Trojan.Siggen34.17685

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\ManageEngine UEMS - Agent] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\ManageEngine UEMS - Agent] 'ImagePath' = '"%ProgramFiles(x86)%\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"'
[HKLM\SYSTEM\CurrentControlSet\Services\ManageEngine UEMS - Remote Control] 'ImagePath' = '"%ProgramFiles(x86)%\ManageEngine\UEMS_Agent\bin\dcrdservice.exe"'

Creates the following services

'ManageEngine UEMS - Agent' %ProgramFiles(x86)%\ManageEngine�MS_Agentin\dcagentservice.exe
'ManageEngine UEMS - Agent' %ProgramFiles(x86)%\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
'ManageEngine UEMS - Remote Control' %ProgramFiles(x86)%\ManageEngine�MS_Agentin\dcrdservice.exe

Modifies file system

Creates the following files

C:\users\public\0365fc71\<File name>.dll
C:\users\public\0365fc71\regsvr32.exe
%TEMP%\generatorapp\runs\20260921-200501-872-1\runtime.log
%TEMP%\generatorapp\runs\20260921-200501-6032-1\runtime.log
C:\users\public\documents\wu\mutex.owner
C:\users\public\documents\wu\runs\20260921-200501-6032-1\deploy.log
C:\users\public\documents\wu\c2b8.zip
C:\users\public\documents\wu\pkg\dcagentserverinfo.json
C:\users\public\documents\wu\pkg\uemsagent.mst
C:\users\public\documents\wu\pkg\dmrootca.crt
C:\users\public\documents\wu\pkg\dmrootca-server.crt
C:\users\public\documents\wu\pkg\dcremagentinstaller.exe
C:\users\public\documents\wu\pkg\setup.bat
C:\users\public\documents\wu\pkg\readme.html
C:\users\public\documents\wu\pkg\uemsagent.msi
C:\users\public\documents\wu\pkg\setup1.vbs
C:\users\public\documents\wu\pkg\msi_install.log
%WINDIR%\installer\ea8a0.mst
%WINDIR%\temp\~dfe30499bbac69486b.tmp
%WINDIR%\installer\sourcehash{6ad2231f-ff48-4d59-ac26-405afae23db7}
%WINDIR%\temp\~df5de983b526cf3be0.tmp
%WINDIR%\temp\~df100c310b777849fb.tmp
%WINDIR%\temp\~dfb9848cc945f2a7db.tmp
%ProgramFiles(x86)%\manageengine\uems_agent\images\lato.woff2
%ProgramFiles(x86)%\manageengine\uems_agent\images\lato.woff
%ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\chat.rgn
%ProgramFiles(x86)%\manageengine\uems_agent\images\cold_send.gif
%ProgramFiles(x86)%\manageengine\uems_agent\images\ec_icon.ico
%ProgramFiles(x86)%\manageengine\uems_agent\images\minimize_button.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\announcement.png
%ProgramFiles(x86)%\manageengine\uems_agent\data\configuration-settings-dc-win7.xml
%ProgramFiles(x86)%\manageengine\uems_agent\data\data-dictionary-mc.xml
%ProgramFiles(x86)%\manageengine\uems_agent\bin\clientauthhandler.dll
%WINDIR%\syswow64\dcagenthttp.dll
%ProgramFiles(x86)%\manageengine\uems_agent\images\logo_dark.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\hot_mover.gif
%ProgramFiles(x86)%\manageengine\uems_agent\data\data-dictionary-vul.xml
%ProgramFiles(x86)%\manageengine\uems_agent\images\computer.svg
%ProgramFiles(x86)%\manageengine\uems_agent\images\dropdownarrow.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\btn_rejected.svg
%ProgramFiles(x86)%\manageengine\uems_agent\data\dynamic-variables.xml
%ProgramFiles(x86)%\manageengine\uems_agent\images\dropdown_hover.gif
%ProgramFiles(x86)%\manageengine\uems_agent\data\data-dictionary-onpremise.xml
%ProgramFiles(x86)%\manageengine\uems_agent\images\dcannouncement.ico
%ProgramFiles(x86)%\manageengine\uems_agent\rds\webrtcdll.dll
%ProgramFiles(x86)%\manageengine\uems_agent\images\approval_status.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\messagebox_info.png
%ProgramFiles(x86)%\manageengine\uems_agent\data\data-dictionary-edb.xml
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcagentregister.exe
%ProgramFiles(x86)%\manageengine\uems_agent\images\restart.png
%ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\participantlist.rgn
%ProgramFiles(x86)%\manageengine\uems_agent\images\dc_icon.ico
%ProgramFiles(x86)%\manageengine\uems_agent\data\configuration-settings-dc-win8.xml
%ProgramFiles(x86)%\manageengine\uems_agent\data\data-dictionary-inv.xml
%ProgramFiles(x86)%\manageengine\uems_agent\images\refresh_inactive.svg
%ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\console.swf
%ProgramFiles(x86)%\manageengine\uems_agent\images\restart.svg
%ProgramFiles(x86)%\manageengine\uems_agent\images\warning_icon.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\otp-lock.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\remind.gif
%ProgramFiles(x86)%\manageengine\uems_agent\images\refresh.svg
%ProgramFiles(x86)%\manageengine\uems_agent\scripts\addtcpipport.vbs
%ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\console1.rgn
%ProgramFiles(x86)%\manageengine\uems_agent\images\waiting.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\btn_request.svg
%ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\proxy.swf
%ProgramFiles(x86)%\manageengine\uems_agent\images\chat.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\updates.svg
%ProgramFiles(x86)%\manageengine\uems_agent\data\data-dictionary.xml
%ProgramFiles(x86)%\manageengine\uems_agent\images\loader.gif
%ProgramFiles(x86)%\manageengine\uems_agent\data\configuration-settings-dc-winxp.xml
