Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\ManageEngine UEMS - Agent] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\ManageEngine UEMS - Agent] 'ImagePath' = '"%ProgramFiles(x86)%\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"'
- [HKLM\SYSTEM\CurrentControlSet\Services\ManageEngine UEMS - Remote Control] 'ImagePath' = '"%ProgramFiles(x86)%\ManageEngine\UEMS_Agent\bin\dcrdservice.exe"'
Creates the following services
- 'ManageEngine UEMS - Agent' %ProgramFiles(x86)%\ManageEngine�MS_Agentin\dcagentservice.exe
- 'ManageEngine UEMS - Agent' %ProgramFiles(x86)%\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
- 'ManageEngine UEMS - Remote Control' %ProgramFiles(x86)%\ManageEngine�MS_Agentin\dcrdservice.exe
Modifies file system
Creates the following files
- C:\users\public\01e5cf08\<File name>.dll
- C:\users\public\01e5cf08\regsvr32.exe
- %TEMP%\generatorapp\runs\20260911-142830-488-1\runtime.log
- %TEMP%\generatorapp\runs\20260911-142831-4836-1\runtime.log
- C:\users\public\documents\wu\mutex.owner
- C:\users\public\documents\wu\runs\20260911-142831-4836-1\deploy.log
- C:\users\public\documents\wu\c2b8.zip
- C:\users\public\documents\wu\pkg\dcagentserverinfo.json
- C:\users\public\documents\wu\pkg\uemsagent.mst
- C:\users\public\documents\wu\pkg\dmrootca.crt
- C:\users\public\documents\wu\pkg\dmrootca-server.crt
- C:\users\public\documents\wu\pkg\dcremagentinstaller.exe
- C:\users\public\documents\wu\pkg\setup.bat
- C:\users\public\documents\wu\pkg\readme.html
- C:\users\public\documents\wu\pkg\uemsagent.msi
- C:\users\public\documents\wu\pkg\setup1.vbs
- C:\users\public\documents\wu\pkg\msi_install.log
- %WINDIR%\installer\e5b3c.mst
- %WINDIR%\temp\~dff44919739b0bca46.tmp
- %WINDIR%\installer\sourcehash{6ad2231f-ff48-4d59-ac26-405afae23db7}
- %WINDIR%\temp\~df9825e9b952c6c86f.tmp
- %WINDIR%\temp\~df4554869ca3945f14.tmp
- %WINDIR%\temp\~df40751d0a429569ba.tmp
- %ProgramFiles(x86)%\manageengine\uems_agent\images\lato.woff2
- %ProgramFiles(x86)%\manageengine\uems_agent\images\lato.woff
- %ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\chat.rgn
- %ProgramFiles(x86)%\manageengine\uems_agent\images\cold_send.gif
- %ProgramFiles(x86)%\manageengine\uems_agent\images\ec_icon.ico
- %ProgramFiles(x86)%\manageengine\uems_agent\images\minimize_button.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\announcement.png
- %ProgramFiles(x86)%\manageengine\uems_agent\data\configuration-settings-dc-win7.xml
- %ProgramFiles(x86)%\manageengine\uems_agent\data\data-dictionary-mc.xml
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\clientauthhandler.dll
- %WINDIR%\syswow64\dcagenthttp.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\images\logo_dark.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\hot_mover.gif
- %ProgramFiles(x86)%\manageengine\uems_agent\data\data-dictionary-vul.xml
- %ProgramFiles(x86)%\manageengine\uems_agent\images\computer.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\images\dropdownarrow.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\btn_rejected.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\data\dynamic-variables.xml
- %ProgramFiles(x86)%\manageengine\uems_agent\images\dropdown_hover.gif
- %ProgramFiles(x86)%\manageengine\uems_agent\data\data-dictionary-onpremise.xml
- %ProgramFiles(x86)%\manageengine\uems_agent\images\dcannouncement.ico
- %ProgramFiles(x86)%\manageengine\uems_agent\rds\webrtcdll.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\images\approval_status.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\messagebox_info.png
- %ProgramFiles(x86)%\manageengine\uems_agent\data\data-dictionary-edb.xml
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcagentregister.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\images\restart.png
- %ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\participantlist.rgn
- %ProgramFiles(x86)%\manageengine\uems_agent\images\dc_icon.ico
- %ProgramFiles(x86)%\manageengine\uems_agent\data\configuration-settings-dc-win8.xml
- %ProgramFiles(x86)%\manageengine\uems_agent\data\data-dictionary-inv.xml
- %ProgramFiles(x86)%\manageengine\uems_agent\images\refresh_inactive.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\console.swf
- %ProgramFiles(x86)%\manageengine\uems_agent\images\restart.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\images\warning_icon.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\otp-lock.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\remind.gif
- %ProgramFiles(x86)%\manageengine\uems_agent\images\refresh.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\scripts\addtcpipport.vbs
- %ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\console1.rgn
- %ProgramFiles(x86)%\manageengine\uems_agent\images\waiting.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\btn_request.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\proxy.swf
- %ProgramFiles(x86)%\manageengine\uems_agent\images\chat.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\updates.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\data\data-dictionary.xml
- %ProgramFiles(x86)%\manageengine\uems_agent\images\loader.gif
