EchoTrail

ADAudit Plus 9.0.0

by ZOHO Corpinstaller signed by ZOHO Corporation Private LimitedValid

Sources: observed in the EchoTrail lab on Windows 11 on October 26, 2026.

The install

Installer
manageengine_adaudit_plus_x64_ga.exe
Installer type
installshield
Installed through
the screenshot-and-model clicker
Install directory
C:\Program Files\ManageEngine
Launched
ADAudit.exe
Windows
Windows 11
Date
October 26, 2026
Executables dropped
398

installer sha256 3fa81dd967b888a2a5a9d986b52878fd35a36542845bd4e947966acb8fa36ab2

The lab used ADAudit Plus for 5 minutes, then rebooted and watched what came back.

On screen

Frames from the lab session, cropped to ADAudit Plus's own windows.

ADAudit Plus 9.0.0: Worth a look
Worth a look. A Question dialog asks 'This will uninstall ADAudit Plus 8.0. Do you want to continue?' with Yes and No buttons, over an unrelated Edge window.
ADAudit Plus 9.0.0: Worth a look
Worth a look. A full-screen Microsoft Edge first-run page titled 'Stay current with your browsing data' is showing, not the ADAudit app.
ADAudit Plus 9.0.0: Worth a look
Worth a look. A full-screen Microsoft Edge first-run page is showing, which is not the adaudit.exe window, and no app window is visible in the screenshot.