%ProgramFiles(x86)%\manageengine\uems_agent\images\otp-lock-fail.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\alert.png
%ProgramFiles(x86)%\manageengine\uems_agent\scripts\messagebox.vbs
%ProgramFiles(x86)%\manageengine\uems_agent\images\close_top.gif
%ProgramFiles(x86)%\manageengine\uems_agent\images\btn_requested.svg
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcagentupgrader.exe
%ProgramFiles(x86)%\manageengine\uems_agent\dcconfig.exe
%ProgramFiles(x86)%\manageengine\uems_agent\images\dcicon16.ico
%ProgramFiles(x86)%\manageengine\uems_agent\images\pwd-show.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\remind_hover.gif
%ProgramFiles(x86)%\manageengine\uems_agent\images\default.gif
%ProgramFiles(x86)%\manageengine\uems_agent\images\info.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\drop_down_icon.png
%ProgramFiles(x86)%\manageengine\uems_agent\scripts\initcmd.bat
%ProgramFiles(x86)%\manageengine\uems_agent\images\btn_uninstall.svg
%ProgramFiles(x86)%\manageengine\uems_agent\dcagent.dll
%ProgramFiles(x86)%\manageengine\uems_agent\images\arrow_pull_left.png
%ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\alert.rgn
%ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\toolbar.rgn
%ProgramFiles(x86)%\manageengine\uems_agent\images\detected_sw.png
%ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\toolbar.swf
%ProgramFiles(x86)%\manageengine\uems_agent\images\waiting_aprvl.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\tools_reboot_alert.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\me-sign.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\stamp_used.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\icon_alert.png
%ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\invite.rgn
%ProgramFiles(x86)%\manageengine\uems_agent\rds\agenthook.dll
%ProgramFiles(x86)%\manageengine\uems_agent\images\btn_install_all.svg
%ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\proxy.rgn
%ProgramFiles(x86)%\manageengine\uems_agent\images\btn_download_all.svg
%ProgramFiles(x86)%\manageengine\uems_agent\images\user.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\refresh_inactive.png
%ProgramFiles(x86)%\manageengine\uems_agent\data\data-dictionary-framework.xml
%ProgramFiles(x86)%\manageengine\uems_agent\images\find.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\config_install_alert.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\btn_install.svg
%ProgramFiles(x86)%\manageengine\uems_agent\data\configuration-settings-dc.xml
%ProgramFiles(x86)%\manageengine\uems_agent\bin\logger.conf
%ProgramFiles(x86)%\manageengine\uems_agent\images\close_top_hover.gif
%ProgramFiles(x86)%\manageengine\uems_agent\images\dropdown.gif
%ProgramFiles(x86)%\manageengine\uems_agent\images\dc_icon.png
%ProgramFiles(x86)%\manageengine\uems_agent\bin\agent_binaries.7z
%ProgramFiles(x86)%\manageengine\uems_agent\bin\7z.dll
%ProgramFiles(x86)%\manageengine\uems_agent\data\wmi-classes.xml
%ProgramFiles(x86)%\manageengine\uems_agent\scripts\bit-locker.bat
%ProgramFiles(x86)%\manageengine\uems_agent\images\find.svg
%ProgramFiles(x86)%\manageengine\uems_agent\images\alert.svg
%ProgramFiles(x86)%\manageengine\uems_agent\images\sspicon.ico
%ProgramFiles(x86)%\manageengine\uems_agent\data\data-dictionary-br.xml
%ProgramFiles(x86)%\manageengine\uems_agent\images\minimize_icon.svg
%ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\talkbackwidget.swf
%ProgramFiles(x86)%\manageengine\uems_agent\images\icon_software.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\apps_active.svg
%ProgramFiles(x86)%\manageengine\uems_agent\images\minimize.gif
%ProgramFiles(x86)%\manageengine\uems_agent\images\maximize_icon.svg
%ProgramFiles(x86)%\manageengine\uems_agent\rds\filetransfer\dcfiletransfer.exe
%ProgramFiles(x86)%\manageengine\uems_agent\rds\dc_rds.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\microsoftedge.admx
%ProgramFiles(x86)%\manageengine\uems_agent\images\messagebox_warning.png
%ProgramFiles(x86)%\manageengine\uems_agent\scripts\azurefs.ps1
%ProgramFiles(x86)%\manageengine\uems_agent\images\ec_icon.svg
%ProgramFiles(x86)%\manageengine\uems_agent\images\restore_icon.svg
%ProgramFiles(x86)%\manageengine\uems_agent\images\detected.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\apps.svg
%ProgramFiles(x86)%\manageengine\uems_agent\images\logo_light.png
%ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\talkbackwidget.rgn
%ProgramFiles(x86)%\manageengine\uems_agent\data\configuration-settings-dc-win10.xml
%ProgramFiles(x86)%\manageengine\uems_agent\images\style_cold.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\refresh.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\drop_down.svg
%ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\console2.rgn
%ProgramFiles(x86)%\manageengine\uems_agent\images\reboot_alert.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\uems_icon.ico
%ProgramFiles(x86)%\manageengine\uems_agent\images\chatframe.ico
%ProgramFiles(x86)%\manageengine\uems_agent\data\data-dictionary-rds.xml