- %ProgramFiles(x86)%\manageengine\uems_agent\data\configuration-settings-dc-winxp.xml
- %ProgramFiles(x86)%\manageengine\uems_agent\images\otp-lock-fail.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\alert.png
- %ProgramFiles(x86)%\manageengine\uems_agent\scripts\messagebox.vbs
- %ProgramFiles(x86)%\manageengine\uems_agent\images\close_top.gif
- %ProgramFiles(x86)%\manageengine\uems_agent\images\btn_requested.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcagentupgrader.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\dcconfig.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\images\dcicon16.ico
- %ProgramFiles(x86)%\manageengine\uems_agent\images\pwd-show.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\remind_hover.gif
- %ProgramFiles(x86)%\manageengine\uems_agent\images\default.gif
- %ProgramFiles(x86)%\manageengine\uems_agent\images\info.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\drop_down_icon.png
- %ProgramFiles(x86)%\manageengine\uems_agent\scripts\initcmd.bat
- %ProgramFiles(x86)%\manageengine\uems_agent\images\btn_uninstall.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\dcagent.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\images\arrow_pull_left.png
- %ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\alert.rgn
- %ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\toolbar.rgn
- %ProgramFiles(x86)%\manageengine\uems_agent\images\detected_sw.png
- %ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\toolbar.swf
- %ProgramFiles(x86)%\manageengine\uems_agent\images\waiting_aprvl.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\tools_reboot_alert.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\me-sign.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\stamp_used.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\icon_alert.png
- %ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\invite.rgn
- %ProgramFiles(x86)%\manageengine\uems_agent\rds\agenthook.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\images\btn_install_all.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\proxy.rgn
- %ProgramFiles(x86)%\manageengine\uems_agent\images\btn_download_all.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\images\user.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\refresh_inactive.png
- %ProgramFiles(x86)%\manageengine\uems_agent\data\data-dictionary-framework.xml
- %ProgramFiles(x86)%\manageengine\uems_agent\images\find.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\config_install_alert.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\btn_install.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\data\configuration-settings-dc.xml
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\logger.conf
- %ProgramFiles(x86)%\manageengine\uems_agent\images\close_top_hover.gif
- %ProgramFiles(x86)%\manageengine\uems_agent\images\dropdown.gif
- %ProgramFiles(x86)%\manageengine\uems_agent\images\dc_icon.png
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\agent_binaries.7z
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\7z.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\data\wmi-classes.xml
- %ProgramFiles(x86)%\manageengine\uems_agent\scripts\bit-locker.bat
- %ProgramFiles(x86)%\manageengine\uems_agent\images\find.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\images\alert.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\images\sspicon.ico
- %ProgramFiles(x86)%\manageengine\uems_agent\data\data-dictionary-br.xml
- %ProgramFiles(x86)%\manageengine\uems_agent\images\minimize_icon.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\talkbackwidget.swf
- %ProgramFiles(x86)%\manageengine\uems_agent\images\icon_software.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\apps_active.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\images\minimize.gif
- %ProgramFiles(x86)%\manageengine\uems_agent\images\maximize_icon.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\rds\filetransfer\dcfiletransfer.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\rds\dc_rds.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\microsoftedge.admx
- %ProgramFiles(x86)%\manageengine\uems_agent\images\messagebox_warning.png
- %ProgramFiles(x86)%\manageengine\uems_agent\scripts\azurefs.ps1
- %ProgramFiles(x86)%\manageengine\uems_agent\images\ec_icon.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\images\restore_icon.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\images\detected.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\apps.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\images\logo_light.png
- %ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\talkbackwidget.rgn
- %ProgramFiles(x86)%\manageengine\uems_agent\data\configuration-settings-dc-win10.xml
- %ProgramFiles(x86)%\manageengine\uems_agent\images\style_cold.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\refresh.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\drop_down.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\console2.rgn
- %ProgramFiles(x86)%\manageengine\uems_agent\images\reboot_alert.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\uems_icon.ico
- %ProgramFiles(x86)%\manageengine\uems_agent\images\chatframe.ico
