Overview

overview

8

Static

static

3

2026-08-03...id.exe

windows10-2004-x64

8

2026-08-03...id.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    139s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 10:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_8cf1f92017b559ee0b946bfd0c31a9d6_cobalt-strike_icedid.exe
  • Size 139KB
  • Sample260804-mze82sdj4w
  • SHA256 1935fdce4e68fd521fd4daaf468e04c7364a055848cfebb8010f90ab35d76c87
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Executes dropped EXE 44 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Power Settings 1 TTPs 4 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 55 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
    execution
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 21 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies trusted root certificate store through registry 1 TTPs 8 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 59 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 10 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 23 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_8cf1f92017b559ee0b946bfd0c31a9d6_cobalt-strike_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_8cf1f92017b559ee0b946bfd0c31a9d6_cobalt-strike_icedid.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4136
    • C:\Windows\System32\certutil.exe
      "C:\Windows\System32\certutil.exe" -hashfile "C:\Users\Public\Documents\Cache_B0A0_1C88\pkg_406D.zip" SHA256
      2⤵
        PID:3292
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -Command "$ErrorActionPreference='Stop'; Add-Type -AssemblyName System.IO.Compression.FileSystem; $z=[IO.Compression.ZipFile]::OpenRead('C:\Users\Public\Documents\Cache_B0A0_1C88\pkg_406D.zip'); try { $r=@('DCAgentServerInfo.json','UEMSAgent.mst','DMRootCA.crt','DMRootCA-Server.crt','dcremagentinstaller.exe','setup.bat','README.html','RemCom.exe','UEMSAgent.msi','setup1.vbs'); $n=@($z.Entries | ForEach-Object {$_.FullName}); foreach($x in $r){if($n -notcontains $x){exit 21}}; $b=New-Object byte[] 65536; foreach($e in $z.Entries){if($e.Length -gt 0){$s=$e.Open(); try {while($s.Read($b,0,$b.Length) -gt 0){}} finally {$s.Dispose()}}}; exit 0 } finally {$z.Dispose()}"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3372
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='Stop'; Add-Type -AssemblyName System.IO.Compression.FileSystem; [IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Public\Documents\Cache_B0A0_1C88\pkg_406D.zip','C:\Users\Public\Documents\Cache_B0A0_1C88\ext\')"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:304
      • C:\Windows\System32\wscript.exe
        "C:\Windows\System32\wscript.exe" //B //Nologo "C:\Users\Public\Documents\Cache_B0A0_1C88\ext\setup1.vbs"
        2⤵
        • Executes a VBScript file via the Windows Script Host.
        • Suspicious use of WriteProcessMemory
        PID:2684
        • C:\Windows\System32\wscript.exe
          "C:\Windows\System32\wscript.exe" "C:\Users\Public\Documents\Cache_B0A0_1C88\ext\setup1.vbs" /elevated
          3⤵
          • Executes a VBScript file via the Windows Script Host.
          • Suspicious use of WriteProcessMemory
          PID:6004
          • C:\Windows\System32\powercfg.exe
            "C:\Windows\System32\powercfg.exe" /change standby-timeout-ac 0
            4⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:5156
          • C:\Windows\System32\powercfg.exe
            "C:\Windows\System32\powercfg.exe" /change standby-timeout-dc 0
            4⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:804
          • C:\Windows\System32\powercfg.exe
            "C:\Windows\System32\powercfg.exe" /change hibernate-timeout-ac 0
            4⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:3720
          • C:\Windows\System32\powercfg.exe
            "C:\Windows\System32\powercfg.exe" /hibernate off
            4⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:5816
          • C:\Windows\System32\msiexec.exe
            "C:\Windows\System32\msiexec.exe" /i "C:\Users\Public\Documents\Cache_B0A0_1C88\ext\UEMSAgent.msi" TRANSFORMS="C:\Users\Public\Documents\Cache_B0A0_1C88\ext\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Public\Documents\Cache_B0A0_1C88\ext\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Public\Documents\Cache_B0A0_1C88\ext\DMRootCA.crt" /qn
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:4584
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2504
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 4DC2EF56320461B3AAFDB11CB53802B4
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3324
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies trusted root certificate store through registry
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5532
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4852
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe
          bin\dcpatchscan.exe -y 1
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          PID:1564
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4192
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4620
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4236
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3984
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\meaap.exe" -m 1 -a 7093261d-e605-4137-be02-f2a185eeaad2
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:4944
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 7093261d-e605-4137-be02-f2a185eeaad2 -f "--" -c val-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\Vulnerability-metadata.json" -a 1
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:3280
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 7093261d-e605-4137-be02-f2a185eeaad2 -c val-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\Vulnerability-metadata.json" -e enabled -a 3
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:4556
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"
          3⤵
          • Drops file in Program Files directory
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5468
          • C:\Windows\SysWOW64\systeminfo.exe
            systeminfo.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Gathers system information
            PID:4620
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 22
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          PID:4804
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
          bin\dcinventory.exe -i postinstallation 0 1
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:2144
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\metroapps.exe
            metroapps.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            PID:4500
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:5204
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6024
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4824
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 9
          3⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          PID:6120
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
        7 0 0
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        PID:1664
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
        bin\dcstatusutil.exe RequestAgentSlotFromServer
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        PID:2164
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        PID:3720
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1044
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1512
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
        3 0 0
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:2756
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
          bin\dcinventory.exe -p processor compatibility
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3256
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2364
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          PID:4980
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5400
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1696
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5756
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1248
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe" -m 1 -c Refresh
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:4200
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 9ff13e98-156a-40a8-a2f0-1966149487e5 -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\acp_component.zip" -c acp -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ApplicationControl-metadata.json" -a 1
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5104
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\acp_component.zip"
              5⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              PID:1348
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4536
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe"
                6⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                • Modifies data under HKEY_USERS
                • Suspicious use of WriteProcessMemory
                PID:2680
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\dcprocmon.exe
                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\dcprocmon.exe"
                  7⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Modifies data under HKEY_USERS
                  PID:4180
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
                  33 0 0
                  7⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • System Location Discovery: System Language Discovery
                  PID:4560
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\ACPipelogServer.exe
                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\ACPipelogServer.exe"
                  7⤵
                  • Executes dropped EXE
                  • Checks processor information in registry
                  PID:2448
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\Privilager.exe
                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\Privilager.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:5868
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s postnotify SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ SYSTEM 0 1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3708
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\metroapps.exe
          metroapps.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4936
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuninstallsw.exe
          bin\dcuninstallsw.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1248
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        PID:3144
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\NotifDriver_W10x64.sys
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\NotifDriver_W10x64.sys"
      1⤵
      • Executes dropped EXE
      PID:1716