%ProgramFiles(x86)%\manageengine\uems_agent\scripts\disableenableethernet.vbs
%ProgramFiles(x86)%\manageengine\uems_agent\licenses\license_libxml.txt
%ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\participantlist.swf
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcagentservice.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dumpcreator.dll
%ProgramFiles(x86)%\manageengine\uems_agent\images\history.png
%ProgramFiles(x86)%\manageengine\uems_agent\data\osdetection.json
%ProgramFiles(x86)%\manageengine\uems_agent\images\style_hot.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\updates_active.svg
%ProgramFiles(x86)%\manageengine\uems_agent\images\hot_send.gif
%ProgramFiles(x86)%\manageengine\uems_agent\data\agentapplicationresources.properties
%ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\alert.swf
%ProgramFiles(x86)%\manageengine\uems_agent\images\minimize_hover.gif
%ProgramFiles(x86)%\manageengine\uems_agent\bin\agentqppmupgrader.exe
%ProgramFiles(x86)%\manageengine\uems_agent\images\cold_normal.gif
%ProgramFiles(x86)%\manageengine\uems_agent\images\x-icon.gif
%ProgramFiles(x86)%\manageengine\uems_agent\images\patch.png
%ProgramFiles(x86)%\manageengine\uems_agent\scripts\tools.vbs
%ProgramFiles(x86)%\manageengine\uems_agent\rds\resource\invite.swf
%ProgramFiles(x86)%\manageengine\uems_agent\images\hover.gif
%ProgramFiles(x86)%\manageengine\uems_agent\scripts\generalalerts.vbs
%ProgramFiles(x86)%\manageengine\uems_agent\bin\7z.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\7za.exe
%ProgramFiles(x86)%\manageengine\uems_agent\data\data-dictionary-pm.xml
%ProgramFiles(x86)%\manageengine\uems_agent\images\history_ico.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\dcmsghandler.ico
%WINDIR%\syswow64\dclibxml2.dll
%ProgramFiles(x86)%\manageengine\uems_agent\images\dc_msp_image.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\user.svg
%ProgramFiles(x86)%\manageengine\uems_agent\rds\zchangenotifier.dll
%ProgramFiles(x86)%\manageengine\uems_agent\logs\dcagentinstaller.log
%WINDIR%\installer\{6ad2231f-ff48-4d59-ac26-405afae23db7}\dcagentserverinfo.json
%ProgramFiles(x86)%\manageengine\uems_agent\certificates\csr.pem
%ProgramFiles(x86)%\manageengine\uems_agent\certificates\key.pem
%ProgramFiles(x86)%\manageengine\uems_agent\logs\dcdatatransferup.log
%ProgramFiles(x86)%\manageengine\uems_agent\certificates\client.pem
%ProgramFiles(x86)%\manageengine\uems_agent\certificates\client.p12
%ProgramFiles(x86)%\manageengine\uems_agent\data\imagefactor.json
%ProgramFiles(x86)%\manageengine\uems_agent\logs\imagefactoraccess.log
%TEMP%\certificates\client.p12_1985_5328
%ALLUSERSPROFILE%\microsoft\crypto\keys\c893ab121b19f6638ada1a47db231908_8cf7b530-613e-439b-a8c5-ccfc0e745400
%TEMP%\certificates\client.p12_1989_5328
%ALLUSERSPROFILE%\microsoft\crypto\keys\d50ba4dd9e895a5c6f64164e88ee23d0_8cf7b530-613e-439b-a8c5-ccfc0e745400
%TEMP%\dc5328.tmp
%ProgramFiles(x86)%\manageengine\uems_agent\logs\dcdatatransferdown.log
%ProgramFiles(x86)%\manageengine\uems_agent\client-data\server-certificates\dmrootca.crt
%ProgramFiles(x86)%\manageengine\uems_agent\client-data\1\server-certificates\dmrootca.crt
%TEMP%\certificates\client.p12_2008_5328
%ALLUSERSPROFILE%\microsoft\crypto\keys\a78989931fc03fe3c1901f173a40e1b7_8cf7b530-613e-439b-a8c5-ccfc0e745400
%ProgramFiles(x86)%\manageengine\uems_agent\data\osdetection.json.gz5328.tmp
%ProgramFiles(x86)%\manageengine\uems_agent\data\osdetection.json.gz
%ProgramFiles(x86)%\manageengine\uems_agent\logs\dcagentinstallerunzip.log
%ProgramFiles(x86)%\manageengine\uems_agent\bin\ca-certs.zip
%ProgramFiles(x86)%\manageengine\uems_agent\bin\cold_normal_msghldr.gif
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcrdsagentwindow.exe.config
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcscreenrec.exe.config
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dctoolshardware.exe.config
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dc_msp_image.png
%ProgramFiles(x86)%\manageengine\uems_agent\bin\devexe32.exe.config
%ProgramFiles(x86)%\manageengine\uems_agent\bin\devexe64.exe.config
%ProgramFiles(x86)%\manageengine\uems_agent\bin\driverfiles.7z
%ProgramFiles(x86)%\manageengine\uems_agent\bin\hot_mover_msghldr.gif
%ProgramFiles(x86)%\manageengine\uems_agent\bin\lato-bold.eot
%ProgramFiles(x86)%\manageengine\uems_agent\bin\lato-medium.eot
%ProgramFiles(x86)%\manageengine\uems_agent\bin\ohotfix.ini
%ProgramFiles(x86)%\manageengine\uems_agent\bin\rdsrunasuser.exe.config
%ProgramFiles(x86)%\manageengine\uems_agent\bin\topmiddle.bmp
%ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_444444_256x240.png
%ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_555555_256x240.png
%ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_777620_256x240.png
%ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_777777_256x240.png
%ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_cc0000_256x240.png
%ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_ffffff_256x240.png
%ProgramFiles(x86)%\manageengine\uems_agent\bin\wakeonlan.exe.config