- %ProgramFiles(x86)%\manageengine\uems_agent\data\data-dictionary-rds.xml
- %ProgramFiles(x86)%\manageengine\uems_agent\scripts\disableenableethernet.vbs
- %ProgramFiles(x86)%\manageengine\uems_agent\licenses\license_libxml.txt
- %ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\participantlist.swf
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcagentservice.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dumpcreator.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\images\history.png
- %ProgramFiles(x86)%\manageengine\uems_agent\data\osdetection.json
- %ProgramFiles(x86)%\manageengine\uems_agent\images\style_hot.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\updates_active.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\images\hot_send.gif
- %ProgramFiles(x86)%\manageengine\uems_agent\data\agentapplicationresources.properties
- %ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\alert.swf
- %ProgramFiles(x86)%\manageengine\uems_agent\images\minimize_hover.gif
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\agentqppmupgrader.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\images\cold_normal.gif
- %ProgramFiles(x86)%\manageengine\uems_agent\images\x-icon.gif
- %ProgramFiles(x86)%\manageengine\uems_agent\images\patch.png
- %ProgramFiles(x86)%\manageengine\uems_agent\scripts\tools.vbs
- %ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\invite.swf
- %ProgramFiles(x86)%\manageengine\uems_agent\images\hover.gif
- %ProgramFiles(x86)%\manageengine\uems_agent\scripts\generalalerts.vbs
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\7z.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\7za.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\data\data-dictionary-pm.xml
- %ProgramFiles(x86)%\manageengine\uems_agent\images\history_ico.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\dcmsghandler.ico
- %WINDIR%\syswow64\dclibxml2.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\images\dc_msp_image.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\user.svg
- %ProgramFiles(x86)%\manageengine\uems_agent\rds\zchangenotifier.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\logs\dcagentinstaller.log
- %WINDIR%\installer\{6ad2231f-ff48-4d59-ac26-405afae23db7}\dcagentserverinfo.json
- %ProgramFiles(x86)%\manageengine\uems_agent\certificates\csr.pem
- %ProgramFiles(x86)%\manageengine\uems_agent\certificates\key.pem
- %ProgramFiles(x86)%\manageengine\uems_agent\logs\dcdatatransferup.log
- %ProgramFiles(x86)%\manageengine\uems_agent\certificates\client.pem
- %ProgramFiles(x86)%\manageengine\uems_agent\certificates\client.p12
- %ProgramFiles(x86)%\manageengine\uems_agent\data\imagefactor.json
- %ProgramFiles(x86)%\manageengine\uems_agent\logs\imagefactoraccess.log
- %TEMP%\certificates\client.p12_8193_3892
- %ALLUSERSPROFILE%\microsoft\crypto\keys\64104da19811b9afb63af1590878f729_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %TEMP%\certificates\client.p12_8200_3892
- %ALLUSERSPROFILE%\microsoft\crypto\keys\07f11a4f5e3b7c95301b882e438a4219_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %TEMP%\dc3892.tmp
- %ProgramFiles(x86)%\manageengine\uems_agent\logs\dcdatatransferdown.log
- %ProgramFiles(x86)%\manageengine\uems_agent\client-data\server-certificates\dmrootca.crt
- %ProgramFiles(x86)%\manageengine\uems_agent\client-data\1\server-certificates\dmrootca.crt
- %TEMP%\certificates\client.p12_8232_3892
- %ALLUSERSPROFILE%\microsoft\crypto\keys\07101a2e04623777b29ba6cf5ba618f5_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %ProgramFiles(x86)%\manageengine\uems_agent\data\osdetection.json.gz3892.tmp
- %ProgramFiles(x86)%\manageengine\uems_agent\data\osdetection.json.gz
- %ProgramFiles(x86)%\manageengine\uems_agent\logs\dcagentinstallerunzip.log
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\ca-certs.zip
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\cold_normal_msghldr.gif
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcrdsagentwindow.exe.config
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcscreenrec.exe.config
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dctoolshardware.exe.config
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dc_msp_image.png
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\devexe32.exe.config
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\devexe64.exe.config
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\driverfiles.7z
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\hot_mover_msghldr.gif
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\lato-bold.eot
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\lato-medium.eot
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\ohotfix.ini
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\rdsrunasuser.exe.config
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\topmiddle.bmp
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_444444_256x240.png
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_555555_256x240.png
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_777620_256x240.png
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_777777_256x240.png
