c2b8.zip
- SHA256 d0ce3a37913020b1b37b239645b254b04e4e9af8b50ba6b6c8977c4eec39a17c
Overview
overview
8Static
static
1README.html
windows10-2004-x64
3README.html
windows11-ltsc_2024-x64
3RemCom.exe
windows10-2004-x64
3RemCom.exe
windows11-ltsc_2024-x64
3UEMSAgent.msi
windows10-2004-x64
7UEMSAgent.msi
windows11-ltsc_2024-x64
7dcremagent...er.exe
windows10-2004-x64
3dcremagent...er.exe
windows11-ltsc_2024-x64
3setup.bat
windows10-2004-x64
3setup.bat
windows11-ltsc_2024-x64
3setup1.vbs
windows10-2004-x64
7setup1.vbs
windows11-ltsc_2024-x64
8Static task
static1
Behavioral task
behavioral1
Sample
README.html
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
README.html
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
RemCom.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
RemCom.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
UEMSAgent.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral6
Sample
UEMSAgent.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral7
Sample
dcremagentinstaller.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
dcremagentinstaller.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
setup.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
setup.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
setup1.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral12
Sample
setup1.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target c2b8.zip
- Size 33.0MB
- Sample260721-phrxmabl3x
- SHA256 d0ce3a37913020b1b37b239645b254b04e4e9af8b50ba6b6c8977c4eec39a17c
- MD5 75f411ed2c6cf42fa11015a26897f75c
- SHA1 3410fac209496ec91488dc81db50299b872833b1
- SHA512 a43e0b0203fca02defb7eb503290b13f8d5b5b5a0bb0ce1501a8b0c79475ecee42687fea7752178e4b142ecb68c18b52fbef9540ef0ff1af8fb1fc05b613a208
- SSDEEP 786432:nM7YCxbdhnfCJMGPk1Di4DNOCFzzt7P18AnX07UL3Ea+:MJxbXnfCJMAYDi4D0C5Z9nT3D+
- TLSH T1F97733F1A442896BA9C1DCA0E7C5C184E28641E5CE743D77E16A53F3C2E7AC794E72E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
c2b8.zip.zip 33.0MB
-
DCAgentServerInfo.json1KB
-
DMRootCA-Server.crt1KB
-
DMRootCA.crt1KB
-
README.html.html 2KB
-
RemCom.exe.exe 3.1MB
-
UEMSAgent.msi.msi 31.8MB
-
UEMSAgent.mst20KB
-
dcremagentinstaller.exe.exe 194KB
-
setup.bat3KB
-
setup1.vbs.vbs 1KB
DCAgentServerInfo.json
- SHA256 d613c6b25b6ff6db2c7f1aa60d7c42ddaf1280d41d13ea8b55f8165aecd6f7c0
- MD5 f4ba296deb010eda962b592e1a2da8c9
- SHA1 061ae74cec70de307ece716d82ab79e3c650fb3b
- SHA512 fe5787ef119dab9425ff66274199dad16596ec4e1a9a11fdca32be8d4d5ed466223894d4e67052c6aa82d2132428906a18ad88a14e775595fd47809f143d5019
- TLSH T1EB3110F8D8130E575ACE8B18A42C2C05AAA4012F5C15384C7B5C66ADBFAD61F13F283F
- MD5 SHA1 SHA512 TLSH
DMRootCA-Server.crt
- SHA256 07dad440f495de28c0ac5b2638b7dca3a4ca3d4c5e1bdd9dc1d872ed5b7a75f8
- MD5 ba4aa3ca0ad076efc3f6bb16949e99b1
- SHA1 ea0eca5c0e0a4d338fa254f695c0c8f6efc1b275
- SHA512 19479543bc1224544e2eee65b0ffb01c24a529f59d7aa6bb848883322d812ba3e5cd7dae06c03e1cf2686606e89ccfb8d2baf43ca2701f21e6d7adf2de902460
- TLSH T16721B6AA0F247EFA15BBF578D48801190C85692B9FC8AD408C4D29B58B8B424666E889
- MD5 SHA1 SHA512 TLSH
DMRootCA.crt