What it dropped

Executables

  • icudt67.dllNotSigned
    C:\Program Files\ManageEngine\ADAudit Plus\pgsql\bin\icudt67.dll
    sha256 5ff9c8026344e886f280ddfa235a1e16e1bcd396e90f9ed600b6f71d9d881ae8
  • adauditplusagent-x64.msi
    C:\Program Files\ManageEngine\ADAudit Plus\webapps\adap\agent\ADAuditPlusAgent-x64.msi
  • jvm.dllsigned by CN="Azul Systems, Inc.", O="Azul Systems, Inc.", L=Sunnyvale, S=California, C=US, SERIALNUMBER=3500498, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=USValid
    C:\Program Files\ManageEngine\ADAudit Plus\jre\bin\server\jvm.dll
    sha256 f4e7cb349a19b5eb50b860d3e9a9cc5c985f9aee1c9dda3ce3ae848a51c3f74a
  • postgres.exeNotSignedran during the lab session
    C:\Program Files\ManageEngine\ADAudit Plus\pgsql\bin\postgres.exe
    sha256 db14ddb0efc10b72b57dc29dbce5a719e2755dcd0ae54297d0ea4bbfc75f79a0
  • wxmsw3210u_core_vc_x64_custom.dll
    C:\Program Files\ManageEngine\ADAudit Plus\pgsql\bin\wxmsw3210u_core_vc_x64_custom.dll
    sha256 f9a0e80ba4e4d0b42b6ed4119275203be00898050fb0f62791a04b852b61f809
  • adauditplusagent-x86.msi
    C:\Program Files\ManageEngine\ADAudit Plus\webapps\adap\agent\ADAuditPlusAgent-x86.msi
  • libcrypto-3-x64.dllNotSigned
    C:\Program Files\ManageEngine\ADAudit Plus\pgsql\bin\libcrypto-3-x64.dll
    sha256 94dbbfb2f37794670c09072e578d363f2a2913b53ff777c4b48ef7afcbdaada7
  • wxbase3210u_vc_x64_custom.dll
    C:\Program Files\ManageEngine\ADAudit Plus\pgsql\bin\wxbase3210u_vc_x64_custom.dll
    sha256 3cd9ff8e59c84fa71c897d3ece15e9022f23cec023da0817fd94f53b9d025572
  • adauthwmi.dll
    C:\Program Files\ManageEngine\ADAudit Plus\lib\native\ADAuthWmi.dll
    sha256 a9404c469839cd982aefcaa6aebf98abba6eef0a96de0f1165845a3f7477f8a3
  • adauthwmi.dll
    C:\Program Files\ManageEngine\ADAudit Plus\lib\native\system64\ADAuthWmi.dll
    sha256 a9404c469839cd982aefcaa6aebf98abba6eef0a96de0f1165845a3f7477f8a3
  • adutil.dll
    C:\Program Files\ManageEngine\ADAudit Plus\lib\native\ADUtil.dll
    sha256 7b4258b8721d5cf2fbfeb208ad9a042cb36469b2702d992a1577593d3afad707
  • adutil.dll
    C:\Program Files\ManageEngine\ADAudit Plus\lib\native\system64\ADUtil.dll
    sha256 7b4258b8721d5cf2fbfeb208ad9a042cb36469b2702d992a1577593d3afad707
  • icuin67.dllNotSigned
    C:\Program Files\ManageEngine\ADAudit Plus\pgsql\bin\icuin67.dll
    sha256 23d5914acf071f566df19aaf404373e5c73c9910c370e728976f6202c04cf6c3
  • manageengineadsframework.dll
    C:\Program Files\ManageEngine\ADAudit Plus\lib\native\ManageEngineADSFramework.dll
    sha256 c09e42954689369b486d56f805e9422bd006ac5ed299d6efb77029313453dab5
  • manageengineadsframework.dll
    C:\Program Files\ManageEngine\ADAudit Plus\lib\native\system64\ManageEngineADSFramework.dll
    sha256 c09e42954689369b486d56f805e9422bd006ac5ed299d6efb77029313453dab5
  • icuuc67.dllNotSigned
    C:\Program Files\ManageEngine\ADAudit Plus\pgsql\bin\icuuc67.dll
    sha256 2fb4007a1f1089a0807cc1abde5443f5c3b0865ecfd80344b6ad165f1fe53ade
  • libiconv-2.dllNotSigned
    C:\Program Files\ManageEngine\ADAudit Plus\pgsql\bin\libiconv-2.dll
    sha256 3ee9786ab3eb8dfd791bdbd17c7e791dbe025734befcded0ee4170e1089f79df
  • adsmsecurity.dllsigned by CN=ZOHO Corporation Private Limited, O=ZOHO Corporation Private Limited, L=Chennai, S=Tamil Nadu, C=INValid
    C:\Program Files\ManageEngine\ADAudit Plus\lib\native\ADSMSecurity.dll
    sha256 7aeefd98e460abac89c490309b33d15a387eac422574e38e2e05d0923011ec6d
  • adsmsecurity.dllsigned by CN=ZOHO Corporation Private Limited, O=ZOHO Corporation Private Limited, L=Chennai, S=Tamil Nadu, C=INValid
    C:\Program Files\ManageEngine\ADAudit Plus\lib\native\system64\ADSMSecurity.dll
    sha256 7aeefd98e460abac89c490309b33d15a387eac422574e38e2e05d0923011ec6d
  • issetup.dll
    C:\Program Files (x86)\InstallShield Installation Information\{B4E87CC6-F195-4CFE-92A2-8439FC3716C9}\ISSetup.dll
  • microsoft.sharepoint.client.dll
    C:\Program Files\ManageEngine\ADAudit Plus\lib\native\sharePointOnlineCSOM\Microsoft.SharePoint.Client.dll
    sha256 a11586daaea334c7db8156473d8c53bfe290d70ceae3cf54a84633df4be0883d
  • awt.dllsigned by CN="Azul Systems, Inc.", O="Azul Systems, Inc.", L=Sunnyvale, S=California, C=US, SERIALNUMBER=3500498, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=USValid
    C:\Program Files\ManageEngine\ADAudit Plus\jre\bin\awt.dll
    sha256 319e83db807ffcbeb6c799f68e1c496230c4332006440732bf42d856395e319d
  • ucrtbase.dll
    C:\Program Files\ManageEngine\ADAudit Plus\jre\bin\ucrtbase.dll
    sha256 d404dc9aa843d53d7e276dd078b2cac8d7aa905e2838a1fe8385278e19ba3810
  • 7za.exeNotSignedran during the lab session
    C:\Program Files\ManageEngine\ADAudit Plus\tools\archiver\windows\x86-64\7za.exe
    sha256 35d4d69d7cd6cb44558f208c3b1334268013f9daf82d2dda848893a1c30c59c2
  • libxml2.dllNotSigned
    C:\Program Files\ManageEngine\ADAudit Plus\pgsql\bin\libxml2.dll
    sha256 fa13b5d8bdc8254a6a7f0bc9b26331fa6badf096334bb912e7dc6928206a74a0
  • remcom.exe
    C:\Program Files\ManageEngine\ADAudit Plus\bin\RemCom.exe
    sha256 b0dee57badb65c87a01882a1fd66fd37ac7e8e807094428ce396dd557ee7e605
  • remcom.exe
    C:\Program Files\ManageEngine\ADAudit Plus\bin\system64\RemCom.exe
    sha256 b0dee57badb65c87a01882a1fd66fd37ac7e8e807094428ce396dd557ee7e605
  • ecpg.exe
    C:\Program Files\ManageEngine\ADAudit Plus\pgsql\bin\ecpg.exe
    sha256 d820039f60f13c06dd27a58b7a7d6eb6a64f58a589c11cad41255e2e3daa530f
  • fontmanager.dllsigned by CN="Azul Systems, Inc.", O="Azul Systems, Inc.", L=Sunnyvale, S=California, C=US, SERIALNUMBER=3500498, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=USValid
    C:\Program Files\ManageEngine\ADAudit Plus\jre\bin\fontmanager.dll
    sha256 b0deacbf68c52baef9cba648ca79728476170e279dee363c18a843c01d2f4b8c
  • setup.exefile_missingran during the lab session
    C:\Program Files (x86)\InstallShield Installation Information\{B4E87CC6-F195-4CFE-92A2-8439FC3716C9}\setup.exe
    sha256 a9f3a36f603129ab5c89f3ea456c592c903e0e7fb0b1dd2a5830c4a3633fe4b0
  • wxmsw3210u_xrc_vc_x64_custom.dll
    C:\Program Files\ManageEngine\ADAudit Plus\pgsql\bin\wxmsw3210u_xrc_vc_x64_custom.dll
    sha256 f9352c12adcaac6485a810a42bf662a6911e05ba097198b0cc07b14a87b1d483
  • 7za.exe
    C:\Program Files\ManageEngine\ADAudit Plus\tools\archiver\windows\x86\7za.exe
    sha256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
  • msvcr100.dll
    C:\Program Files\ManageEngine\ADAudit Plus\lib\native\msvcr100.dll
    sha256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
  • msvcr100.dll
    C:\Program Files\ManageEngine\ADAudit Plus\lib\native\system64\msvcr100.dll
    sha256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
  • msvcr100.dll
    C:\Program Files\ManageEngine\ADAudit Plus\bin\msvcr100.dll
    sha256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
  • libssl-3-x64.dllNotSigned
    C:\Program Files\ManageEngine\ADAudit Plus\pgsql\bin\libssl-3-x64.dll
    sha256 98d4d505fe2fb4c4cf9e370cfa35078bc7aa964136ef908b71d783536e48f1dd
  • libzstd.dllNotSigned
    C:\Program Files\ManageEngine\ADAudit Plus\pgsql\bin\libzstd.dll
    sha256 287e7e474961e8886a3d961e2c07da647a7ac8d60d97023545f3a3ecf604daba
  • libcurl.dll
    C:\Program Files\ManageEngine\ADAudit Plus\pgsql\bin\libcurl.dll
    sha256 5a94033492cceb948e6d45b963adda653436abcea939a6c08c7103b5e88d768f
  • wxmsw3210u_html_vc_x64_custom.dll
    C:\Program Files\ManageEngine\ADAudit Plus\pgsql\bin\wxmsw3210u_html_vc_x64_custom.dll
    sha256 79a190ae358911dbfdba750cbcaa83a629be02a31cfb973d34300a5ce0408f02
  • dict_snowball.dll
    C:\Program Files\ManageEngine\ADAudit Plus\pgsql\lib\dict_snowball.dll
    sha256 57a5d3fad8be4ff376e7fa0c67954676862422a07c9f772b67804bd899daf318