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e59753a.rbs
          • Path C:\Config.Msi\e59753a.rbs
          • Size 58KB
          • SHA256 76d58f0aee13c89eaf87981d46e0131bd7e9341abf86e89ebfb46ff856f3cd0d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e59753f.rbs
          • Path C:\Config.Msi\e59753f.rbs
          • Size 546B
          • SHA256 2736c13fb3cc8dbb5b63fcdc69f372f6239b43f4e7ec4d5014fdb8be668efe66
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          client.p12
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
          • Size 1002B
          • SHA256 b75d271d8edd3d270d10777a066b1598af47e04e762ce9b0904187f0ffeb2608
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          InstalledSoftwareScanData.json
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\InstalledSoftwareScanData.json
          • Size 6KB
          • SHA256 3958e035c652c8b31a3bff2428ddfcf49013d929951a64eb4278f53be0b46180
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CURRENT
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed_dnsa\CURRENT
          • Size 16B
          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
          • MD5 SHA1 SHA512
          Submit Download

          7za.exe
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          • Size 802KB
          • SHA256 f00836a63be7ebf14e1b8c40100c59777fe3432506b330927ea1f1b7fd47ee44
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ClientAuthHandler.dll
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
          • Size 2.3MB
          • SHA256 7627f75435af64ab72991eb93996df3f61101e7b57cdf5a9d8d2e06d75b76aad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Lato-Bold.eot
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
          • Size 250KB
          • SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Lato-Medium.eot
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Medium.eot
          • Size 245KB
          • SHA256 1727853b9469a665c3a5573e39503bc592a794d810aed5d03e9a8940f507823c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          agent_binaries.7z
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
          • Size 14.6MB
          • SHA256 6d5bf676a5800214126df113bbf68a8b3f6ea051ccfbf212c11927df89035082
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ca-certs.zip
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ca-certs.zip
          • Size 160B
          • SHA256 7e6debd55c669504ffd364e96b1e539c5d6839472887ecd739ba79b155c62fa1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          cfgUpdate.exe
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cfgUpdate.exe
          • Size 62KB
          • SHA256 7232bb0e4842bf2f8a370dce70df60c72560416a5bb317650cf88afbd7acb820
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cold_normal_msghldr.gif
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cold_normal_msghldr.gif
          • Size 536B
          • SHA256 fc7d90a7546fb0f8c8ad6e617f74d185be15f85aaf5d329919bc2776887bc9d1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dcagentregister.exe
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
          • Size 92KB
          • SHA256 430aad28ddd50d0026f7e547764b2f4cd7c54204519e119614895068397904dc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dcagentservice.exe
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
          • Size 1.2MB
          • SHA256 23fa8f503da68dd5724b136f9f401ab747db352e5edd8e2c277bf7426f774773
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dcpatchscan.exe
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe
          • Size 3.3MB
          • SHA256 e3200c70077193f3decf5896fded35b3cce2034aec5517178a24e35a665abfd0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dcstatusutil.exe
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
          • Size 1.1MB
          • SHA256 b24ad0ae12c05931f11b66f26166c7ec41a7be318893aebe4cc2babe29bdb080
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hot_mover_msghldr.gif
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hot_mover_msghldr.gif
          • Size 172B
          • SHA256 c9657b6062e0798cfb5e39be8d8d1546d901ee339dde4915c82b40460a205f9e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          resources.exe
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.exe
          • Size 318KB
          • SHA256 7e311d65ca1a0461cc6bda079efdcbd4f2f0a7967c2f09be02f2b62b97eb4848
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          topmiddle.bmp
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\topmiddle.bmp
          • Size 1016B