- SHA256 e4c972c982a54150a6cefd83109131912a0941e6c367b9b650dce831d97d64b9
- MD5 02efe0982c996e2590aa0aa94bffc299
- SHA1 49fb668bd3250eb1bfa496f9edeb9e0f81379f30
- SHA512 d39e23bf146c89491588083372a5733cedd1b56ea0a398de71b79109cb0a2c8ea2bf4a2f9940fa7e640c2abebc81d02ddbeff08b7a8c053613d33b6ab99e7f08
- TLSH T1C231DA568D8668E4E482F0D5E0BA04168F5F81E6A477E73218D739B3DB84A53123914C
- MD5 SHA1 SHA512 TLSH
README.html
- SHA256 c430a6802aa574bb46874cd15321b27a4ba69c55c04f1f83072acce7b5e8a452
- MD5 ab3a8287f8e9ab6d80ab5870c9f844a6
- SHA1 5e521d5161bfab7b2c041146aa1e12ee85a1ba4c
- SHA512 1143e5a5dc825152d64a7af57c19f495a1a21192f3b16cd7aed9c6acfaf796d093f692655b74d7f516576acc96726b821cf8034978baabb9cbcd1783b8d48bee
- TLSH T11E51DC73D7926F37A163035E714AE3D82F11F1C19054AB18B2BA81D67DCA12B60673DE
- MD5 SHA1 SHA512 TLSH
RemCom.exe
- IMPHASH 098fd29fd58f8494ca12a788b4f7c2ba
- SHA256 7a1dcf22a67c194367d4ef65304cf69c11df0b14c3d08215b7ee81373a3cefba
- MD5 3e298792e73b58dd0b0d81f91683d9e0
- SHA1 ed5066d483b7249dc75fa4b0578108f96b8c91fb
- SHA512 aa3ce01fe0f5602cc79fe8879cfd773e0bbde8a820f81baa95698a5346b4cc1c6bb36cd39839995cb308cf9248e566500fdf8c040e022130693f01e9a04c6f66
- SSDEEP 98304:qI4kvKvHx15RFAN4z4yGTpOnHNQc9xQrpf:qI4kU5RFRzw9OnHt92rl
- TLSH T108E59D13FE418471FAC2013B82FD5FBA8D7E9610136DA9E3669539B44F702D26A3934B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6b:b6:c5:7d:1c:29:57:a1:97:6a:43:58:6c:09:ca:b6:44:d3:d7:13:c3:78:13:93:59:f5:83:dc:b4:06:69:2b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN
Chains
Jul 15, 2024
CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Sep 19, 2018 - Jan 28, 2028
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Mar 18, 2029
Subject
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN
Serial Number
44:85:59:e8:d5:9f:e0:56:29:9e:6e:8f
Issuer
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 11, 2023 - Oct 9, 2026
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
5
Entry point
1978662
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
d:\Webhost\15-07-2024\WindowsBuilds\DC_NATIVE\8716047\desktopcentral\ONPREMISE\REMCOM_BUILD\RemCom\Release\RemCom.pdb
mpr
WNetCancelConnection2A
WNetAddConnection2A
crypt32
CertFreeCertificateContext
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertOpenStore
CertCloseStore
CryptMsgClose
CertGetNameStringW
CertGetNameStringA
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
ws2_32
getaddrinfo
inet_ntoa
accept
listen
closesocket
htons
bind
setsockopt
connect
send
WSASetLastError
recv
freeaddrinfo
getservbyname
getnameinfo
WSAStartup
WSAGetLastError
ntohs
getsockname
WSACleanup
gethostbyname
getsockopt
socket
ioctlsocket
kernel32
FormatMessageA
HeapFree
GetProcessHeap
HeapAlloc
SetConsoleMode
GetConsoleMode
ReadConsoleA
GetStdHandle
CopyFileA
GetCurrentDirectoryA
FindResourceA
Sleep
WaitNamedPipeA
SetConsoleTitleA
GetCurrentProcessId
ExitThread
SetConsoleCursorPosition
FillConsoleOutputCharacterA
GetConsoleScreenBufferInfo
WaitForSingleObject
CreateProcessA
GetTickCount
SetLastError
GetComputerNameA
SetConsoleCtrlHandler
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
InterlockedIncrement
GetModuleHandleExW