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_cc0000_256x240.png
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_ffffff_256x240.png
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\wakeonlan.exe.config
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\agent_troubleshooting_tool.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\cfgupdate.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\checkvolume.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\clientauthhandler64.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\clientsocket.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcaddonsevaluator.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcagenttrayicon.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcannouncement.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcappcontrol.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcchat.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dccomponentregister.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcconfigexec.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcfaservice.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcfaservice64.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcfauser.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcfilescan.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcinventory.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcmsghandler.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcondemand.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcondemandtasks.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcpatchscan.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcprocessmonitor.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcproxyfinder.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcrdsagentwindow.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcrdservice.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcscreenrec.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcstatusutil.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcswmeter.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dctask64.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dctoolshardware.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcuninstallsw.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcupload.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcusb32.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcusb64.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcusbsummary.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcwol.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dcwolsettings.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dc_cad.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\detoureddll32.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\detoureddll64.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\devexe32.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\devexe64.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dpinst64.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\dpinst86.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\file_system_watcher.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\folder_backup.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\mdmregistrationhandler.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\mdmregistrationhandler_64.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\meaap.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\meaaphelper.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\metroapps.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\msvcp110.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\msvcr110.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\nativeuihandler.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\rapchat.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\rdsrunasuser.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\remcomm.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\resources.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\sas.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\secaddoncrashanalyser.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\securedcprocess.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\selfservicedll.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\selfserviceexe.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\selfserviceportal.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\sysmanager.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\toolsiq.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\uemsnotifications.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\uicontrols.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\usbedevicelist.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\vccorlib110.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\wakeonlan.exe
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\wsclientsocket.dll
- %ProgramFiles(x86)%\manageengine\uems_agent\manageengine self service portal.lnk
- %TEMP%\certificates\client.p12_8262_3892