          • SHA256 bb6b032f562a0578070b18e1002c22bec4520cf191f11384af316a0ae33b8cea
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ui-icons_444444_256x240.png
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png
          • Size 6KB
          • SHA256 eaf7c7ee2747275dda6c53e731a10db1a7b15f4fbb46e1b69d6bb2056bc9fd81
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ui-icons_555555_256x240.png
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_555555_256x240.png
          • Size 6KB
          • SHA256 5d04051dfd9d2d740355404f98a683d1ec0feb2fca7d76e533c1a6e5ce92dd2e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ui-icons_777620_256x240.png
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777620_256x240.png
          • Size 4KB
          • SHA256 9dbe4a0d03feed6f65eb2560a0a8b4ba4264545ee8fd31c1763a3b219d0328d6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ui-icons_777777_256x240.png
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png
          • Size 6KB
          • SHA256 e75b27211e16fcf94715168001bb7055ca376d46f928110ba3d0825232452e5a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ui-icons_cc0000_256x240.png
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_cc0000_256x240.png
          • Size 4KB
          • SHA256 02891575d4358e9edde3e42d94057f8e9f82a9d64376f71ee86cef149d30537e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ui-icons_ffffff_256x240.png
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_ffffff_256x240.png
          • Size 6KB
          • SHA256 b6b06deef2b924cc3835d63f4883d47882734a33e71b212d917a68cede3b8e9d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AgentApplicationResources.properties
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties
          • Size 98KB
          • SHA256 fb1321f35dacb680e3cefb846f65f657b7141ecaaac61ecea2a009f6a0434426
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OSDetection.json
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
          • Size 15KB
          • SHA256 d4a4d290a60e27dde19bb6b6183da79ebb8a254bd25ffa41f8c5d3d67f8c2702
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OSDetection.json.gz4784.tmp
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz4784.tmp
          • Size 2KB
          • SHA256 5cbc36ed2b88e9ecb6ad8d4d68c98cb191cf82807fc1092a1eb93cf34a0dd67f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          agent-settings.xml4784.tmp
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml4784.tmp
          • Size 3KB
          • SHA256 11eefc1e2305c4223527c6e95389dc5ce39074d424e37cf290b31eedeee25221
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          configuration-settings-dc-win10.xml
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
          • Size 242KB
          • SHA256 1a388c11ac7b14c44ecb605da1f6111274beb11d947442311c5ef1a88d6e4b68
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          customer-meta-data.json4784.tmp
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json4784.tmp
          • Size 898B
          • SHA256 4fd764b548ad7d1565ca414192a0c2101aeeb3bea04ab7880e7f7df5a23f92d5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          data-dictionary-framework.xml
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
          • Size 415KB
          • SHA256 9e2dcf836433b648d592cf5ea82af6d44cc6f0cb8625436dc164dda3601df2a7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          data-dictionary-onpremise.xml
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
          • Size 109KB
          • SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          data-dictionary.xml
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
          • Size 1.6MB
          • SHA256 0c6236f2f6794c79fb2795bea6eb04775d94ea8079ce9d92502236bfb448a706
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          deployment-policies.xml
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml
          • Size 6KB
          • SHA256 3ad0e5128c6c817107392a3f3a4d97797f7cd12c78fbcb81c38440a92955bbbf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dynamic-variables.xml
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\dynamic-variables.xml
          • Size 28KB
          • SHA256 6df9a28cfd8d76f1e41e6f9fcdf28eb8fa3b5a5d67015ba51fdf1c76980bde1d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          meta-data.xml5868.tmp
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml5868.tmp
          • Size 9KB
          • SHA256 d49ed7e75159ebddf57303b2b4f07a62d56fd501332501d0dbae167758753079
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dcagent.dll
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
