• Ivanti Endpoint Manager

    Contributed By: Micah Babinski (mbabinski)

    The command-line arguments for the exes listed below occassionally contain fragmented, seemingly-random strings containing special unicode characters, what looks like bits of HTML or XML tags, and/or URL-enocoded strings. For example:

    • LDdrives.exe -p 51205 -c -s -b5D€Cv
    • LDdrives.exe -p 51205 -c -s -b8µq
    • LDdrives.exe -p 51205 -c -s "-b8¶(+N& "
    • LDmemory.exe -p 51207 -c -s "-b32164/><key nam=ÂgËo�"
    • LDnetwork.exe -p 51214 -c -s -b10žÊ/€/�

    These processes all spawn instances of Console Host (conhost.exe) with the 0x4 flag, like C:\Windows\system32\conhost.exe 0x4.