Overview

overview

7

Static

static

3

setup.exe

windows10-2004-x64

7

setup.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/08/2026, 02:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    setup.exe
  • Size 58.6MB
  • Sample260824-c53lessdmg
  • SHA256 abb9decacf6925cc39d9626b8cf925ee4518b8ff0f8c66885847c6c74c690b16
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 5 IoCs
    discovery
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 23 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies trusted root certificate store through registry 1 TTPs 8 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 10 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 36 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4696
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS"
      2⤵
      • Executes a VBScript file via the Windows Script Host.
      • Suspicious use of WriteProcessMemory
      PID:2480
      • C:\Windows\System32\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2448
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5716
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 02C4354E89C3D944649CCAE2619747BA
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4868
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies trusted root certificate store through registry
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5804
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2800
        • C:\Windows\SysWOW64\net.exe
          net session
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4840
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 session
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4080
        • C:\Windows\SysWOW64\icacls.exe
          "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q
          4⤵
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:4692
        • C:\Windows\SysWOW64\icacls.exe
          "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant:r "YRWKJLDU\Admin":(OI)(CI)F /T /Q
          4⤵
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:4320
        • C:\Windows\SysWOW64\icacls.exe
          "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /inheritance:r
          4⤵
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:2832
        • C:\Windows\SysWOW64\icacls.exe
          "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q
          4⤵
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:4204
        • C:\Windows\SysWOW64\icacls.exe
          "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q
          4⤵
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:5532
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4276
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        7za.exe e -aoa "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:5232
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -p dc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2476
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"
          4⤵
          • Drops file in Program Files directory
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4464
          • C:\Windows\SysWOW64\systeminfo.exe
            systeminfo.exe
            5⤵
            • System Location Discovery: System Language Discovery
            • Gathers system information
            PID:5988
  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:2784
  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4628
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exe
      CRU_Reporter.exe -RegisterCRU
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2952
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2740
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 9
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:2084
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
      7 0 0
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies registry class
      PID:4444
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      PID:2012
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2148
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
      bin\dcstatusutil.exe RequestAgentSlotFromServer
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:6108
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
      3 0 0
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:2240
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
        16
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        PID:2756
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      PID:4928
  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\UEMSAgentHealthChecker.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5816
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 1
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5304
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 2
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3452
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 4
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1120