          • Size 3.1MB
          • SHA256 15ad7ce2ebfda80a19bde288e71b7c63c1b3cd71416b7ee2df6504610de44883
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Lato.woff
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
          • Size 36KB
          • SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          drop_down_icon.png
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
          • Size 449B
          • SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          info.png
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
          • Size 2KB
          • SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dcdatatransferdown.log
          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
          • Size 5KB
          • SHA256 698fe1692bbcccc9766b1583f983b307b70a0ea24c118af633633ef6c4a55a91
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 c242955204af8017d7d001750715285332b5ce53c3b3d7bc6b97fece5b5df31b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          diag.log
          • Path C:\Users\Public\Documents\Cache_B0A0_1C88\diag.log
          • Size 370B
          • SHA256 2e65dfd6bd9d10dca2f128722673f6c40c6d56893c2e7f4fd1d62150f358ae3d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          DCAgentServerInfo.json
          • Path C:\Users\Public\Documents\Cache_B0A0_1C88\ext\DCAgentServerInfo.json
          • Size 1KB
          • SHA256 f61a22250f15815ee5bf3657c8cb6f7c7c385aed68c45989c895366187c7e02a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          DMRootCA-Server.crt
          • Path C:\Users\Public\Documents\Cache_B0A0_1C88\ext\DMRootCA-Server.crt
          • Size 1KB
          • SHA256 d5557ae15f12c4b7d27399def6c1819f8821a13d0de950cdb65e17023e9552b4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          DMRootCA.crt
          • Path C:\Users\Public\Documents\Cache_B0A0_1C88\ext\DMRootCA.crt
          • Size 1KB
          • SHA256 aa78c357965f4239d7e84cec68347171e0e620a39ea012f86707659b0278fcd8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          README.html
          • Path C:\Users\Public\Documents\Cache_B0A0_1C88\ext\README.html
          • Size 2KB
          • SHA256 c430a6802aa574bb46874cd15321b27a4ba69c55c04f1f83072acce7b5e8a452
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          RemCom.exe
          • Path C:\Users\Public\Documents\Cache_B0A0_1C88\ext\RemCom.exe
          • Size 3.1MB
          • SHA256 7a1dcf22a67c194367d4ef65304cf69c11df0b14c3d08215b7ee81373a3cefba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UEMSAgent.msi
          • Path C:\Users\Public\Documents\Cache_B0A0_1C88\ext\UEMSAgent.msi
          • Size 31.8MB
          • SHA256 92f68fc7f6d0f544a750bf67b4903d1a4062d1372b7f98ab5c2f698eb61359bb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UEMSAgent.mst
          • Path C:\Users\Public\Documents\Cache_B0A0_1C88\ext\UEMSAgent.mst
          • Size 20KB
          • SHA256 180195558475b32abedb88b3103c06ee464148809986b78de32d8fdba897c516
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dcremagentinstaller.exe
          • Path C:\Users\Public\Documents\Cache_B0A0_1C88\ext\dcremagentinstaller.exe
          • Size 194KB
          • SHA256 927837f0b31d20c0ed7948cf6170b57b28bfd4bd118aa21853611062ed2678b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setup.bat
          • Path C:\Users\Public\Documents\Cache_B0A0_1C88\ext\setup.bat
          • Size 3KB
          • SHA256 fe27ac5a7a72e2f380ecd90367eccec418f87dd7cabb3d3a19ba27f38871b13e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          setup1.vbs
          • Path C:\Users\Public\Documents\Cache_B0A0_1C88\ext\setup1.vbs
          • Size 1KB
          • SHA256 33633ef8abb63a5ed8bcd1cf78e90f80438bb0236afe59714bfff83d73410428
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          pkg_406D.zip
          • Path C:\Users\Public\Documents\Cache_B0A0_1C88\pkg_406D.zip
          • Size 33.0MB
          • SHA256 d7d432e81d268f77446757bc2c0cc2d5828852c68274b75f6a7a879b2f8e179b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI7D35.tmp
          • Path C:\Windows\Installer\MSI7D35.tmp
          • Size 81KB
          • SHA256 17805948e9d5f51fca01c13bb7dedb1f1a1e17bcf5cc0cb6c01d9f773b712744
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BAEBE581FCB73249406FC21094EA252E_BC0CE803EF41A748738619ED7838EEFC
          • Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAEBE581FCB73249406FC21094EA252E_BC0CE803EF41A748738619ED7838EEFC
          • Size 5B
          • SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
          • MD5 SHA1 SHA512
          Submit Download

          dcagenthttp.dll
          • Path C:\Windows\SysWOW64\dcagenthttp.dll
          • Size 3.6MB
          • SHA256 3de8d74127b797813742dd9fd618c38572b269f8dbb14af4d6014a1addec4e38
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dclibxml2.dll
          • Path C:\Windows\SysWOW64\dclibxml2.dll
          • Size 2.1MB
          • SHA256 a451dd3babd79318b612072cb417fd4848be821a1607dc58ac31676e9312fd7a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/3372-23-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
          Download

          memory/3372-17-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
          Download

          memory/3372-24-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
          Download

          memory/3372-25-0x00000172CFCF0000-0x00000172CFCFA000-memory.dmp
          Download

          memory/3372-22-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
          Download

          memory/3372-21-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
          Download

          memory/3372-20-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
          Download

          memory/3372-19-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
          Download

          memory/3372-18-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
          Download

          memory/3372-26-0x00000172CFD20000-0x00000172CFD32000-memory.dmp
          Download

          memory/3372-16-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
          Download

          memory/3372-12-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
          Download

          memory/3372-13-0x00000172B7920000-0x00000172B7942000-memory.dmp
          Download

          memory/3372-11-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
          Download

          memory/3372-10-0x00007FFD8B02F000-0x00007FFD8B030000-memory.dmp
          Download

          memory/3372-28-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
          Download

          memory/3372-29-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp
          Download