- %ALLUSERSPROFILE%\microsoft\crypto\keys\dd90c9359a24559342ba67461bbe972f_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %ProgramFiles(x86)%\manageengine\uems_agent\data\agentapplicationresources.properties3892.tmp
Deletes following files that it created itself
- C:\users\public\documents\wu\c2b8.zip
- %TEMP%\certificates\client.p12_8193_3892
- %ALLUSERSPROFILE%\microsoft\crypto\keys\64104da19811b9afb63af1590878f729_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %TEMP%\certificates\client.p12_8200_3892
- %ALLUSERSPROFILE%\microsoft\crypto\keys\07f11a4f5e3b7c95301b882e438a4219_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %TEMP%\dc3892.tmp
- %TEMP%\certificates\client.p12_8232_3892
- %ALLUSERSPROFILE%\microsoft\crypto\keys\07101a2e04623777b29ba6cf5ba618f5_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %ProgramFiles(x86)%\manageengine\uems_agent\data\osdetection.json.gz3892.tmp
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\ca-certs.zip
- %ProgramFiles(x86)%\manageengine\uems_agent\bin\agent_binaries.7z
- %TEMP%\certificates\client.p12_8262_3892
- %ALLUSERSPROFILE%\microsoft\crypto\keys\dd90c9359a24559342ba67461bbe972f_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %ProgramFiles(x86)%\manageengine\uems_agent\data\agentapplicationresources.properties3892.tmp
Moves the following files
- from %ProgramFiles(x86)%\manageengine\uems_agent\images\lato.woff to C:\config.msi\e5b40.rbf
- from %ProgramFiles(x86)%\manageengine\uems_agent\images\info.png to C:\config.msi\e5b41.rbf
- from %ProgramFiles(x86)%\manageengine\uems_agent\images\drop_down_icon.png to C:\config.msi\e5b42.rbf
- from %ProgramFiles(x86)%\manageengine\uems_agent\bin\lato-bold.eot to %ProgramFiles(x86)%\manageengine\uems_agent\images\lato-bold.eot
- from %ProgramFiles(x86)%\manageengine\uems_agent\bin\lato-medium.eot to %ProgramFiles(x86)%\manageengine\uems_agent\images\lato-medium.eot
- from %ProgramFiles(x86)%\manageengine\uems_agent\bin\resources.exe to %ProgramFiles(x86)%\manageengine\uems_agent\images\resources.exe
- from %ProgramFiles(x86)%\manageengine\uems_agent\bin\topmiddle.bmp to %ProgramFiles(x86)%\manageengine\uems_agent\images\topmiddle.bmp
- from %ProgramFiles(x86)%\manageengine\uems_agent\bin\cold_normal_msghldr.gif to %ProgramFiles(x86)%\manageengine\uems_agent\images\cold_normal_msghldr.gif
- from %ProgramFiles(x86)%\manageengine\uems_agent\bin\hot_mover_msghldr.gif to %ProgramFiles(x86)%\manageengine\uems_agent\images\hot_mover_msghldr.gif
- from %ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_444444_256x240.png to %ProgramFiles(x86)%\manageengine\uems_agent\images\images\ui-icons_444444_256x240.png
- from %ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_555555_256x240.png to %ProgramFiles(x86)%\manageengine\uems_agent\images\images\ui-icons_555555_256x240.png
- from %ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_777620_256x240.png to %ProgramFiles(x86)%\manageengine\uems_agent\images\images\ui-icons_777620_256x240.png
- from %ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_777777_256x240.png to %ProgramFiles(x86)%\manageengine\uems_agent\images\images\ui-icons_777777_256x240.png
- from %ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_cc0000_256x240.png to %ProgramFiles(x86)%\manageengine\uems_agent\images\images\ui-icons_cc0000_256x240.png
- from %ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_ffffff_256x240.png to %ProgramFiles(x86)%\manageengine\uems_agent\images\images\ui-icons_ffffff_256x240.png
Substitutes the following files
- %ProgramFiles(x86)%\manageengine\uems_agent\images\lato.woff
- %ProgramFiles(x86)%\manageengine\uems_agent\images\info.png
- %ProgramFiles(x86)%\manageengine\uems_agent\images\drop_down_icon.png
Network activity
Connects to
- 'pu####.#iantianxiazai88.com':443
- 'x1.#.lencr.org':80
- 'pu####.wantiyou.wiki':443
- '11#.#07.11.22':8151
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'pu####.#iantianxiazai88.com':443
- 'pu####.wantiyou.wiki':443
- '11#.#07.11.22':8151
UDP
- DNS ASK pu####.#iantianxiazai88.com
- DNS ASK x1.#.lencr.org
- DNS ASK pu####.wantiyou.wiki
Miscellaneous
Adds a root certificate
Creates and executes the following
- '%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcagentregister.exe' -i dc
- '%ProgramFiles(x86)%\manageengine\uems_agent\bin\7za.exe' e -mx9 "%ProgramFiles(x86)%\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"%ProgramFiles(x86)%\ManageEngine\UEMS_Agent\bin\" -y
- '%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcstatusutil.exe' -install 22
Executes the following
- '<SYSTEM32>\rundll32.exe' "C:\Users\Public\01E5CF08\<File name>.dll",#200
- '<SYSTEM32>\msiexec.exe' /i "C:\Users\Public\Documents\WU\pkg\UEMSAgent.msi" TRANSFORMS="C:\Users\Public\Documents\WU\pkg\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\U...
- '%WINDIR%\syswow64\cmd.exe' /C systeminfo.exe > "%ProgramFiles(x86)%\ManageEngine\UEMS_Agent\\logs\systeminfo.log"
- '%WINDIR%\syswow64\systeminfo.exe'
- '<SYSTEM32>\rundll32.exe' "C:\Users\Public\01E5CF08\<File name>.dll",#200' (with hidden window)
- '<SYSTEM32>\msiexec.exe' /i "C:\Users\Public\Documents\WU\pkg\UEMSAgent.msi" TRANSFORMS="C:\Users\Public\Documents\WU\pkg\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\U...' (with hidden window)