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e595d3d.rbs
        • Path C:\Config.Msi\e595d3d.rbs
        • Size 63KB
        • SHA256 2f22ef8be22c9503dc386b93193cbe1c93ee9bca9659246c7e7bb1a2a64ec3d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e595d43.rbs
        • Path C:\Config.Msi\e595d43.rbs
        • Size 546B
        • SHA256 bddb303666fbb4ebe0d7d139dbcbbc377522c1a5a5123ad6d58c0e20a8fe7aac
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        client.p12
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
        • Size 1KB
        • SHA256 a514669ec6b87ee81d1efc82056cbfbf3ad1abb31db83aebefa953e98c2bdb9f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        7za.exe
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        • Size 839KB
        • SHA256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ClientAuthHandler.dll
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
        • Size 3.1MB
        • SHA256 83213e2eaf59ae51dae43ef745211cfec11fc2f2cdddcf12e60e876cb31432a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lato-Bold.eot
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
        • Size 250KB
        • SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lato-Medium.eot
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Medium.eot
        • Size 245KB
        • SHA256 1727853b9469a665c3a5573e39503bc592a794d810aed5d03e9a8940f507823c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UEMSAgentCryptoHandler.dll
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
        • Size 480KB
        • SHA256 1350d993df746987d9f73a5f16bbbcfc007b973b47aae002b896e9d8de1d1db1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        agent_binaries.7z
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
        • Size 29.1MB
        • SHA256 14ae05d3e056207fa991ede24704f76bfb6a7c329993769e78374113c4ac0193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cold_normal_msghldr.gif
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cold_normal_msghldr.gif
        • Size 536B
        • SHA256 fc7d90a7546fb0f8c8ad6e617f74d185be15f85aaf5d329919bc2776887bc9d1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dcagentregister.exe
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
        • Size 244KB
        • SHA256 46532137b794eee1e1b1459bd74d8b4dd79e05533076a4b30e78105c9ce0acd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dcagentservice.exe
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
        • Size 1.5MB
        • SHA256 9df7a780cd51de4467f55c8553ba361b1207de9f6073aa5eab5368154041bf2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dcstatusutil.exe
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
        • Size 1.3MB
        • SHA256 ad2ef8e8cd6d18a93aaa5daea434c1c3b48bf3da5cc7f7af728a53da2b3d8881
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hot_mover_msghldr.gif
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hot_mover_msghldr.gif
        • Size 172B
        • SHA256 c9657b6062e0798cfb5e39be8d8d1546d901ee339dde4915c82b40460a205f9e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        resources.zip
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.zip
        • Size 119KB
        • SHA256 790e4cc4c928b2055f625056e5e98a1ac6059ac54dd30f4126ed01f506b0f23f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        topmiddle.bmp
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\topmiddle.bmp
        • Size 1016B
        • SHA256 bb6b032f562a0578070b18e1002c22bec4520cf191f11384af316a0ae33b8cea
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ui-icons_444444_256x240.png
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png
        • Size 6KB
        • SHA256 eaf7c7ee2747275dda6c53e731a10db1a7b15f4fbb46e1b69d6bb2056bc9fd81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-icons_555555_256x240.png
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_555555_256x240.png
        • Size 6KB
        • SHA256 5d04051dfd9d2d740355404f98a683d1ec0feb2fca7d76e533c1a6e5ce92dd2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-icons_777620_256x240.png
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777620_256x240.png
        • Size 4KB
        • SHA256 9dbe4a0d03feed6f65eb2560a0a8b4ba4264545ee8fd31c1763a3b219d0328d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-icons_777777_256x240.png
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png
        • Size 6KB
        • SHA256 e75b27211e16fcf94715168001bb7055ca376d46f928110ba3d0825232452e5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSDetection.json
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
        • Size 15KB
        • SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        agent-settings.xml
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml
        • Size 5KB
        • SHA256 f483839509d0b48247c6e6b6ac903dd1843252ae396b0de1b2564830e4a6e28d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        configuration-settings-dc-win10.xml
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
        • Size 247KB
        • SHA256 4a84d8cc08ffa3e45d7e350550fd32d4a0416788eabe3fba77c8c2df2dc1fe6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        data-dictionary-framework.xml
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
        • Size 413KB
        • SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        data-dictionary-onpremise.xml
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
        • Size 109KB
        • SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        data-dictionary.xml
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
        • Size 1.6MB
        • SHA256 223fc4388d7e54a0a27395911535adc0cf8b26f7e992dc6f0d189b77331b5137
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dcagent.dll
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
        • Size 4.6MB
        • SHA256 bec4bd6a1744b0a8c8856f9f779db2eb3bdba081a489adb19000de7a52ccefa4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lato.woff
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
        • Size 36KB
        • SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dcmsghandler.ico
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico
        • Size 14KB
        • SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        drop_down_icon.png
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
        • Size 449B
        • SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        info.png
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
        • Size 2KB
        • SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        minimize_icon.svg
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
        • Size 161B
        • SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dcClientAuthAccess.log
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
        • Size 3KB
        • SHA256 7efbd020b81e81b4532ed1ea9ceb95e8f70fa48edcce1c46cad2838fcd8471a0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dcClientAuthAccess.log
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
        • Size 3KB
        • SHA256 ac657374af926d6b8946fada5129cdbd4a06d2914c7b0f80999a1fedc247b3bc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dcClientAuthAccess.log
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
        • Size 4KB
        • SHA256 7f23bee368a18d21d09a433383b93b3625a527a6220a3e981f3502cc60cb2944
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dcagentinstaller.log
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
        • Size 11KB
        • SHA256 27c2cb56c25e3a240381b9409c03bfea3deb973e4c481a8a0f763155d568675a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dcrotatelog.log
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
        • Size 1KB
        • SHA256 faf7739b657ac6b107f42cdd590fb55418619ad398cb72b536bc911ebb7aa844
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        setAppPermission_Internal.bat
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
        • Size 957B
        • SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DMRootCA-Server.crt
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
        • Size 1KB
        • SHA256 32b04c296998752e382484eb8986e886805934e461edc611051575e355600d1c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DMRootCA.crt
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
        • Size 1KB
        • SHA256 6b6935462dc5232dd152f4b380e34e0c7f5678b443e1ea0e2811c2b21a49c55c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Agentinstalllog.txt
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt
        • Size 1KB
        • SHA256 1df698250183cb42326066bed82d55c3caa437abf7d3b906e5c57e3fb874a4db
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DCAgentServerInfo.json
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCAgentServerInfo.json
        • Size 4KB
        • SHA256 2d906fc376010ab0f3145b58e4e5d3b73540ae361d7222509bdef10293871a4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SetUP.VBS
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS
        • Size 824B
        • SHA256 6053c83865de1fe0f527608a3cff4d1689bfebc4047d81187fb78e8dbbbbb74c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UEMSAgent.mst
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst
        • Size 20KB
        • SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI6279.tmp
        • Path C:\Windows\Installer\MSI6279.tmp
        • Size 429KB
        • SHA256 f78db8103f85debda13f93feafdb903823f8751640885492c6aeef938d7b09a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dcagentlibxml2.dll
        • Path C:\Windows\SysWOW64\dcagentlibxml2.dll
        • Size 2.0MB
        • SHA256 fffcb7b3ea73b35ee4cbbe137f40b84fd6799f762cdb2a29f40b07c60cecdde2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download