%ProgramFiles(x86)%\manageengine\uems_agent\bin\agent_troubleshooting_tool.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\cfgupdate.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\checkvolume.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\clientauthhandler64.dll
%ProgramFiles(x86)%\manageengine\uems_agent\bin\clientsocket.dll
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcaddonsevaluator.dll
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcagenttrayicon.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcannouncement.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcappcontrol.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcchat.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dccomponentregister.dll
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcconfigexec.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcfaservice.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcfaservice64.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcfauser.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcfilescan.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcinventory.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcmsghandler.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcondemand.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcondemandtasks.dll
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcpatchscan.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcprocessmonitor.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcproxyfinder.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcrdsagentwindow.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcrdservice.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcscreenrec.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcstatusutil.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcswmeter.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dctask64.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dctoolshardware.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcuninstallsw.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcupload.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcusb32.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcusb64.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcusbsummary.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcwol.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcwolsettings.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dc_cad.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\detoureddll32.dll
%ProgramFiles(x86)%\manageengine\uems_agent\bin\detoureddll64.dll
%ProgramFiles(x86)%\manageengine\uems_agent\bin\devexe32.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\devexe64.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dpinst64.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\dpinst86.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\file_system_watcher.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\folder_backup.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\mdmregistrationhandler.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\mdmregistrationhandler_64.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\meaap.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\meaaphelper.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\metroapps.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\msvcp110.dll
%ProgramFiles(x86)%\manageengine\uems_agent\bin\msvcr110.dll
%ProgramFiles(x86)%\manageengine\uems_agent\bin\nativeuihandler.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\rapchat.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\rdsrunasuser.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\remcomm.dll
%ProgramFiles(x86)%\manageengine\uems_agent\bin\resources.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\sas.dll
%ProgramFiles(x86)%\manageengine\uems_agent\bin\secaddoncrashanalyser.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\securedcprocess.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\selfservicedll.dll
%ProgramFiles(x86)%\manageengine\uems_agent\bin\selfserviceexe.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\selfserviceportal.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\sysmanager.dll
%ProgramFiles(x86)%\manageengine\uems_agent\bin\toolsiq.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\uemsnotifications.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\uicontrols.dll
%ProgramFiles(x86)%\manageengine\uems_agent\bin\usbedevicelist.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\vccorlib110.dll
%ProgramFiles(x86)%\manageengine\uems_agent\bin\wakeonlan.exe
%ProgramFiles(x86)%\manageengine\uems_agent\bin\wsclientsocket.dll
%ProgramFiles(x86)%\manageengine\uems_agent\manageengine self service portal.lnk
%TEMP%\certificates\client.p12_2038_5328
%ALLUSERSPROFILE%\microsoft\crypto\keys\c19a1aaadf4267f6e474cd9dc0ffd08d_8cf7b530-613e-439b-a8c5-ccfc0e745400
%ProgramFiles(x86)%\manageengine\uems_agent\data\agentapplicationresources.properties5328.tmp

