2bf3d1da691b2d6e48e70efb139238d7b885559573d325449aff9a21452903553799b47c8bdfefe242b1b29b31225e94871767acdd8257066a2
- SSDEEP 6144:7gdw3WS+AcP021JmpP4D5NFhW9FNOj23RHbu6wtAadMYAm/o:7gOm2pgNFhQy29buHt//W
- TLSH T13544123CE5D727C68951C1A34D18A3DE329CF8AE5C56FBA5349AF8BC8CC15130B5EA81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Medium.eot
- Size 245KB
- SHA256 1727853b9469a665c3a5573e39503bc592a794d810aed5d03e9a8940f507823c
- MD5 cecc32d267ee07ce3413637314b66ca0
- SHA1 627b584f88033791f427091fff74c9310bdc2ef1
- SHA512 b2f21a38ba5608b4851ee8404abb7ce752388b0b9dfcb24c10f4a1961048ce3d4f811f92b7fb7f2040a1f79243b99760e17ed34c4f0f24a5c2031db47322026e
- SSDEEP 6144:SOcdcK8q3U1SniBmXCCCBT6vTy8bV5O+M059N:nOcWEtkCCCBT6Ly8bfM059N
- TLSH T12D341201EAF9036FE595D2CB68056B269517891049B0ECAEE1FF1B3E0CDCEFC46815E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
- Size 14.6MB
- SHA256 6d5bf676a5800214126df113bbf68a8b3f6ea051ccfbf212c11927df89035082
- MD5 b26cb94e52dd0688c3a77b46e883f084
- SHA1 27692088d8f3d321a6f9afb39395f6109f0469e9
- SHA512 9823343c9c341b3a9c07ad9b3c89ec9c2efc8ea31f3937cfccd3c03724494ebddcd83a53a383087d2cc8e4aedff1e64aa7bcd76fc7d6a28fec4c6309bbd19311
- SSDEEP 393216:FT+EJ+ygjrEhL2oJ/3u6xC/9HI7T3ebuRgzPNK:FT+U+nQhL2oJ/jI/WXeiKk
- TLSH T15FF633E9B4828A4BC5C889B0C64681C4E1CE41B5DC9A6CB6D5B167BFD3DA8C714DB3F0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ca-certs.zip
- Size 160B
- SHA256 7e6debd55c669504ffd364e96b1e539c5d6839472887ecd739ba79b155c62fa1
- MD5 7fe1c49c6da9570331515a2d300642e3
- SHA1 13c824b889876a1ae1e94faeed430185329df502
- SHA512 9de0c421861be17aa0e32ee5a3b603be946f075bb7178e7ee40d8b8639bedd3761e88114dfddc4aa0ab5ae20d6adfae5535b7205b8fa3674e6e8aaad27a0fb7a
- TLSH T1A0C0122AC1CA24F0EF077FB6B05613A34D0CC1FB020386570C4690401F81EAD8D2C406
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cfgUpdate.exe
- Size 62KB
- SHA256 7232bb0e4842bf2f8a370dce70df60c72560416a5bb317650cf88afbd7acb820
- MD5 8e3d3fe805da01bc5abb251f2fb58705
- SHA1 8adc16a8e417cfe1130c3b3e40495ea977374fdf
- SHA512 8e742dc4122c3971f3a0175f648647ba0630fb87d0c1a415c5cd38178643a07a0e2e9ca5e360b3e1de530dba5ba323aa963de9daf204bb0ab19afaa38372311a
- SSDEEP 768:KuhPgdGgqsgO0JRCXwvtLqhjgiWmZhSX0P+4EDsXnqmpif52TZaZTAMxkEYg:KuhP+dgv0AvUjymZhSEPF4k4xH
- TLSH T167537B27B390C432D462197458A9C2725E7B79620BF8D6C77788037E4FB13D0AEB935A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cold_normal_msghldr.gif
- Size 536B
- SHA256 fc7d90a7546fb0f8c8ad6e617f74d185be15f85aaf5d329919bc2776887bc9d1
- MD5 60f77c64f9c8a86fd24c8e64c20e009e
- SHA1 e9299102aa662027b9e46246a5847074444ec1fd
- SHA512 972afa85faba00ad96efad4951ec92ed90e60175dd80a388328c708975df2871655d8ae31ea750d60298ab1514c1a4b53b3b0304d5ace6118b4fea320c075f33
- TLSH T12BF075C0B546067A64170F3544351D4502476D06A57CA33ACC50FCDCD67E220B0229A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
- Size 92KB
- SHA256 430aad28ddd50d0026f7e547764b2f4cd7c54204519e119614895068397904dc
- MD5 2978f0ceba230877a2476d3d99739518
- SHA1 a16ae5aa1bb6017d2732ee5cced1ede9b091816e
- SHA512 5e8ccd699315e23ccc94b4541d568815f88ffc5736c39bdc29d4dc9c3dce3e8ee1b9c70e9f28d980b5433f5bc10d49658b13dc2e8947a415e45d1e4153001cc5
- SSDEEP 1536:APLaK7cLtLWedH8rwkrsofXR1BjDrl7E2zzi0FNLGpxLzH:T66trH4wW3RE2zzieLGDT
- TLSH T1ED938E227690C032E456597468ACCA725E7FBD215BB8C4C77788477B1FA03C0AF7A35A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
- Size 1.2MB
- SHA256 23fa8f503da68dd5724b136f9f401ab747db352e5edd8e2c277bf7426f774773
- MD5 9c1ac952bdfee44fed1ecf7165808e12
- SHA1 8fee062be189b641b0ffcbbb7287697b9be16cae
- SHA512 bb9720f816a1833769d083079a75913c7aef9a103c3edca122ff151acd94cfb586b3b8303720d305807f72f28c6370bf80d478c5a0e6beb734384a89e344685b
- SSDEEP 24576:QSTpNU+Po5KeKA66v9cskz0LIU6iUKLO7N7EqyyF6FmR0OqZC0uNZtSTHytb0Dk:Q2F1ec5zu9LOx7yyF6FmR0OqTi+TStgw
- TLSH T13B559E22D7428031E7E200B7C57A86BAA938AB75131190E3E3D45DE85AEC5D17E3F25F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
- Size 2.0MB
- SHA256 8e35a7064793a56a8d6f1e08050fa588571c8898f5bcea4f78228cf343ce5016
- MD5 5956882d71ddb032bc14ce667b700d9e
- SHA1 74224f6a2948baeab354e2e2a7e687ab6a65877d
- SHA512 f7230ec387f95ab5aff516771b11ca00475adf460a293308a4dd9206a1ef2fc4a462c647ad8a4b0696209b7ed19e303c84667ff85bb2b4a06f4d4e90c15d5f6d
- SSDEEP 49152:oc41Ly9rwBXp10lrzBSnwX0cLP65eP8Txvkd/TgVI3cYKNpe:ey96iSnwXpLP65Lvkdnco
- TLSH T137A57D11A742C437E5B304F6C97D86BE5438B930172490C3B3C42DAD9BF99D27A36A6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdservice.exe
- Size 2.6MB
- SHA256 1c0d5cd681debbeb1109cf96e667b405349ca36eca8ab189d2fac7cef9babd4c
- MD5 6666b421742bd5a575ef8daa0a4acc46
- SHA1 c025992302e13fadba94231cf702b829b29e108c
- SHA512 ccca86f55c2a9e5b54960bcd5f38e566265b9fed006e663729baaa78c793305bce4a56b6dbb0d9694ddfa641bde6ace5fabea73ff2e8e577c463e2b9acb5a6f1
- SSDEEP 49152:fqV9IT7CIQKylb8CA8UzHCUZnywvh3mIgq8r89IbS3EBUJ14wZYJ9w4fvY+hImrI:fqV9Ia1ZA8UTClwvh3mIgq8r89IbavZ3
- TLSH T1A6C5AF22BB818036D6B32172811EA3BDE97896301B3591C7A3D01E7D3E745D2AD3D69F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