GetEnvironmentVariableW
GetModuleHandleW
GetFileType
GetVersion
TlsGetValue
InterlockedCompareExchange
TlsSetValue
InitializeCriticalSectionAndSpinCount
InterlockedExchangeAdd
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
TlsFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
CreateFiber
SwitchToFiber
DeleteFiber
FormatMessageW
ReadConsoleW
ConvertThreadToFiber
ConvertFiberToThread
FreeLibrary
LoadLibraryW
LocalFree
FindFirstFileW
FindNextFileW
WaitForMultipleObjects
ResetEvent
ReleaseMutex
CreateMutexW
GetSystemInfo
CreateEventW
GetLogicalDriveStringsW
ExpandEnvironmentStringsW
GetTempPathW
GetSystemDirectoryW
GetLongPathNameW
FindClose
GetTimeZoneInformation
GetSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
WideCharToMultiByte
MultiByteToWideChar
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetDiskFreeSpaceExW
CreateDirectoryW
RemoveDirectoryW
DeleteFileW
CreateHardLinkW
MoveFileExW
CopyFileW
SetFileAttributesW
SetFileTime
GetFileAttributesExW
GetFileAttributesW
SetThreadPriority
SetEvent
GetExitCodeThread
TryEnterCriticalSection
VirtualQuery
SetEndOfFile
lstrlenA
GetDriveTypeW
SetEnvironmentVariableA
CompareStringW
CreateFileW
WriteConsoleW
IsValidLocale
EnumSystemLocalesA
GetModuleHandleA
GetProcAddress
GetCurrentProcess
GetEnvironmentVariableA
GetModuleFileNameA
DeleteFileA
WriteFile
GetVersionExA
CreateFileA
SetCurrentDirectoryW
GetCurrentDirectoryW
GetLocaleInfoA
GetUserDefaultLCID
GetFileSize
ReadFile
GetLastError
CloseHandle
LoadLibraryA
FindFirstFileA
InterlockedExchange
InitializeCriticalSection
EncodePointer
DecodePointer
RaiseException
HeapDestroy
HeapReAlloc
HeapSize
RtlUnwind
ExitProcess
ResumeThread
CreateThread
MoveFileA
GetCommandLineA
HeapSetInformation
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
LCMapStringW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetCurrentThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
HeapCreate
IsProcessorFeaturePresent
SetHandleCount
GetStartupInfoW
FatalAppExitA
GetConsoleCP
FlushFileBuffers
SetFilePointer
GetModuleFileNameW
GetLocaleInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetStdHandle
GetFullPathNameA
GetFileInformationByHandle
PeekNamedPipe
GetStringTypeW
user32
GetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
SetUserObjectSecurity
advapi32
EqualSid
CryptGetUserKey
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptGetProvParam
CryptEnumProvidersW
CryptSignHashW
CryptExportKey
CryptSetHashParam
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
ReportEventW
DeregisterEventSource
RegisterEventSourceW
RevertToSelf
EnumDependentServicesA
ControlService
QueryServiceStatusEx
ImpersonateLoggedOnUser
CreateProcessAsUserA
AddAccessAllowedAce
GetSecurityDescriptorDacl
GetAclInformation
InitializeAcl
GetAce
AddAce
LogonUserA
CreateProcessWithLogonW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenSCManagerA
OpenServiceA
CreateServiceA
CloseServiceHandle
StartServiceA
GetLengthSid
CopySid
OpenProcessToken
GetTokenInformation
CryptAcquireContextA
FreeSid
AllocateAndInitializeSid
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
shell32
SHCreateDirectoryExA