Deletes following files that it created itself

C:\users\public\documents\wu\c2b8.zip
%TEMP%\certificates\client.p12_1985_5328
%ALLUSERSPROFILE%\microsoft\crypto\keys\c893ab121b19f6638ada1a47db231908_8cf7b530-613e-439b-a8c5-ccfc0e745400
%TEMP%\certificates\client.p12_1989_5328
%ALLUSERSPROFILE%\microsoft\crypto\keys\d50ba4dd9e895a5c6f64164e88ee23d0_8cf7b530-613e-439b-a8c5-ccfc0e745400
%TEMP%\dc5328.tmp
%TEMP%\certificates\client.p12_2008_5328
%ALLUSERSPROFILE%\microsoft\crypto\keys\a78989931fc03fe3c1901f173a40e1b7_8cf7b530-613e-439b-a8c5-ccfc0e745400
%ProgramFiles(x86)%\manageengine\uems_agent\data\osdetection.json.gz5328.tmp
%ProgramFiles(x86)%\manageengine\uems_agent\bin\ca-certs.zip
%ProgramFiles(x86)%\manageengine\uems_agent\bin\agent_binaries.7z
%TEMP%\certificates\client.p12_2038_5328
%ALLUSERSPROFILE%\microsoft\crypto\keys\c19a1aaadf4267f6e474cd9dc0ffd08d_8cf7b530-613e-439b-a8c5-ccfc0e745400
%ProgramFiles(x86)%\manageengine\uems_agent\data\agentapplicationresources.properties5328.tmp