- Size 1.1MB
- SHA256 b24ad0ae12c05931f11b66f26166c7ec41a7be318893aebe4cc2babe29bdb080
- MD5 34bfd8a2cafc17cc6d77731137647ee3
- SHA1 f759d53de2db6984ecc7604d0d655cb9324c71ab
- SHA512 26772bdc4d88ba6ea664d47c5f1d96fe1b3c08cebf852c77c2a0513459f763edf17300e341f4e764da647649177e4812fc926dda15c640b91ccfd6d0f847ac34
- SSDEEP 24576:yq6MTUXbn7CW4nVG2w30/JssVTlFLsWOq63IfHNpFw0wOzfTkqZgfVV:sn3/8FLsWOq63IfHX6NKTHZsV
- TLSH T1E135AF21EB024031E1E200B7C6B9D6BA7938A771271590D3E3C05DE96BA89D1BD3E75F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hot_mover_msghldr.gif
- Size 172B
- SHA256 c9657b6062e0798cfb5e39be8d8d1546d901ee339dde4915c82b40460a205f9e
- MD5 c8a811d36876948a70fe7509b7f49925
- SHA1 48541ac236da4f143154a8f71fb7fb3f3110bb38
- SHA512 6bba69fa213b495a9faf4ea917788c43d888b3d96606db1644d7f8c456fb089f01d3e2582016a5043a49182ebd9767a2169aab94de05868ab0efeff5825c7578
- TLSH T115C0801594D652DB7498C735951537213919947F996DD12D404431F134785A0511FD64
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.exe
- Size 318KB
- SHA256 7e311d65ca1a0461cc6bda079efdcbd4f2f0a7967c2f09be02f2b62b97eb4848
- MD5 4373ce1e6f57dc9df7a8ada69479d8ba
- SHA1 f19deb28a0af966ad8c03db23cd21f75dfedda08
- SHA512 e1c1cd77650e72652528b005da981a8ee3b28c995c41875a872202d0a00c75c612050f74b626dbf42f9e5412624860d182b7b6c98dde4df7c09a7f735834dd41
- SSDEEP 6144:QnqKQ2Oq3ScuA05A+O4PlDfZIkbaRF30zG26Wdi9vhEsSCyAekfX6xgrNQi:mqhq3M5A+XfhaD3lV5SCyAe+XmCJ
- TLSH T19264CF2137E5C47BC692253089DC6BF970FAA7490F2448C723C49F2E5E35AE6D239729
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\topmiddle.bmp
- Size 1016B
- SHA256 bb6b032f562a0578070b18e1002c22bec4520cf191f11384af316a0ae33b8cea
- MD5 368947d319ac4823f5d542c8f723fb0c
- SHA1 7d419d7c8b15f9abefc936f526e68ae2c535292f
- SHA512 ed51660075cfeb5a3826231a0f0e2b1b165d0dc808cc5c1f309885dfa7903c914b76bebbb183ef38d67a789adf43b0e6e5223cfccfc362d50ab05b1becb15a60
- TLSH T188119AF0A1F0DCBAE7571660799EB42055D66AC03249424D340BF6286EB7715748CFA9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png
- Size 6KB
- SHA256 eaf7c7ee2747275dda6c53e731a10db1a7b15f4fbb46e1b69d6bb2056bc9fd81
- MD5 d10bc07005bb2d604f4905183690ac04
- SHA1 69011104e870704cf45910d74bed5938f9062891
- SHA512 c8df6ec5eb5684348613af6e8bc2e8d5759ff9912e9d36df42c09960739b0922c2830b56059ec0a95fc2ed7aa83fb3fe5a8673402544c4bd00daab457b9b97ab
- SSDEEP 192:JfC8S1p4JW0bYmezNui5WP1UMIUN93GUO4:JK8AvOYmW1+BIg93P
- TLSH T102E19E87A4C2459E8EAA5CFF1D8E522DC17B8E1A9A1B50C52552D2C1071DFF8D483FC8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_555555_256x240.png
- Size 6KB
- SHA256 5d04051dfd9d2d740355404f98a683d1ec0feb2fca7d76e533c1a6e5ce92dd2e
- MD5 00dd0ec0a16a1085e714c7906ff8fb06
- SHA1 244bd9b7c3b1c4f7ef72de31f67804faff213715
- SHA512 163afece9ae9693c41324ffd89191132a8d2e42d73f962ace0b70b44a17d954c8f506cc25af152397e2536da6245e4336ae465708edf6ede955b4ad502af7a71
- SSDEEP 96:gMXxllGqNJYXQT1pTyOgoz8D1EYwRxOmTtWuXrevpJS/Rq3Kt3KlASyN6KaP:zXTvYXQzy51nfmcuXibSralG/aP
- TLSH T166E18DE534F0C16898A14C3253536644D16EB3C3A8F7AD02C1B0AABAA465F3872FF7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777620_256x240.png
- Size 4KB
- SHA256 9dbe4a0d03feed6f65eb2560a0a8b4ba4264545ee8fd31c1763a3b219d0328d6
- MD5 4e7e3e142f3939883cd0a7e00cabdaef
- SHA1 d20567fd436991539eafd65c3bde77d82a656012
- SHA512 d145a64f637f34d9f9fefaf7cef14ea277d0933e16c625234a9c1e0a54a7f3d0d820ab49b4b68d5d3e9853399d74efba9ff7771bfd3481f8c1c70e6dc6f50275
- SSDEEP 96:7sHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:oHm231Nvu+wIqltWOe3nIH
- TLSH T1A7A13DE27BE7DCF495E62277BF9D5491E1542A41207047B4C4C4D11C695C99B1361E11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png
- Size 6KB
- SHA256 e75b27211e16fcf94715168001bb7055ca376d46f928110ba3d0825232452e5a
- MD5 40bf25799e4fec8079c7775083de09df
- SHA1 4fc6b1449c73f5d10489c104225ebe326a4016ba
- SHA512 51c9e46224098e9270bf51bec93e0528b5e726a632a1de57863fba531d914a9db1d3fb07d22cef756f6fc9e999bf08043e73bca6225a9ab7efffe2904105c388
- SSDEEP 192:92XiIsTugcTnouLuIXdj7Z7rgmlWRI1ie+BVtNzDby:AmOTnwCnZftW61ie+BV3Xby
- TLSH T15DE19FC1E5F8C4E0DD58E668EE886209C7A658B9064742DBCF0485694B48D3186FAB8F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_cc0000_256x240.png
- Size 4KB
- SHA256 02891575d4358e9edde3e42d94057f8e9f82a9d64376f71ee86cef149d30537e
- MD5 093a819138276b446611d1d2a45b98a2
- SHA1 1c7fc1ab71ed0d9fa051f07c7e8f43467121ebf7
- SHA512 c886fae282a185b69a2cdd8593cc4c4e7ee463bc010bf59544058bb294cb0bc2ecc008a9dbdc6c7cd0e45bbb80bb9cdd5b7520c4a88779eb8ff2df56128d7b8d
- SSDEEP 96:gHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:gHm231Nvu+wIqltWOe3nIH
- TLSH T187A17DE17B6BC4E4EBE7233FBFD95460A1542A01206073F480C0D1ECA98D9A71361E21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_ffffff_256x240.png
- Size 6KB
- SHA256 b6b06deef2b924cc3835d63f4883d47882734a33e71b212d917a68cede3b8e9d
- MD5 ea4ebe072be75fbbea002631916836de
- SHA1 1769aa84191332e981245146067080ee4faa592a
- SHA512 85990dc5c32560e10cf380d0e10707a4d995ff58b35cc81bb0ebca5afec15c1ddd6cb0de8e7fb392f2384f2a7ef9482f2b1e47924556e983b9c5ff1a79c1e7de
- SSDEEP 96:DcH4W00cRUjbz7dqG+sLo/Hh+U5cVH/lT3jmk/8fY44WtYHM4tNtldMJU/gl:oYW0YhqG+sLoPT+XjNQYbZNtfMJb
- TLSH T1B3D19E81D6CEA64BCB01DCC97EC73BD82588436B5A1A94EA15D2B0C8B52FA8CC50583F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\global-meta-data.xml4292.tmp
- Size 30KB
- SHA256 35f2ee8933f332e06f17bc351b3fea1ae243e19c31a79615c937766678117361
- MD5 e5cb7ac7fdeee6b8f3b7e61318f99d72
- SHA1 6deffb2e7a90da45245ed64801b9a3b76b5df2c4
- SHA512 cb924995145e3b1e905d465daaf0b0e3f2c02cd37b101a97be56916d8cae58f0a1330d355f3e4d3c8f36c8ed94179d871f2bac1dd68309e7bb73f321918e89cb
- SSDEEP 768:NafyRPXpc9bARN7NInwN+ew/ZEmdAZ+8Dj5qN:NayRPXpc9bARN7NInwN+e8ZEh0Gs
- TLSH T16FD251E677D20A154560B0CECBBD4F8192B7F7DF892A1BC831A054B5931B6F73A8B601
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\EPMErrorCodes.xml.gz4292.tmp
- Size 7KB
- SHA256 f98afedcadb662b4d445800cb2fb704c9432f6449a850db0de7626dc5e50e000
- MD5 c70276f2b72556c0501bb6c8ce05d533
- SHA1 f6aaf376581cf4405d0bcc4fed283b6279b79652
- SHA512 10fd7ce87fc63190aefae117ccf1a839cd61ad28b630995d231bb01243e166d76c2f69647166149b9388983745aa09b51c36889dc4de63c831c8d73f9f90c2aa
- SSDEEP 192:ROGetiEfnoWBJLfDa0AQROfcsvXPsWJSPVZxKnb:ROGgOWS3QIfcTaSPfgnb
- TLSH T199F1AE803AC8102EC460C95486965EE722551F0A77FEE12B081ED4E7CB7FC6A52753D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\applications.xml.gz4292.tmp
- Size 624KB
- SHA256 bfb10f1711894765c10aefaa9f8f91199cf273ba31ca14b25ccddb501ef6e2a7
- MD5 a6d5b6d0d167ffccfc02351dd40844d6
- SHA1 4bf77d3a8ee8c05f6f8d0b3a6d2aef045f34e829
- SHA512 022feef083d68995ebf8d095016a25ec3719722078015ade25b752496aa8aa6cd2fa78b3dde9c3b3f8b2dcec655a79b99d26755968279e1410f3fd3656316e98
- SSDEEP 12288:6Lq8o55KpU5ABPazxKnque/k9wLA3SOhkSO/8bPIux16eDQfGvhT4juMwXm7STga:6+fKe5ABPiuhyJ/sAu3WfoU7SIRabcG
- TLSH T12FD423EDDCDF0990C858428B4E1F388661691941B761BFE132B0D93CA7C5AECDF49A87
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcdriverupdates.dll.gz4292.tmp
- Size 365KB
- SHA256 b51efd8fde309d36a38e2174db59bc7633473df450627fdfea437816cfe42c05
- MD5 c2c5b2c043b6aa50648858f0626ebb17
- SHA1 01b8a07a67c614c77669588dacb95deb5a00fcbe
- SHA512 6a4cd400b7b36162c147dadeed8f6dc0274c80bf6dfa6a672dd8fbdfb72f7dcaa1367ca807bb34799bf513eaa86a065c80339f3d4d3a7fcef222f266e9f76368
- SSDEEP 6144:OBwZzMQNINGrcc2pfNCI0Z7Nx5rkxKpNdXg7KMCgX2mdO4+VwBMBswbI7H:cwrINGrc5pfNE5g0PUKMCgXxO47cIb
- TLSH T1D7842300EA8216561FFDC5C1E40FC4B3C6BA17DFC1DBA2E628663D8DF24DA02A9755C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcpatchutils.dll.gz4292.tmp
- Size 516KB
- SHA256 a80de7283baa35b09e93ae6d98c1b56df4fca3a39c866a991c0e5ba01982ea54
- MD5 ec127913c51f40be0bd68ae5b97519c6
- SHA1 cb7a36e47051b8a75196e154f5b1ca2ecc07b252
- SHA512 65f38229d24cde9ab3a8840fba1fd9dcda80181390f1d08da56c11c8103df1d19ef8b93ef02b3669ff5d039399190da79d580d3baf5ccd25810828946d99ac8b
- SSDEEP 12288:7n5KTIX39WRSNaMppIBohwl0IOaRYwq/nYSVaMBP3aXaLDLtAUrZ:7n5KcX8S88jOl5+YsBnLDBz
- TLSH T1DBB423827ABB8AD5C00FA53AD7FFB772D2427654F68122A4E4660E13FC31B9D4392171
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\drvforceupdate.exe.gz4292.tmp
- Size 120KB
- SHA256 76bb3afb0c8746b57f118fdc4ea24c7daa04ab6bbe364650f359de24cc31ff4c
- MD5 90d7b5f00a0b07950ec7b46c6a5b3e1f
- SHA1 c12af4cfefcb384db1d7b59f4a8b41d4c192555d
- SHA512 bcec9518131b645800e0e15870c781abf966dbb0912366400dd70f47e786517edb5105f08acfad924013f0ea6dba5007522b7dc7b0675a86aafe2137ade95204
- SSDEEP 3072:4HPUIWm8r6tjwLbLQmLLhgYcrVFv0Fe31TuCX80fpemxog3xcm6V3kR:OWmIgjwLQmLivB90Fe5ul0fptx963G
- TLSH T1FFC3120843D0959467BCB5C9C4ED78BFDFB3595031A98BDB68A4021297CDDB22EAF342
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\hardware.json.gz4292.tmp
- Size 120KB
- SHA256 adbdfa43845c115c766393805e2446fb33a10ded58b536317b6eeaaceacd1579
- MD5 6fd6ffb424a4cc3e7493f5a2d3088da7
- SHA1 9f62619981fd7faea27e9b0821fd0098233a514f
- SHA512 aa6ff478f9cdf98f821c2cc0deaec88fe024488f6ad635dc0d201eb4d45d981d4d748916d8c828fe4b610035012779de9bf53cf51685c88a438062b1a3675a3c
- SSDEEP 1536:oJsjAImdKz3Yr7gG0V8S8Wwjd/KOm2rQVOor/D71AfXa6xW3EAL5AOOO3g+Dw:AINYWV78Wwjdwd3/tSXH85AOOO3g+U
- TLSH T174C3B0EF0363897D45BEC65E15B48A1FAC0690477F626045BE80CB22EEBFDA058C5C79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-dependency-details.xml.gz4292.tmp
- Size 110KB
- SHA256 d0f8d48a2234609c549e6604145109a956a6ca3998aebb0729f4ee156ecb6939
- MD5 c8923164f5cd1dcd063abf4d71e109c9
- SHA1 0d78f394f56ae35ddc93b297cd2c4a0bb35bfbea
- SHA512 a5f9e2380973779cbe0c6c149fde40471997b166b5f332b036f49390ade24465367caecaca04e5053d44c873d3cc420b2860f7ee3bd6d62131a7359f92cdd9ae
- SSDEEP 1536:GU/sY0ETW0jaMuCmhw+DJWXZFCFmfsi/DrJJPm7v9NSuPUbrpJarzkR0UJRjxDxG:XkWCSaMZmhF2xV/nnugesrzaMp9DY
- TLSH T159B312116E31DE178F4A9A76316E7FA0F65323419386CC370E03A7FD6399E78459984C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-scan-data.xml.gz4292.tmp
- Size 233KB
- SHA256 0a5fe8f072604e2aea3e59b02c18ebf7180db49ba7b277ca8bff3a63770179cf
- MD5 68b7c0cf8f3a7c413c49c8734c79ec60
- SHA1 74c70a64b3549e2813de1406eddd42d4b8262e80
- SHA512 047033bff6dbef7f0599701d40d65323cb7200600831ddc98d81cd708eb3572212150a1011c34ddf380119ea5a0d3333fefbc60651087183fbdfa9f5f75c297b
- SSDEEP 6144:+82c46t7wtnhu64CgJzxjLdO5Cb1MRpL+ledrDnj:+82N6t6u99JdjLo4b1MRJPd
- TLSH T159342360E283E9B7EF835CDFBB8625DF5B4396D3E55C1B0891621A29D736AD34E009C0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchresource.xml.gz4292.tmp
- Size 160KB
- SHA256 007c3bb26b1ea45cdbcde81e140c2c73e5537a08d9a0fb5af820c211baf95404
- MD5 4ce4021e4c3d4384a8e06e3fc306669c
- SHA1 08fb04d37b417b896d7c9bf6a7c647a443b56929
- SHA512 ae014ab912608732d73b27f1bda5f072cb31e745e1a091853bcd08e2dac608560c3331b9913c71c76ff030368487d7418e160bdcef8884d7cecd5f8120095bd8
- SSDEEP 3072:sWBLuRwIH0DXRL9xu1WuN/xRlIsbisGiUlNht6zGGGGq0zSYYLiNFX7TJdeR:vBLuRxGYbxRqs+gUdsSHYYgFX5dA
- TLSH T115F31244B7AC0F095D86DCAA7608A0D4C76FCA5D936A2F12EF3FD59C5CDE80A02F6610
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchtodepfiles.xml.gz4292.tmp
- Size 4KB
- SHA256 ff37000019ed7822acbbd2db5cd4d7e5a20839c9ed522ec52b5744b5f96b5d7d
- MD5 f95d2740f9084a555fe23692c0495b40
- SHA1 8c81c5361dd1628d5c0d2432d3f88077b5df8a46
- SHA512 9da5b5b5df22da94d1543aec032f1570c16b772a369fb2984b516f4df77e1682dd8e26248611c6561e92a1cc2c9db8deba2da60f7b35c2255a8ba39ffacfd340
- SSDEEP 96:esjHvjHbbFthaBGDpXmzIU9F5gjlvQkIgHfwD6y1AYYxbGR5Id:tvjHbb/V299ojlvQkISCRC
- TLSH T131917C07910CF65EC8242AE28E9A1DF8178E00D8393152856DC82F3217B67FA18B1295
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchutils.json.gz4292.tmp
- Size 340B
- SHA256 16d745bb671edcc34b3af1f7f08afe9b9562ad5b514fe0fa9918190c6dbab527
- MD5 88b93a1f2b7b689d6f79b0227c7781f3
- SHA1 d6c2dccd694389e9140e004a353bb1d854caaebf
- SHA512 ca45ff419d0af21316c0fc14a5857dc1dfc42360d216536a4fa8124101100878732d556a1d3d271e0df5737b77d94f10f8ed7fac70c354d8726905e5e29ecfbc
- TLSH T12BE02DD4F140BE9087A058ED39E32689023F828B860030B383F28E830B010FCD0CF6C8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\server-applications.xml4292.tmp
- Size 62B
- SHA256 dc3ba306133d36aca2f8529d71b2c11cff1ef1b322d036aa44fb4ad8215ec9c7
- MD5 66e501fe40026e8fd15851d95e6772a6
- SHA1 f86b2c5e644c360bf83aaf421416831904fa467f
- SHA512 d932cc5629137b815c18641dfd3043c04e7209bb337a0ebb0f298e2c9ec94c890203c41ae9cc453d180e4ff59700893083e8be1d9651b8354e2f0e3a46250ded
- TLSH T100A002D5631191674BD155664769C0A8937D711A38A00D454D9149A706560490B46156
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\superseded-tree-scan-data.7z4292.tmp
- Size 340KB
- SHA256 788064b818088138803c4fff8038e0ffdb96537576fb9ac217c0821935b96a72
- MD5 8ce87c34084cda58410f1bfd74eeb4c2
- SHA1 6162f4f6e166af9fee9cffdab06161864193e3db
- SHA512 fc8fdbf875b7f1aea036f166a6bdde09cd83246a0e53019c27d41a716c6f093b85757a9707b0d06531952912c32248a2101f7e3a08c8fe0d116d5949d8c2cadd
- SSDEEP 6144:39Thq4kEqanDsr/HO4pLmWMYuf7tlEtLJF927FgW7t/e+hS6bmobicPNGdm:391qjCnDS/7pLzALmTg7Fgcpe+Xbmo+U
- TLSH T1327423B6F19E2B738B7B44872B32D8D1D73F7044BF85B637AE98B0DA441E0895214762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\MisconfigEngine.dll.gz4292.tmp
- Size 464KB
- SHA256 330c26d95b59deb9cc893537bc91e1b8852d1ff4c99219c968ded6e93440c009
- MD5 d9fe4142d10fdca3ffa4c1b13c0793de
- SHA1 da0cd0fe875fe19e60f2701aa35d3d1a23c0fd71
- SHA512 fe4f9a114b34a0fd8d0c8dbbc0964450bb225686ec113fb638f8fb21a76cb357a0bda3e67e7675c1eaebf055ded845e105d2c33710f16589cd99223a25709c5b
- SSDEEP 12288:KAv6dZ+cXAx11I/fMN9fgR/o8GlPfmenWO4pU9GC:WwlxPI/EIRXGmYp4pU9GC
- TLSH T116A4235525FCE71799A2FA4A5EAE80925BD293040ED0C671EC7A7034829276DEF3FC50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz4292.tmp
- Size 201KB
- SHA256 0e38c0611ca05835971a71b2f460ddfe8a936b2b5c02d6611b09854c6cdce2a3
- MD5 42198bc0b5a873ae4542e21ca7a55ccd
- SHA1 db6e99be06fb5162f0fd2c5c4aa4a27964b8b5b2
- SHA512 94750d83c9de6017fd39bec8e05e1ea6daeb40722afb471079267a1477a95a43f89639ef023fc401c8c6a6040246d3fc23970c8f476a17ca3ce6872a50514da0
- SSDEEP 3072:9KnpnnBDOTA7Um0byMAI/OZfzRb2hWxZqZz81JeXSZU//OtHesb+NC6a13MJS09/:AxnsTrm0byMOZfzRrxrJa9araY6wMSCH
- TLSH T1841423634D00599F10ACDBA561FBC60636953EF7815BBB741BD6B9CE3BE0F8442B9012
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\misconfig-scan-data.xml.gz4292.tmp
- Size 48KB
- SHA256 02fa3f0696e3ecec5b0ca1918b5870d68c45a558531fc47efac05f6a4de304ed
- MD5 c5b89231b7f05159c26ef2ecc1c54453
- SHA1 247c3bfd11a289e651ce6626a1acd7eb47e77b16
- SHA512 898cab7b9bc0d8ec9b5e382e31dbb9ab3b912547b3585337d81a34eaf86bb0ec21cbdbfb3eeee33ff77fa6735dc773078ec4487ce56a3277c63f2025cb5ceda3
- SSDEEP 768:k9KczP0sdkLOgfkzhZMwb3tlyItZlup69Usn0ZYPHzXF5weFT3aKLNvsc+S4QkfM:k99jdyot5lPwp6pc2TF5XEEsvxD89c5k
- TLSH T12C2302D88C6869338CE9649C3DD5027C2A702FFBA636C3EE6D6A2D12CC1F6253454C68
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties
- Size 98KB
- SHA256 fb1321f35dacb680e3cefb846f65f657b7141ecaaac61ecea2a009f6a0434426
- MD5 c340fdd54a3956f567a1b3b5bf0ad58e
- SHA1 3c620fd4efda92ddcb42fedd600d4ceb1d940a97
- SHA512 d5e3171d3b11bb56fcf35de8ad596fb37008f21d9e8dfa18444c1460490fdffde3149981ab7fa45a144ce1daa28a5c588230b58fc802ccd30568dc2383b38f3a
- SSDEEP 3072:UyfCAIeTx7UYwyKlWF/VPKWl+DE09phQl1mWSDj8kS:VfCAIMBUYwyKlAVPKc+LDj8kS
- TLSH T16AA3735AD1766F7E33C6132BF4392BD176B20D648741A9E87988E8F4D63C84121BB4B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
- Size 15KB
- SHA256 d4a4d290a60e27dde19bb6b6183da79ebb8a254bd25ffa41f8c5d3d67f8c2702
- MD5 783b02208909201added3870096ecb7e
- SHA1 f912be0d056a40d9ffc49aeff5287d258048664c
- SHA512 a3b95b96082621a06f1b3df0dde7b50b4c84172f8f5a48889f766fab9594e3dc41a86ab47553bc8ef4a01c29103bfc59ace36f1135e4aedc0d7079faad513589
- SSDEEP 96:jSOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:jBhBAO8b0Obx9nFLnnmI
- TLSH T1E662C593A51D099F0222039999DF7AD3A1BC94344C7328FEF8C259256FDAC1923737B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
- Size 28KB
- SHA256 e7adadaa6b10ec1011abdc290111ef696da1e94bbb66856b7066e9ecb145b521
- MD5 da7c3be29aa3d318899f929b63bbcb66
- SHA1 7ffd095dd10f45d70c695130d3512018bf87ed8b
- SHA512 fc3786b5927e4ea1616cd2a7494f90d57d7f2231a0e83c3a1042a910021e52ad4f31a2d85770d999e8bc6a8061d75da377d9e84f8532ac0abca1835dd4dcff3a
- SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fphTc1aHz82aEgEL:0PY/1
- TLSH T122D25297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz3964.tmp
- Size 2KB
- SHA256 3703e5c6dc2c3f70417307865674f3135dac682e0ce02f8e25c96e1e944c844e
- MD5 9a305a9f3b98017176dc6961789662d4
- SHA1 568e9166c9df215736792d936f5effc9561136d9
- SHA512 0960ba5e2eab03d2a36521acb3bb88077b60edb929e351b1ebda19681d3667db68228ceed575d9180bf33069057de07fe9c541105714a5c34eff6a95ec2af484
- TLSH T131513B7F11A8C91A008C8192D624F1306ABFC237A66C5A4DFDF6030C53BD4A52AB5CB9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\UserAssignmentRules.json4292.tmp
- Size 687B
- SHA256 2454f24a04e490d3b061765f40f13fd23aed5d593c8367fee08c8f049fd80c58
- MD5 0d31abda68d74f0d8c89f502a28ae5d0
- SHA1 285553dde974ff216060a1add216088cf465dfd7
- SHA512 b3562e05595974e4ded52e633f35bf17721c7b6897825a6f12ff2ed1350f32997063166bcf685706b49ed0e47b2258fdf24b95d52f33bd361e9556a866563c4e
- TLSH T185014246F0B94D5316C582F5CC99A1179322408BCF8C3D43B55D498DDFAC539313C21D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-security-setting.json3964.tmp
- Size 203B
- SHA256 a1fac0607d7f2363c8442999c99221a2563bcec5647118ee1ba49993440f539e
- MD5 f61b381ba5016c56a642ec3312de9290
- SHA1 bcdd4b0b85fc8ccf22f31945b021654066c9a905
- SHA512 fd6dde69065b456b7f05a250f5a3c968656859d42063dbfadd82ad471d9a045719a077fe5536f7a1a6273ccda9d27ac2f682a53274a7b017e67841e8d7012952
- TLSH T140D022FAD697F0C046E5606A16F28BCE1102E9A0E2CE4169E13977961A00178022BDB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml4292.tmp
- Size 3KB
- SHA256 3582149f8ebd0e41651875baf56fdc164f3231d8244da20539684d805730f26f
- MD5 e7a9f52f3dbdd643de1be5f4a8544645
- SHA1 b7858eeab4861713bb1331d3ab244878fe318d57
- SHA512 b418fe5aa68e6b4d300fa3003f11cb4d0add195030cae8d98f6d676fd9551faefa39b0b58a8c3a8482563ec396cce84f6b8e2efc6ff521c944cc6a96e33ad260
- TLSH T185812111A0B0C72D1374776CDD56F715CE0606962A191B0AF05D38FB0F7ABD17AAB4E2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\antivirus_list.conf4292.tmp
- Size 328B
- SHA256 0a7128e8aac6275c49f6d69ed927d60431a9fe5be31605b8958d5c7c8db9a442
- MD5 8fd78140fe3d14ddea17b7912fd0b395
- SHA1 8792224f1f95bdec9952c526ce5d32da017227b0
- SHA512 fd5a09748ee9dccabeb283b28173620e7a7f9a1c91e83c5942a39ed3f8535234f14f3de69010d55dd7569fc0b975a96bb675e98fd4601da9a50c5df35814c0fa
- TLSH T15FE0205855EEEC318FDD3B99182D26CF894A216201D15E741B64226451581DEC8AD1DD
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc.xml
- Size 261KB
- SHA256 db2751fd3ef07f03c99e5b117f2806f627470d629d4dd79f619dc8ea51f9d805
- MD5 0b2e7aceb8fb4d6fd05c58cde380297c
- SHA1 e80cd444ef61f95de76582a6bc7381bc223c82c4
- SHA512 541bf21ca6cc52a1fc6c0851100a3df10d543cfc205eea2711ed2c46d63f463045bb638a3cba60c83c5cedc87df9736c74dcd6a401b1eca1d1e6418959d49574
- SSDEEP 768:HDVQuZ14/++C1TFgSNwb2MxoH9rDT95+E4XBNv2pWc2twcIMgGIbMQnKXjUEAav4:HDzZZ1uSNA7YTo2aO1
- TLSH T1684417969DFEAC53E2D4091C8E921C087D9A4B874DC918A535BC3BE4FF634C341A72B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
- Size 415KB
- SHA256 9e2dcf836433b648d592cf5ea82af6d44cc6f0cb8625436dc164dda3601df2a7
- MD5 d1a1e51389e6663e8e53933731adf46f
- SHA1 9ada91a587210f7f67ce5e805d7c35ba1c4201eb
- SHA512 14208064c56b6fd9998f10b7a534b3c48ddc1539ca4ae63521e5ccced1824e3a2e7ecc0c2e592138bf17d4ef07d253ba537215d8fc095b0d2a55842887624a99
- SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZn2FYYh:6fufQiiNJY7tYiSYh
- TLSH T13E94B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
- Size 109KB
- SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
- MD5 b39316c180a11c7cbefd08019ad9c97d
- SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
- SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
- SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
- TLSH T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
- Size 1.6MB
- SHA256 0c6236f2f6794c79fb2795bea6eb04775d94ea8079ce9d92502236bfb448a706
- MD5 415d608384f186f24717c62056111c99
- SHA1 85a8d23411db39acaaa00a7efb974535f74bfb26
- SHA512 f72b81cddefac677b27d41380fbc647c83a1cd22ac3d319659f569d64907103cbaa5ca3ab877c97fb54f3f0f37b5a6a3a7afa96f6c4c7bee02aaa275473b7ceb
- SSDEEP 49152:L8vq3hwELiWbHTKR0NDZK+/0KfEDKJKzK5xFKOQFKNoDKpW83wKFC+KFE2v:4vqxwEeWbHTK+hZK+/0KfEDKJKzK5xF8
- TLSH T13E75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ds-server-info.xml4292.tmp
- Size 789B
- SHA256 ce7db08b5b37026c6f1c1f09ad3493e6f0bef626705a3f0e7a190d0bc4b35ff9
- MD5 0cf08f8a20193cc0cc732f6845d984de
- SHA1 21d084a99e328caab367d602e77e0fd71416458e
- SHA512 9f8b2608ae70f31897e93c5beca5bfbd653eecebe7feda4cd376a69804ce7e3c4745eee13a8922771e45da954ff1d2d90d693f903eb207401b8586f7c733943e
- TLSH T12D01B102B843DCE92362BB84238D981A9E542422711F1C507151BE918A3EFA31C7343B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\dynamic-variables.xml
- Size 28KB
- SHA256 6df9a28cfd8d76f1e41e6f9fcdf28eb8fa3b5a5d67015ba51fdf1c76980bde1d
- MD5 889d10168a96d01a40af825a606ffbe8
- SHA1 d1a75fea9d9aedd31dd581b8cdf7b45791d790d8
- SHA512 4536452db3e0d32cc7129bab4180a509b71d5affa0fb98599cf7ae4d21671cce0fcb7335cc891a0ce247de2a6674197f6ba74409a14b6bfc15a7a03d1511b90b
- SSDEEP 768:LXRI9jcxa3qsbOFtm60CVmqPC21XxmYOXNe/pR71KRa2GG4q+V5No5hVMKD4idqH:LXRI9jcxa3qsbOFtm60CVmqPC21XxmYL
- TLSH T10AD2753E61A0FC4CBAD0E85C14CC8A188855D313518D7AF1FBE84F2E0BA59A5525FDFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\mdm-enrollment-settings.json4292.tmp
- Size 141B
- SHA256 0c474158017f88d09295d4b6cb94c4b581fcbc0543f03c2f6229b6ca7242cb71
- MD5 7e99013fc407b68995686e987222a546
- SHA1 5f82c62bce7acea179483c674268259bfd3e2399
- SHA512 a0a30bfebbaa7fccca136ad62e39ce8bcef240bb434438cca1a232bb7464b6625fb3259ada667e65fedbfcb73cc8540f6fc1903a8387e279f7020441898a1955
- TLSH T16AC09B51C6402DF44F4D78EC984DD6C91D909353594EA4B1F420555E7F8D17C3870CD2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml5104.tmp
- Size 10KB
- SHA256 1b56c4ac97dfa2853676035126ffecf8e3f11d09c1a8c43cedd655b125ed338f
- MD5 447b08d9e5500246cbdfa643fe687e40
- SHA1 46b6f37aa0ae6813b2431e537b0767e920c9dd39
- SHA512 d7873fb10704ab883b094ccae0017ac2cd79f51b93b8656ed50c2eccb3dee8e5eec013148e08d1221fc2b792fcabe2328320d9a018ed7e2dfc796b840cff9771
- SSDEEP 192:mUKUEURURUwuUgU/UkuURU7U2UUU2UTUMUdUZU+UHUlUHUIUxuUMUhUrUIUaU5/p:mN9sm6JkMoonVBED669MkiptDQSZXK/p
- TLSH T1423258A06BCF9CF84194FA0C8F49C920F9B6F61721AD10157698BC488EF74D73EB6169
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ns-status-details.xml6072.tmp
- Size 1KB
- SHA256 bed18ac9df66eeb02d52a9e77f9626e26fab5adb39d48624ffd1d491fbff4fc1
- MD5 f798036f879004b8df4ee4478b1a7695
- SHA1 94490df43c2c54b81af932fc6b6b3dd7c432c2f0
- SHA512 d134d09d77ac1b8d37dbd151c3b78df3c4c2cabb42212e06b127fe7ddf71b50eae265d21ee1cc2798ecaa6c6874ca39ed547492daa76f4fd97bdc3d3b8fad1e5
- TLSH T127418211A8839CE92357BF942D8E89229C5D1867322F2DA0B151BE91563FFD31C734BA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf5412.tmp
- Size 55B
- SHA256 2001c465639c8b53419ae3ef4069ba573577ed26f592c988463e5db44336d7f8
- MD5 87cadf1716a7a89b6a5e95707bbe0e5c
- SHA1 677e32f23bfbaa64b2eeb562a24b9153eff29c7d
- SHA512 92c72d63eb92952cde4bf2dd01cff2ace0b531d28b3d53ade8b5912ee796d2313b08f4a7ee172efcaca8f2951386d3c8916796ac736801ece831bc6d7ae2ca76
- TLSH T18290026DD52E681112675D0E66488F43C51A50C1198D582B1A2C1826A0B417D5A50153
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\wmi-classes.xml
- Size 44KB
- SHA256 86467edb2cd13dccd9ff7204361db996f5043f9a1e0414cc40d60aeee9873857
- MD5 eb76a82b9680f5c567471241f0b5b98d
- SHA1 88cfd218d3e660b3ca38296bb433023b637a4970
- SHA512 ff7e462527adbd8cfb0d71535dfb2ae58365e63870a7fd28f85ab19800c08006026ed4e7edd39afee43c085df5803039291786445f6791466b0c2cb0ea9b34a3
- SSDEEP 192:E7XG+upmfApVeqiIrFER/j3Bmft5lo7zdtIsyfLzm2PsO6lAIf2GkDpQ/1jOIcc+:jeqw4n6lHf2ipwD6DF8
- TLSH T18F132329E3DDDE82529285829E457836DC9E057295FC623033FF33BF1752581AD5382B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
- Size 3.1MB
- SHA256 15ad7ce2ebfda80a19bde288e71b7c63c1b3cd71416b7ee2df6504610de44883
- MD5 7e12fdfa73e292f21d91fab687229213
- SHA1 092919df467205f4b81337a73e1d8602c77d92ee
- SHA512 5e41cf585b2e549330b21d8e9f414fbe7588fe405c1b80d32053c14b98b45a001384c93ac32e7253910f01285f1c6efc0d46e163c1b0c3f017fd04f5bda20ad7
- SSDEEP 49152:8594T6Iiya9PlJdUI11loQlxI6Uh8Zvu4d7TmunCQ/XHaT9eGfcph9yv3fxJuQ:8P4uIiya9PeHQlxdQ4dGunCQfUer9yvr
- TLSH T19AE5AF13EB418031E5DA00B6C27A9B7A9D396730132590D7E7D06DE86EB45E27A3E34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
- Size 36KB
- SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
- MD5 171937a8fad6a1c8a37344d09d4fc20c
- SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
- SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
- SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
- TLSH T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
- Size 449B
- SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
- MD5 60bd20b51eb0483e93aa6f4cb0a84288
- SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
- SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
- TLSH T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
- Size 2KB
- SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
- MD5 d4893659007e98de701a47cd39991be3
- SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
- SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
- TLSH T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 436B
- SHA256 e600a41696c55ffcfde8c90cd7a8943b0b1c5aa28371873757dc1cd97d358c1f
- MD5 cb0cc89c69fd34cbc259d6b7ec6ae048
- SHA1 7f634f263aff512785de4c074465fd20e2ef2f96
- SHA512 6a1379ff7242149dc2f20ea62b52dd6c5a1b9e0dd5f2a3595bc05322edfb8095e9a4dccc1651fd6ede7c9ad3a0f1ada57bcb46ebe16303bab4d75ea7be96e0b9
- TLSH T1DAE0E544757DC51832A2425503A95010EC3386C0B9C5D3B01A1763BAB3B3B62F9A9EF4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 1KB
- SHA256 a5f26b0d5231f73f085550f9116058fbf435ee65d943eacfba35977b5443b466
- MD5 70c42b9422b6db2f113feafa4488e0ef
- SHA1 362f3ab412a67037c0605744e0ea240f9e41e325
- SHA512 6d2d57e4c90dc85b14c47e5ffa705d8533391325779e173d5034d23aa891cab370ebccc8ae19776718bf4739374d1a6c52d759e4d6547502b9551180d0264ff1
- TLSH T1A721FD02713DA85436E1424256B95410EC33CBC57B81C3705A06B3BAB373B72EA6FEE9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 101KB
- SHA256 766a4ff11bad2e5c9598e82f105c739f5ad934c64a0b29b2de143179ccb377fa
- MD5 88d4f183b0e18a5541b00e34e9a634aa
- SHA1 0ee06ce784731102385c530101873d3b53dfbbe7
- SHA512 8dc0510ea4e19d9dd177eeee2cbb1038e2b9c73af5ac046e96ecd138a8dd848994ec90cc20eaf1994858b76195dd2acf345c98fa1e248ba2bfa915a0216bb49c
- SSDEEP 3072:G5K6KSK1KGKSKU8IyNzbPind3iWmY72Ab0wlVE9yUfOP7ljAnUX7nrO1eJmxSNKM:GoMO
- TLSH T16AA3AE4229B475709767AFE595081BC36593392C0303F8A5B3ACBFE857FE8021E7D9A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
- Size 4KB
- SHA256 eb1ecb698ebddee5a23479054f073821c21d53a9b0a91ba9c7bde9e279552dca
- MD5 3bed6d3c22f8c96ac19f938375416121
- SHA1 81c00213a5221de659916355fc6cc7709e3eeb62
- SHA512 dece095383049bfde7b70d936a945eadfdc7503705ad0858ccce28efb8ab6b28b2f54bcd3f86ca2300a8b2f2cdaeee649aa291f9c6fb0c3b9ba3222aabcc1f7f
- SSDEEP 48:+7y4v/M24EP2IhREett2eW2+Em25EG292MEgy2aEM2jEgy2Pd2Jp2bESBE0EW2sD:+WUJLCej+kG6Dd7gsMjP
- TLSH T18D91E3193B98A57C073D436FB2885804C4506EC7B1B0B1ACFE545629C7F6367FAE8A1C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferup.log
- Size 455B
- SHA256 6a8cfd8fd7de2b838d98d126dbf4650d9f070fd791d964c0a91c172751fd80a7
- MD5 6f58b0db78086b9a98e7704d04645858
- SHA1 de3c35748a1cac38b576807c099f4f90d45e52ed
- SHA512 b1685aeef315434c847d1a4164d2231dfd37c5d1b035f33f021693ed98951955cb4ed110cc63776b5eb43b676ca70ef576d1df83812fba6fb2569d89350cce00
- TLSH T110F0DC156F30783C08BA8A2DB00A8048F0A562833020B0ECED98A1458B79BFF4AB5B0C
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Office439e\DCAgentServerInfo.json
- Size 1KB
- SHA256 408b849c2f806be22aead73f9a31810aa557a739617577ef034b40191ac51673
- MD5 905493a666956c905adabb5cb8c5f44c
- SHA1 720e08d9037544b9f8693d6bd26e093941aa4eb1
- SHA512 49f7c286b6fb65fdd030fef8fa61e7805e42a506ca54e51e73387623414cb777c0d568d092613049487e118a7afd8c61aed572b64e971ec16c184e884fa687bf
- TLSH T15F31DFA8D8130F576BDE960D544C2805A274012F0E147889B72CA4DDFFAD70F53F216D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Office439e\DMRootCA-Server.crt
- Size 1KB
- SHA256 57d42b31c15c11fe4057863cf09f50b3c6aeba05a99cee0935904d7572c8e3ea
- MD5 050709300abe290446798d363d48ae76
- SHA1 2193e904445f482b83465382f37ff4668db36bc8
- SHA512 da339199f4691c9f994710c625f8738368708fe06e27eed6ffd07dd9f7bd3d3e765c1e062584ef41cca48a685f3d7a8d13449ba3ddc248147087ba0a3235cff0
- TLSH T1FB21D6F98F143E3EB4C2D6A8CE1183327C5402235FD5B9830E4A3E4FAB925456809C05
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Office439e\DMRootCA.crt
- Size 1KB
- SHA256 0c0071c233b55cd3ae7b6a89369c91c6337d18b8b82f68902883fac51f97859e
- MD5 9704d9ee4e5e979e4e2cbea064740d40
- SHA1 0d9ad1e6f680d673ea7724e742440f31a3f43f3f
- SHA512 d295ef7377c35a85b670cb17a3a4fd25a480559ea09c7e751dccd8a04b90466de8d3eeb9645e0da446cfca14cf98ec8076e4918511c026ac8cd99743a903191e
- TLSH T15E31B72A875B7CE2B1C7F095D1A910109E7A97865CB726F218FFB806D344ED0476F14D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Office439e\UEMSAgent.msi
- Size 31.8MB
- SHA256 92f68fc7f6d0f544a750bf67b4903d1a4062d1372b7f98ab5c2f698eb61359bb
- MD5 db7ca603d463a06806ff1660979f406d
- SHA1 823ade4e43d36416436a115c48ba562d94fa696f
- SHA512 8e2527478514cf5ec8b40fa0ffc53d91ae72a1ba75a8c96800e06282b5e76e2f2f61f4b9e979c15f691591ee4f926b17aa07aebf31de68638b13e94db702b8d5
- SSDEEP 786432:juvkjbX98hUIlkZpqcvX4kp1h1HnX6Jx5L3gxKF:ivk3X98hUUspqcvokD3yxU6
- TLSH T1FD77337234438836D5C26CB095E6C364D2A60D508EB42453A677B2BBDAF37C296F73E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Office439e\UEMSAgent.mst
- Size 20KB
- SHA256 180195558475b32abedb88b3103c06ee464148809986b78de32d8fdba897c516
- MD5 0509fd12bad30c0cbe679a18bcb2042a
- SHA1 6c933d6b00da0a63621e646912a1079b2af5e0e5
- SHA512 9593e50f7c91fb06701938376255e3a50985a2b7559340f1f17d801026a2f5b8ef1348857b80a0d9b6559768525d68f148b372a50597b0ec8aac15309db800ee
- SSDEEP 48:k7xLm2JQMPTjbJc3GgCP/p/vvrdGRFXfJJa8:kdJQyNGo/JRST
- TLSH T14E924D4AF622E93ACA494A329D53C3CC0731BC01CD82425B76D8B7DFBC7A1841B165EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Office439e\agent_install.log
- Size 1KB
- SHA256 55ed7e27233eaa2b5e1ed35a67786c009bcbe160a929229dfb51cfbba5681572
- MD5 bcd77dc7425950220a19f401a68f8531
- SHA1 10381278536e1e42eb9cccfc5e2e2620172e3de7
- SHA512 339e683489308b0ba9fdead76f25c6b2de497ab9abfd276aa13b8c27e790a0f2d79cf17171d9adb774feff495eb5a6dba18eddc435663c9945decac2705397cc
- TLSH T16C31E5751AD6084AF1B25647AFF3C1521A33FCD658748F0C2389925A06BFD085DA83AB
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Office439e\w.zip
- Size 31.3MB
- SHA256 9dec5da7d1af32f1e3333e7269e93cda576277cf8c1354199b1dc954c0bc6caf
- MD5 dbce18136a64bc4ca17068cd605192b2
- SHA1 64848704f079f42f42e0af659bc0032af6c36626
- SHA512 a316b8a6f05f9fe3625adad29da715eb3c25939b83556a245b9b42f90697e08528c4b2a655d266f4f379da0d50a24da43d7be72bf9be9d8052c0d8b01b0ad949
- SSDEEP 786432:ZCxbdhnfCJMGPk1Di4DNOCFzzt7P18AnX07UL3Ea7:oxbXnfCJMAYDi4D0C5Z9nT3D7
- TLSH T1F67733F1B043895A9DC19CE0E6C5C144E28A41E5CE743AB7D17A53F6C2E7AC7A4E73A0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\DLM.log
- Size 392B
- SHA256 ac2f43750a7b1c1dddfcecec729a48880d968282442493ddcc15906cb3be7650
- MD5 30046a84c95029f3b8b4a069b23ecd83
- SHA1 61f37437ebf2f332cb9abda189b5c003ca1d64b6
- SHA512 ff5d2dac25d2cd14d2a4e44d913097a453291b772c3eff4841916641f552742caa5c9a7210c247ac0eaf095a806f48b377ea9633c20a5fd560859f0b4bc9ce27
- TLSH T13CE0172B056B4E02557287178EC6F116F03324F368318F4913B4020B036F812B4E232E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PDF_Z4R8K5_20261026110707.exe
- Size 1.1MB
- SHA256 81cf4d59df869abfe5034d160090d88bc9c573e8c5daf284fd29417d48411d5b
- MD5 8cf96be406d5b55912e4d79c2a533568
- SHA1 6f6a4f2802e72ce4b0eaad1094bb53a585bdf5d2
- SHA512 83175422ed11d694d31f23b71daf2992c1794be2250023a580490464e57bf3c8731a407d3a50bfb681f5c22fa76de2d82a88b9d1b3c4c591603dd7fc0e53ba3d
- SSDEEP 24576:+8q1L8bEuXsj6ME5pvOIogH5zpPNTKGKmmUYUsK2:FIL8bdXS6MSpvOIokpVTCUYU+
- TLSH T1FA356C0793E902ADE0B7E13C89678906E2767C5A07709ACF13A0795A2F737E19F79311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\crClIENT.DLL
- Size 31KB
- SHA256 0a2ded89cd63864ffe17b0fff0dfc1fe3db1b96607e2df7299d3ade49f573d19
- MD5 1cfeac46a1866eba6b3181b847a937b1
- SHA1 caf646d5299e5260f8156224e7fa4de2c52bcb2b
- SHA512 e1b934cc6516a374ccc3a8ff77ebee730f26037737ca13587ccd48b91d1d0129256eb3af6731a9746406937a4b96b80998b8563a710df74bea8b93f464b0b9d3
- SSDEEP 192:M1W69fMSsRLJx45GLGx+pzPHBwdQLbDSfWFYGO1AmTzMpUH3ymyc0mIWWxv0Yw1u:s/MSWLJx4f6w+GsuNwGHDyNv0Ywk
- TLSH T1D6E20746F78634FDCA97C67489B76737E631B4660218BE3F8368C7B61C31A005A7C9A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIB220.tmp
- Size 81KB
- SHA256 17805948e9d5f51fca01c13bb7dedb1f1a1e17bcf5cc0cb6c01d9f773b712744
- MD5 e9b3f881f3855718fe6a4ed7855bae30
- SHA1 cf19171cc1b2186c5e046c0a3195ce47532b215a
- SHA512 50c04cc4ff234bb97192af5b437838f81e3930b1c2024dc13bd292ff85f6ddbaa670c7e2c2a1ca90d2c9e8de1b0ec4c1e7c2aa49ada80a0f4a42f9e461f41c26
- SSDEEP 1536:A+xCoJw5hZFi1QmA2uFQW9z/gkcWBxk40OExFyoxM:nJw51i1PburjM+xEOExFy9
- TLSH T102837C117350C872E49A693468A9C7326D397D625EF884C77FD907794FA03C1AE3932B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dcagenthttp.dll
- Size 3.6MB
- SHA256 3de8d74127b797813742dd9fd618c38572b269f8dbb14af4d6014a1addec4e38
- MD5 c943a1cdbcd28058068b921cc8daa04e
- SHA1 2694d3588167cc0f940a30a5f4b13793e0cf181e
- SHA512 d5bee6a3a43d4b04e41d177af022ff03ac8a2971f0cc79265e00d027294e56b1de289773e487dba60664a6c9ba3d9f2f26bdd5453cc9220cd8313adf1868fd24
- SSDEEP 49152:eGvD7zfSmnd1o2Mm0A1qga6zN/zuNscwOWbKikCDp9ZqljvLQTeDTtJb83ph9h7Q:1D7zqmnd1oT4XN/zuNsSikq6Lzbs9VQ
- TLSH T1D106BF11FF82C176FECE1176827A4F7E4D3A9744076649C767A43AB80E311E26A3E247
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dclibxml2.dll
- Size 2.1MB
- SHA256 a451dd3babd79318b612072cb417fd4848be821a1607dc58ac31676e9312fd7a
- MD5 67cc424838fda84bad295b4459107c8b
- SHA1 404f865e84e6338735a0c38617d73031195c520f
- SHA512 1a3232bed3826065416a50866d02827765c66104ed49c533324f0cb614745028411bda63784f4f8c3819f9a72e65016171179d80d484d10e52300eaffbd44397
- SSDEEP 49152:e9DUM26DYbVgzTtuKlKuuGaXKbj/BAUZLYM7:TMfQgRBBAUZLT
- TLSH T1F9A5AE15F981C176E5E6807486FEEBB6982ECD31232460E376A639D45E341E232BD34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Tasks\DCAgentUpdater.job
- Size 448B
- SHA256 7fbc8c340a9771d536823d8ffd085f29bda90edff0b2f782c6f357e615650c0b
- MD5 01757d0c759c910358ba8f6464cff35b
- SHA1 9a398541af15dec425c2916dbdc263a78aa4dc7e
- SHA512 6df176cb567bf282d11a1d9e3ca036535f71606902bd50297ecf770dd3aa5dfd78404ca295b84c1b111c26a138eb64cfb5e0a3defe1af4f01011f65c146a8fdc
- TLSH T1A8F04F01ABE2015DF7735BB18AF149505776FD217A72D21D60B4020E0D66B40CA20777
- MD5 SHA1 SHA512 TLSH