After the reboot

Autostart entries

  • service: ManageEngine ADAudit Plus - DataEngine XNode"C:\Program Files\ManageEngine\ADAudit Plus\bin\wrapper.exe" -s "C:\Program Files\ManageEngine\ADAudit Plus\apps\dataengine-xnode\conf\wrapper.conf"

What it talked to

Destinations

  • 127.0.0.1:33307asked by java.exe8 connections
  • 127.0.0.1:33307asked by psql.exe6 connections
  • 149.5.45.67:80asked by manageengine_adaudit_plus_x64_ga.exe4 connections
  • 127.0.0.1:33307asked by pg_isready.exe3 connections
  • 127.0.0.1:50195asked by java.exe2 connections
  • 127.0.0.1:50197asked by java.exe2 connections
  • 127.0.0.1:50189asked by java.exe2 connections
  • 127.0.0.1:50191asked by java.exe2 connections
  • 127.0.0.1:50193asked by java.exe2 connections
  • 136.143.189.18:443asked by manageengine_adaudit_plus_x64_ga.exe2 connections
  • 104.18.38.233:80asked by wrapper.exe
  • 127.0.0.1:32001asked by java.exe
  • 127.0.0.1:32000asked by java.exe
  • 149.5.45.67:443asked by manageengine_adaudit_plus_x64_ga.exe
  • 172.64.149.23:80asked by wrapper.exe

DNS

  • crl.usertrust.comasked by wrapper.exe
  • forms.manageengine.comasked by manageengine_adaudit_plus_x64_ga.exe
  • go.microsoft.comasked by iexplore.exe
  • ocsp.comodoca.comasked by wrapper.exe
  • www.manageengine.comasked by manageengine_adaudit_plus_x64_ga.exe