iphlpapi
GetAdaptersInfo
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
516KB
Virtual Size
516KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
27KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
180KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=152, version=20115,
count=35, id=158, productName=VS2010 build 30319, version=30319,
count=193, id=170, productName=VS2010 build 30319, version=30319,
count=8, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=554, id=174, version=30319,
count=21, productName=Unmarked objects (old),
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=268, id=1, productName=Unmarked objects,
count=141, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
UEMSAgent.msi
- SHA256 92f68fc7f6d0f544a750bf67b4903d1a4062d1372b7f98ab5c2f698eb61359bb
- MD5 db7ca603d463a06806ff1660979f406d
- SHA1 823ade4e43d36416436a115c48ba562d94fa696f
- SHA512 8e2527478514cf5ec8b40fa0ffc53d91ae72a1ba75a8c96800e06282b5e76e2f2f61f4b9e979c15f691591ee4f926b17aa07aebf31de68638b13e94db702b8d5
- SSDEEP 786432:juvkjbX98hUIlkZpqcvX4kp1h1HnX6Jx5L3gxKF:ivk3X98hUUspqcvokD3yxU6
- TLSH T1FD77337234438836D5C26CB095E6C364D2A60D508EB42453A677B2BBDAF37C296F73E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5907cc74cfd6f61cc5c75c3a151bcaa165ff25eab727055ecb774c19ea0c5482
Digest Algorithm
sha256
Digest Matches
Trusted
Prehash
Signing Certificate
CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN
Chains
Jul 15, 2024
CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Sep 19, 2018 - Jan 28, 2028
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Mar 18, 2029
Subject
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN
Serial Number
51:32:af:90:cc:55:1e:68:5b:1b:6b:ab
Issuer
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 20, 2023 - Oct 9, 2026
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
UEMSAgent.mst
- SHA256 180195558475b32abedb88b3103c06ee464148809986b78de32d8fdba897c516
- MD5 0509fd12bad30c0cbe679a18bcb2042a
- SHA1 6c933d6b00da0a63621e646912a1079b2af5e0e5
- SHA512 9593e50f7c91fb06701938376255e3a50985a2b7559340f1f17d801026a2f5b8ef1348857b80a0d9b6559768525d68f148b372a50597b0ec8aac15309db800ee
- SSDEEP 48:k7xLm2JQMPTjbJc3GgCP/p/vvrdGRFXfJJa8:kdJQyNGo/JRST
- TLSH T14E924D4AF622E93ACA494A329D53C3CC0731BC01CD82425B76D8B7DFBC7A1841B165EC
- MD5 SHA1 SHA512 SSDEEP TLSH
dcremagentinstaller.exe
- IMPHASH 0b651ac32b3c387288a1492a23fd5e6d
- SHA256 927837f0b31d20c0ed7948cf6170b57b28bfd4bd118aa21853611062ed2678b2
- MD5 35c1ebfd236a2222141531829f67f0e3
- SHA1 c6be8310ad8152815bc74ce423a02b9360b0f493
- SHA512 732f95a7541b2aef592d159656d2212598401f21be00031a6a66080efa52ce293fc85f458b4f1181a8e5fece98a837e51dc121df773abf0dc210a87cdd54add4
- SSDEEP 3072:xDTP/OYHh9aGwsXOXhnyuGqmEiXyM9SUJlLxTU6mpPF1tE:xDLZBAGwsXo6EiXyM9SIltTU/znE
- TLSH T1E7148C357689C073D557153949F8D77B7A6EB8220B60A0C76BE80B7D9F702E29B3430A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
aa:09:50:50:95:0b:ab:b9:84:35:9e:3e:07:98:db:da:2a:cd:69:0c:3a:8f:7e:e3:e8:1e:83:49:01:ac:85:92
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN
Chains
Jul 15, 2024
CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Sep 19, 2018 - Jan 28, 2028
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Mar 18, 2029
Subject
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN
Serial Number
44:85:59:e8:d5:9f:e0:56:29:9e:6e:8f
Issuer
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 11, 2023 - Oct 9, 2026
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
5
Entry point
57664
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
d:\Webhost\15-07-2024\WindowsBuilds\DC_NATIVE\8716047\desktopcentral\ONPREMISE\SA_SRC\native\agent\Release\dcremagentinstaller.pdb
mpr
WNetCancelConnection2W
WNetAddConnection2W
kernel32
InterlockedDecrement
GetCurrentProcess
WaitForSingleObject
GetModuleHandleW
FormatMessageA
Sleep
CopyFileW
SizeofResource
GetExitCodeProcess
CreateProcessW
MultiByteToWideChar
GetLastError
GetProcAddress
FindClose
GetLocalTime
LockResource
CloseHandle
LocalFree
LoadLibraryW
LoadResource
FindResourceW
FindResourceExW
FindFirstFileW
SetConsoleMode
TerminateProcess
DecodePointer
ReadConsoleInputA
SetEndOfFile
CreateFileW
CreateFileA
WriteConsoleW
SetStdHandle
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
lstrlenA
WideCharToMultiByte
InterlockedIncrement
EncodePointer
InterlockedExchange
InitializeCriticalSection
GetCommandLineA
HeapSetInformation
RtlUnwind
LCMapStringW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
IsProcessorFeaturePresent
HeapCreate
ExitProcess
ReadFile
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
advapi32
SetEntriesInAclW
SetSecurityInfo
RevertToSelf
CreateProcessAsUserW
LogonUserW
BuildExplicitAccessWithNameW
ole32
CoUninitialize
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
oleaut32
SysStringByteLen
SysStringLen
SysAllocString
SysFreeString
VariantClear
SysAllocStringByteLen
Name
.text
Size
131KB
Virtual Size
130KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
504B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=152, version=20115,
count=20, id=158, productName=VS2010 build 30319, version=30319,
count=144, id=170, productName=VS2010 build 30319, version=30319,
count=61, id=171, productName=VS2010 build 30319, version=30319,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=127, id=1, productName=Unmarked objects,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
setup.bat
- SHA256 fe27ac5a7a72e2f380ecd90367eccec418f87dd7cabb3d3a19ba27f38871b13e
- MD5 efc869e1d2ec0db71eb82e86bc114b7b
- SHA1 066e0391da7faa969a7c506beff3beef74b9bd53
- SHA512 edf588d20a0a66f510a370ec63fb351054b201c091d7c26f0501197741911184b7c7dd73b7d8ef3aa0bdf19e7901935066ffaa031a655b22f668f1ee5c12f1b1
- TLSH T14F610F808F522F751454CF59E07A82C3E733D006A7C67070189DBC9ABB8D7A63D3EAA4
- MD5 SHA1 SHA512 TLSH
setup1.vbs
- SHA256 33633ef8abb63a5ed8bcd1cf78e90f80438bb0236afe59714bfff83d73410428
- MD5 0112c726a741f3351dcd1872ad6aa013
- SHA1 7f9f98f388abdc938fc0c2d162233b93c822b809
- SHA512 a2d1e96fe4f73772743e0f64d392515dccd124526fcd69c8607be71842bd95b8c184c58547c2f10f124ed1f9cdbb10466ecde7a2076b6d2ddd1f22630d9d1ac0
- TLSH T15431251B99644A07D4D2C65321F37C5C9F7A6A57000882B735A9DC9883D83639F5F237
- MD5 SHA1 SHA512 TLSH