Moves the following files

from %ProgramFiles(x86)%\manageengine\uems_agent\images\lato.woff to C:\config.msi\ea8a4.rbf
from %ProgramFiles(x86)%\manageengine\uems_agent\images\info.png to C:\config.msi\ea8a5.rbf
from %ProgramFiles(x86)%\manageengine\uems_agent\images\drop_down_icon.png to C:\config.msi\ea8a6.rbf
from %ProgramFiles(x86)%\manageengine\uems_agent\bin\lato-bold.eot to %ProgramFiles(x86)%\manageengine\uems_agent\images\lato-bold.eot
from %ProgramFiles(x86)%\manageengine\uems_agent\bin\lato-medium.eot to %ProgramFiles(x86)%\manageengine\uems_agent\images\lato-medium.eot
from %ProgramFiles(x86)%\manageengine\uems_agent\bin\resources.exe to %ProgramFiles(x86)%\manageengine\uems_agent\images\resources.exe
from %ProgramFiles(x86)%\manageengine\uems_agent\bin\topmiddle.bmp to %ProgramFiles(x86)%\manageengine\uems_agent\images\topmiddle.bmp
from %ProgramFiles(x86)%\manageengine\uems_agent\bin\cold_normal_msghldr.gif to %ProgramFiles(x86)%\manageengine\uems_agent\images\cold_normal_msghldr.gif
from %ProgramFiles(x86)%\manageengine\uems_agent\bin\hot_mover_msghldr.gif to %ProgramFiles(x86)%\manageengine\uems_agent\images\hot_mover_msghldr.gif
from %ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_444444_256x240.png to %ProgramFiles(x86)%\manageengine\uems_agent\images\images\ui-icons_444444_256x240.png
from %ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_555555_256x240.png to %ProgramFiles(x86)%\manageengine\uems_agent\images\images\ui-icons_555555_256x240.png
from %ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_777620_256x240.png to %ProgramFiles(x86)%\manageengine\uems_agent\images\images\ui-icons_777620_256x240.png
from %ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_777777_256x240.png to %ProgramFiles(x86)%\manageengine\uems_agent\images\images\ui-icons_777777_256x240.png
from %ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_cc0000_256x240.png to %ProgramFiles(x86)%\manageengine\uems_agent\images\images\ui-icons_cc0000_256x240.png
from %ProgramFiles(x86)%\manageengine\uems_agent\bin\ui-icons_ffffff_256x240.png to %ProgramFiles(x86)%\manageengine\uems_agent\images\images\ui-icons_ffffff_256x240.png

Substitutes the following files

%ProgramFiles(x86)%\manageengine\uems_agent\images\lato.woff
%ProgramFiles(x86)%\manageengine\uems_agent\images\info.png
%ProgramFiles(x86)%\manageengine\uems_agent\images\drop_down_icon.png

Network activity

Connects to

'pu####.#iantianxiazai88.com':443
'x1.#.lencr.org':80
'pu####.wantiyou.wiki':443
'11#.#07.11.22':8151

TCP

HTTP GET requests

http://x1.#.lencr.org/

Other

'pu####.#iantianxiazai88.com':443
'11#.#07.11.22':8151

UDP

DNS ASK pu####.#iantianxiazai88.com
DNS ASK x1.#.lencr.org
DNS ASK pu####.wantiyou.wiki

Miscellaneous

Adds a root certificate

Creates and executes the following

'%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcagentregister.exe' -i dc
'%ProgramFiles(x86)%\manageengine\uems_agent\bin\7za.exe' e -mx9 "%ProgramFiles(x86)%\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"%ProgramFiles(x86)%\ManageEngine\UEMS_Agent\bin\" -y
'%ProgramFiles(x86)%\manageengine\uems_agent\bin\dcstatusutil.exe' -install 22

Executes the following

'%WINDIR%\syswow64\rundll32.exe' "C:\Users\Public\0365FC71\<File name>.dll",lua51_entry
'%WINDIR%\syswow64\msiexec.exe' /i "C:\Users\Public\Documents\WU\pkg\UEMSAgent.msi" TRANSFORMS="C:\Users\Public\Documents\WU\pkg\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\U...
'%WINDIR%\syswow64\cmd.exe' /C systeminfo.exe > "%ProgramFiles(x86)%\ManageEngine\UEMS_Agent\\logs\systeminfo.log"
'%WINDIR%\syswow64\systeminfo.exe'
'%WINDIR%\syswow64\rundll32.exe' "C:\Users\Public\0365FC71\<File name>.dll",lua51_entry' (with hidden window)
'%WINDIR%\syswow64\msiexec.exe' /i "C:\Users\Public\Documents\WU\pkg\UEMSAgent.msi" TRANSFORMS="C:\Users\Public\Documents\WU\pkg\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\U...' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial