Overview

overview

8

Static

static

3

0b35bdc91c...ba.exe

windows10-2004-x64

8

0b35bdc91c...ba.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/08/2026, 14:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0b35bdc91cdea843a9b9b1b0fc006aba.exe
  • Size 61.8MB
  • Sample260825-ryq2datdmf
  • SHA256 1d6979a176da38de6b35ccfa4058a94b00cd76d0e9201229344d7af0e0770baa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistencespywaretrojan

Malware Config

Signatures

  • Drops file in Drivers directory 6 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Badlisted process makes network request 5 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Power Settings 1 TTPs 1 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 43 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies trusted root certificate store through registry 1 TTPs 7 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 23 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b35bdc91cdea843a9b9b1b0fc006aba.exe
    "C:\Users\Admin\AppData\Local\Temp\0b35bdc91cdea843a9b9b1b0fc006aba.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Windows\SYSTEM32\msiexec.exe
      "msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\LocalOfficeInstall_e322b4812f1b4d57a53d0d5d1d028898\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\LocalOfficeInstall_e322b4812f1b4d57a53d0d5d1d028898\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\LocalOfficeInstall_e322b4812f1b4d57a53d0d5d1d028898\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\LocalOfficeInstall_e322b4812f1b4d57a53d0d5d1d028898\DMRootCA.crt" /lv "C:\Users\Admin\AppData\Local\Temp\LocalOffice_Agentinstall_msi.log" /qn /norestart
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4704
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3664
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 7268C48206D872760BF52BF52ABE48C9
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1240
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies trusted root certificate store through registry
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2180
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2964
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe
        bin\dcpatchscan.exe -y 1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:4124
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
          4⤵
          • Executes dropped EXE
          PID:3936
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
          4⤵
          • Executes dropped EXE
          PID:4588
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1172
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:2136
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5000
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:216
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\meaap.exe" -m 1 -a 7093261d-e605-4137-be02-f2a185eeaad2
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          PID:2508
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4400
        • C:\Windows\SysWOW64\systeminfo.exe
          systeminfo.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Gathers system information
          PID:468
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 22
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        PID:2060
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
        bin\dcinventory.exe -i postinstallation 0 1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:3380
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\metroapps.exe
          metroapps.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          PID:4184
  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:4448
  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:908
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 9
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:1684
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
      7 0 0
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      PID:3280
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
      bin\dcstatusutil.exe RequestAgentSlotFromServer
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      PID:5028
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      PID:648
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2296
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2136
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
      3 0 0
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:1840
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
        bin\dcinventory.exe -p processor compatibility
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        PID:1068
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcwolsettings.exe
        bin\dcwolsettings.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2176
      • C:\Windows\SysWOW64\cscript.exe
        C:\Windows\system32\cscript.exe DisableEnableEthernet.vbs
        3⤵
        • Executes a VBScript file via the Windows Script Host.
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:3052
        • C:\Windows\SysWOW64\powercfg.exe
          powercfg -devicequery wake_from_any
          4⤵
          • Power Settings
          • System Location Discovery: System Language Discovery
          • Checks SCSI registry key(s)
          PID:1436
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
        dcagenttrayicon.exe -r
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        PID:1844
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
        dcagenttrayicon.exe -s
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        PID:3968
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json
        3⤵
        • Executes dropped EXE
        PID:2876
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:556
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:408
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
        3⤵
        • Executes dropped EXE
        PID:3184
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll
        3⤵
        • Executes dropped EXE
        PID:3712
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4464
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe" -m 1 -c Refresh
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:4844
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n d57c4dc4-daa3-496d-85ce-28fc06cd5c6e -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" -c dcm-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json" -a 2
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3492
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" bin\dccomponentregister.dll
            5⤵
            • Executes dropped EXE
            PID:3184
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
            dcagenttrayicon.exe -r
            5⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            PID:2256
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
            dcagenttrayicon.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2032
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip"
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            PID:1428
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
            dcagenttrayicon.exe -r
            5⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            PID:4424
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
            dcagenttrayicon.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:872
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n a8171afd-f23a-419b-9bb8-146a20bb61fd -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" -c blm -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json" -a 2
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of WriteProcessMemory
          PID:2276
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" bin\dccomponentregister.dll
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5000
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip"
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            PID:2840
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 425cc09c-d116-4ff1-a6f4-52ff663926f6 -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\edrComponent.zip" -c edr_win_neutral -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EDR-metadata.json" -a 1
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3848
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\edrComponent.zip"
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            PID:3436
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\bin\EDRDCManager.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\EDR\\bin\\EDRDCManager.exe" -installorupdate
            5⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:4152
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "Standalone.zip"
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              PID:3236
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\bin\MEARWSetup.exe
              MEARWSetup.exe -install mearwconf.json
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              PID:4468
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\MEARWZipUtil.exe
                x "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\MEARWBundle.7z"
                7⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                PID:3896
              • C:\Windows\SYSTEM32\wevtutil.exe
                wevtutil.exe im EDR.man /rf:"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEEDREventLogResource.dll" /mf:"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEEDREventLogResource.dll"
                7⤵
                  PID:2188
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n d57c4dc4-daa3-496d-85ce-28fc06cd5c6e -c dcm-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json" -a 0
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1960
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\devctrlaction64.exe
              -c 4
              5⤵
              • Checks SCSI registry key(s)
              PID:3500
              • C:\Windows\system32\gpupdate.exe
                C:\Windows\system32\gpupdate.exe /Target:Computer /Force
                6⤵
                  PID:3436
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
                dcagenttrayicon.exe -r
                5⤵
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                PID:4768
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
                dcagenttrayicon.exe
                5⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:1768
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n a8171afd-f23a-419b-9bb8-146a20bb61fd -c blm -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json" -a 0
              4⤵
              • Drops file in Program Files directory
              PID:2244
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 425cc09c-d116-4ff1-a6f4-52ff663926f6 -c edr_win_neutral -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EDR-metadata.json" -e enabled -a 3
              4⤵
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              PID:1184
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s postnotify SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ SYSTEM 0 1
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:364
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\metroapps.exe
            metroapps.exe
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            PID:2440
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuninstallsw.exe
            bin\dcuninstallsw.exe
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1200
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exe
          DCProcessMonitor.exe
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3036
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          PID:3304
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          PID:4880
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
          PID:3796
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe"
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Checks SCSI registry key(s)
          • Suspicious use of WriteProcessMemory
          PID:4392
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driversetup64.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driversetup64.exe" -install "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driver\x64\Win10\DCFAFilter.inf"
            2⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:4788
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driversetup64.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driversetup64.exe" -start
            2⤵
            • Executes dropped EXE
            PID:436
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesFaUser.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\uesFaUser.exe"
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Checks SCSI registry key(s)
            PID:4200
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesDevCtrlSummary.exe
            -s ET_ENUM 9 2 "Unknown"
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4448
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\devctrlaction64.exe
              -c 9
              3⤵
              • Executes dropped EXE
              PID:452
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driversetup64.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driversetup64.exe" -stop
            2⤵
              PID:4680
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
            1⤵
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious use of WriteProcessMemory
            PID:1472
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "0" "C:\Windows\TEMP\{c297ff37-a73f-e24d-9352-23ce4e1962cd}\DCFAFilter.inf" "9" "4ca28cc43" "0000000000000154" "Service-0x0-3e7$\Default" "0000000000000164" "208" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win10"
              2⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              PID:2940
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "0" "C:\Windows\TEMP\{136c44ce-7525-d04c-92cb-f75e39d562a8}\MEARWFltDriver.inf" "9" "494795b4b" "0000000000000164" "Service-0x0-3e7$\Default" "0000000000000168" "208" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\win10"
              2⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              PID:1248
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\mearwfltdriver.inf_amd64_33949fe404711eb9\mearwfltdriver.inf" "0" "494795b4b" "0000000000000168" "Service-0x0-3e7$\Default"
              2⤵
              • Drops file in Drivers directory
              • Drops file in Windows directory
              PID:3408
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEARWService.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEARWService.exe"
            1⤵
            • Executes dropped EXE
            PID:2884
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\TelemetryService.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\Telemetryservice.exe"
            1⤵
            • Executes dropped EXE
            PID:2096
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEARWService.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEARWService.exe"
            1⤵
            • Checks processor information in registry
            • Suspicious behavior: LoadsDriver
            PID:1580

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                e580abd.rbs
                • Path C:\Config.Msi\e580abd.rbs
                • Size 58KB
                • SHA256 6d45738a93d21187c1f06a90b2614007afd721ac88bb0a850fc5df5c3fe504e3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                e580ac2.rbs
                • Path C:\Config.Msi\e580ac2.rbs
                • Size 546B
                • SHA256 4148a1f17d246da1f0f897a50dc1b53b8322c9e60be34fdf17f2e4abb89ad2b6
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                PocoCrypto.dll
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\BitLockerMgmt\bin\PocoCrypto.dll
                • Size 2.2MB
                • SHA256 24208305449f9e0798f83bdac575747e2f059a5b6673fe95502dd124112f6fc1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MEARWSetup.exe
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\MEARWSetup.exe
                • Size 18.5MB
                • SHA256 0319b8610148abe1fa8db678a103783e72779b53480a27451d90edf770d4570c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                90b9d24c-5edd-3175-45e9-9b7254d56a79.tmf
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\TMF\90b9d24c-5edd-3175-45e9-9b7254d56a79.tmf
                • Size 528B
                • SHA256 5213fa5faae507b4996b28c52eb50bb5f06ef80426b136ea517658646786a29e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                9e234734-152e-3823-fe7e-1b069641acdd.tmf
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\TMF\9e234734-152e-3823-fe7e-1b069641acdd.tmf
                • Size 808B
                • SHA256 d07fb737c90be645335a3d1447f425dbee8e53ef64dc5f6f8db1af950e8c9ade
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                c0b570d4-7c75-39ee-f5da-d5578c9e051f.tmf
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\TMF\c0b570d4-7c75-39ee-f5da-d5578c9e051f.tmf
                • Size 5KB
                • SHA256 568996b736760671d213ac966e81ca5d93d3caa3db08464795205746fb314b5e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                c43811e3-df39-362d-6475-e12b8896e803.tmf
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\TMF\c43811e3-df39-362d-6475-e12b8896e803.tmf
                • Size 2KB
                • SHA256 e79f6d75f731f6ddcdd4c56430292fd9a67412aff5c6bc77f22c70518ca4d994
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Standalone.zip
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\bin\Standalone.zip
                • Size 15.4MB
                • SHA256 4965befa29503df9ac47ce5b90460bad18f23605f39676f17571466f581a51cf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7za.exe
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                • Size 802KB
                • SHA256 f00836a63be7ebf14e1b8c40100c59777fe3432506b330927ea1f1b7fd47ee44
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ClientAuthHandler.dll
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
                • Size 2.3MB
                • SHA256 7627f75435af64ab72991eb93996df3f61101e7b57cdf5a9d8d2e06d75b76aad
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Lato-Bold.eot
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
                • Size 250KB
                • SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Lato-Medium.eot
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Medium.eot
                • Size 245KB
                • SHA256 1727853b9469a665c3a5573e39503bc592a794d810aed5d03e9a8940f507823c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                agent_binaries.7z
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
                • Size 14.6MB
                • SHA256 6d5bf676a5800214126df113bbf68a8b3f6ea051ccfbf212c11927df89035082
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ca-certs.zip
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ca-certs.zip
                • Size 160B
                • SHA256 7e6debd55c669504ffd364e96b1e539c5d6839472887ecd739ba79b155c62fa1
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                cfgUpdate.exe
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cfgUpdate.exe
                • Size 62KB
                • SHA256 7232bb0e4842bf2f8a370dce70df60c72560416a5bb317650cf88afbd7acb820
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cold_normal_msghldr.gif
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cold_normal_msghldr.gif
                • Size 536B
                • SHA256 fc7d90a7546fb0f8c8ad6e617f74d185be15f85aaf5d329919bc2776887bc9d1
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                dcagentregister.exe
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
                • Size 92KB
                • SHA256 430aad28ddd50d0026f7e547764b2f4cd7c54204519e119614895068397904dc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dcagentservice.exe
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
                • Size 1.2MB
                • SHA256 23fa8f503da68dd5724b136f9f401ab747db352e5edd8e2c277bf7426f774773
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dcpatchscan.exe
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe
                • Size 3.3MB
                • SHA256 e3200c70077193f3decf5896fded35b3cce2034aec5517178a24e35a665abfd0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dcstatusutil.exe
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
                • Size 1.1MB
                • SHA256 b24ad0ae12c05931f11b66f26166c7ec41a7be318893aebe4cc2babe29bdb080
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                hot_mover_msghldr.gif
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hot_mover_msghldr.gif
                • Size 172B
                • SHA256 c9657b6062e0798cfb5e39be8d8d1546d901ee339dde4915c82b40460a205f9e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                resources.exe
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.exe
                • Size 318KB
                • SHA256 7e311d65ca1a0461cc6bda079efdcbd4f2f0a7967c2f09be02f2b62b97eb4848
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                topmiddle.bmp
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\topmiddle.bmp
                • Size 1016B
                • SHA256 bb6b032f562a0578070b18e1002c22bec4520cf191f11384af316a0ae33b8cea
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                ui-icons_444444_256x240.png
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png
                • Size 6KB
                • SHA256 eaf7c7ee2747275dda6c53e731a10db1a7b15f4fbb46e1b69d6bb2056bc9fd81
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ui-icons_555555_256x240.png
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_555555_256x240.png
                • Size 6KB
                • SHA256 5d04051dfd9d2d740355404f98a683d1ec0feb2fca7d76e533c1a6e5ce92dd2e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ui-icons_777620_256x240.png
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777620_256x240.png
                • Size 4KB
                • SHA256 9dbe4a0d03feed6f65eb2560a0a8b4ba4264545ee8fd31c1763a3b219d0328d6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ui-icons_777777_256x240.png
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png
                • Size 6KB
                • SHA256 e75b27211e16fcf94715168001bb7055ca376d46f928110ba3d0825232452e5a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ui-icons_cc0000_256x240.png
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_cc0000_256x240.png
                • Size 4KB
                • SHA256 02891575d4358e9edde3e42d94057f8e9f82a9d64376f71ee86cef149d30537e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ui-icons_ffffff_256x240.png
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_ffffff_256x240.png
                • Size 6KB
                • SHA256 b6b06deef2b924cc3835d63f4883d47882734a33e71b212d917a68cede3b8e9d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dlp-consentsetting.json
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\dlp-resources\dlp-globalsettings\dlp-consentsetting.json
                • Size 45B
                • SHA256 44912bd9b29453180d9a68c47f277dab01bd24560fd83954cacae891d7575e46
                • MD5 SHA1 SHA512
                Submit Download

                dlp-globalsetting.json
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\dlp-resources\dlp-globalsettings\dlp-globalsetting.json
                • Size 592B
                • SHA256 da445cc28048ffd0fcc3460576ceb1188ddc449d614f3a376c9d40e8c59f73ee
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                patch-database-settings.xml
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-database-settings.xml
                • Size 197B
                • SHA256 1acf861ddbabb4864373aa0f8e4d968dd8aab2230c4ed1761184c3f5f98b0201
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                patch-diff-scan-settings.xml
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-diff-scan-settings.xml
                • Size 371B
                • SHA256 0c4bcbbf268f2228c6ae0607d126ce1e6db2bd8a01d36de5f18d02539bd3af8c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                global-meta-data.xml
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\global-meta-data.xml
                • Size 30KB
                • SHA256 a9415e4096fbac365522539b85077f8e5c7c9f2e2c4181840d4fc68762ced59a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                EPMErrorCodes.xml.gz
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\EPMErrorCodes.xml.gz
                • Size 7KB
                • SHA256 f98afedcadb662b4d445800cb2fb704c9432f6449a850db0de7626dc5e50e000
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                applications.xml.gz
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\applications.xml.gz
                • Size 602KB
                • SHA256 39be995d6169eef15d93279394ea705d389d0763fb9072cfd13f44c2bb070ce1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dcdriverupdates.dll.gz
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcdriverupdates.dll.gz
                • Size 365KB
                • SHA256 b51efd8fde309d36a38e2174db59bc7633473df450627fdfea437816cfe42c05
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dcpatchutils.dll.gz
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcpatchutils.dll.gz
                • Size 516KB
                • SHA256 a80de7283baa35b09e93ae6d98c1b56df4fca3a39c866a991c0e5ba01982ea54
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                drvforceupdate.exe.gz
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\drvforceupdate.exe.gz
                • Size 120KB
                • SHA256 76bb3afb0c8746b57f118fdc4ea24c7daa04ab6bbe364650f359de24cc31ff4c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                hardware.json.gz
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\hardware.json.gz
                • Size 117KB
                • SHA256 1cb1bad6763d9a9514d4ee2e61452570fbed3f9d4ad8cf00062b5f8bfa7b8647
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                patch-dependency-details.xml.gz
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-dependency-details.xml.gz
                • Size 98KB
                • SHA256 b530b1be4f272abc44c87165fdaad6d66fb321bb37df29376df3f574d4f22cbf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                patch-scan-data.xml.gz
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-scan-data.xml.gz
                • Size 221KB
                • SHA256 c3b94f24165829a7d095fe6f476b20abe75be2d4d076f062866faf0b2a36bad5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                patchresource.xml.gz
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchresource.xml.gz
                • Size 146KB
                • SHA256 acb668ef2b9d5527dc687287ed946d766d364f362d992e76fdfc86ec9e211857
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                patchtodepfiles.xml.gz
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchtodepfiles.xml.gz
                • Size 3KB
                • SHA256 bfde9ef32c09cc3b51fe16eea601429fe2685af6996d17bf3c846b2591319db7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                patchutils.json.gz
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchutils.json.gz
                • Size 340B
                • SHA256 16d745bb671edcc34b3af1f7f08afe9b9562ad5b514fe0fa9918190c6dbab527
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                quick-updates.json
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\quick-updates.json
                • Size 101KB
                • SHA256 59012dbad6157abfbc13ed56db01b4cd5ecd4a2c3b449e541817a97e49b5102c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                server-applications.xml
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\server-applications.xml
                • Size 62B
                • SHA256 dc3ba306133d36aca2f8529d71b2c11cff1ef1b322d036aa44fb4ad8215ec9c7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                superseded-tree-scan-data.7z
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\superseded-tree-scan-data.7z
                • Size 334KB
                • SHA256 065c3d8469aa6c7315b97134765c3cabf9e78dca92e72bd9ba08668f490b29c9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MisconfigEngine.dll.gz
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\MisconfigEngine.dll.gz
                • Size 464KB
                • SHA256 330c26d95b59deb9cc893537bc91e1b8852d1ff4c99219c968ded6e93440c009
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ServerDetectionChecks.dll.gz
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz
                • Size 201KB
                • SHA256 0e38c0611ca05835971a71b2f460ddfe8a936b2b5c02d6611b09854c6cdce2a3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                applications-vul.xml.gz
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\applications-vul.xml.gz
                • Size 141KB
                • SHA256 e49c430ba8e8682de84a83f5f1249f66563c736a13df4361d17ad7f78d220ab9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                misconfig-scan-data.xml.gz
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\misconfig-scan-data.xml.gz
                • Size 47KB
                • SHA256 e612eff87704aa1b808532cf878ac8d78fb181f517d7fd00ecbbec63f9f8381a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                patchresource-vul.xml.gz
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\patchresource-vul.xml.gz
                • Size 27KB
                • SHA256 cf2b2094dbcc2840410fe2812821bb961aa3759f6748a2dd1e3bac9137f3a746
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vulnerable-patch-scan-data.xml.gz
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml.gz
                • Size 37KB
                • SHA256 19ae96a2307b3168ba31c94217de340527314374003c3bed055bb523d5f2488c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vulnerable-scan-data.xml.gz
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-scan-data.xml.gz
                • Size 107KB
                • SHA256 255a2bb1bdef193f8016a54971293fb14fc650099f81a01ca8ed50d3a5fd4c8d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AgentApplicationResources.properties4788.tmp
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties4788.tmp
                • Size 98KB
                • SHA256 fb1321f35dacb680e3cefb846f65f657b7141ecaaac61ecea2a009f6a0434426
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                BitLocker-metadata.json
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json
                • Size 394B
                • SHA256 5b25e3ce74a902d1b41f08bdf936a191198d2178bd0ca09f18f2509de7263289
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                DeviceControl-metadata.json
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json
                • Size 753B
                • SHA256 2b4b191c84b370692fafa646c83ae75725523e1098a7e59539a5731a5a27d5aa
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                EDR-metadata.json
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EDR-metadata.json
                • Size 478B
                • SHA256 97d2b19996f210a08e1310607312237681e4c0928cf31027d078518bf792110f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                OSDetection.json
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
                • Size 15KB
                • SHA256 d4a4d290a60e27dde19bb6b6183da79ebb8a254bd25ffa41f8c5d3d67f8c2702
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OSDetection.json
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
                • Size 28KB
                • SHA256 c94170a5dc3bdc23b7597f4e17be2f4ea660dba2fc992071492bb16d0b0a7b3f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OSDetection.json.gz
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz
                • Size 2KB
                • SHA256 5cbc36ed2b88e9ecb6ad8d4d68c98cb191cf82807fc1092a1eb93cf34a0dd67f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                addons-resources.json
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\addons-resources.json
                • Size 22B
                • SHA256 acd51bf9e6f86217f046dd8d1b31cd2d324a52fd65e640da1d4ea6a2229b0a61
                • MD5 SHA1 SHA512
                Submit Download

                agent-security-setting.json
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-security-setting.json
                • Size 203B
                • SHA256 70e74ac083bf8fa77f19ff68f2c2c8f7c8290df0c33910dde84c651848b36bb0
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                agent-settings.xml
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml
                • Size 3KB
                • SHA256 931d224b381877983390eccb5cbbbddd558c4b3bc520841313e70904a391767f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                application-agent-store.json
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\application-agent-store.json
                • Size 1KB
                • SHA256 75de1529570863213fcb85339eeaf2c15b8a68c04f1cf81073e4b0cf4d783712
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                configuration-settings-dc-win10.xml
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
                • Size 242KB
                • SHA256 1a388c11ac7b14c44ecb605da1f6111274beb11d947442311c5ef1a88d6e4b68
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                customer-meta-data.json
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json
                • Size 1KB
                • SHA256 e8deaa3eb6fc797e1fd8ddf51b554e9ed600c3f1e988ccbf3649ff28255c99b9
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                data-dictionary-br.xml
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-br.xml
                • Size 54KB
                • SHA256 200c5b769c540ea6cfcf8b311b3cfbe950b2f93406020deca59cd31773a6c9d8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data-dictionary-edb.xml
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-edb.xml
                • Size 389KB
                • SHA256 be1f87e03f3fd0cb7fc75784db831a31cb3c809cb08d4dbf784d6ac832382534
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data-dictionary-framework.xml
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
                • Size 415KB
                • SHA256 9e2dcf836433b648d592cf5ea82af6d44cc6f0cb8625436dc164dda3601df2a7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data-dictionary-mc.xml
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-mc.xml
                • Size 62KB
                • SHA256 43d6385cd675c9b3217f5d59437f887806cd8ca1a56aa49916b999dcd8fc621b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data-dictionary-onpremise.xml
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
                • Size 109KB
                • SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data-dictionary-pm.xml
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-pm.xml
                • Size 278KB
                • SHA256 73c9afdb65406c39f529eb6461b60b91352160a6ab53cf6f1d1c033ad5baf61f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data-dictionary-vul.xml
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-vul.xml
                • Size 163KB
                • SHA256 052ff066f5ca62c9d79312f15341789b4c4851c0e0f67e02eb3bed5454c1bd53
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data-dictionary.xml
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
                • Size 1.6MB
                • SHA256 0c6236f2f6794c79fb2795bea6eb04775d94ea8079ce9d92502236bfb448a706
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ds-server-info.xml
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ds-server-info.xml
                • Size 881B
                • SHA256 2e9c93194157a2a161d7ff44e17362ce3adb2aa66363659a0e5e5b749cc03bf8
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                dynamic-variables.xml
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\dynamic-variables.xml
                • Size 28KB
                • SHA256 6df9a28cfd8d76f1e41e6f9fcdf28eb8fa3b5a5d67015ba51fdf1c76980bde1d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                edrmeta.json
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\edrmeta.json
                • Size 310B
                • SHA256 67dba8238460dfc226087f76a67b217513eb91f9b2451be191847b9d13483a2f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                mdm-enrollment-settings.json
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\mdm-enrollment-settings.json
                • Size 141B
                • SHA256 06ac898bebdcc7eb5d11812733a3c93d4fea8db59f7a0c1db04aea8c6a115fdd
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                meta-data.xml
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml
                • Size 8KB
                • SHA256 03f417bb839b66fe220ea0daadc8380f269b52c6b3412564d3a52c41acc00e37
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                meta-data.xml
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml
                • Size 8KB
                • SHA256 a6f5ef7026b56c942ff1ecc840f59c0c3b9a3484b47e6a14f3a4d67fb71acbfe
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ns-status-details.xml
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ns-status-details.xml
                • Size 1KB
                • SHA256 bed18ac9df66eeb02d52a9e77f9626e26fab5adb39d48624ffd1d491fbff4fc1
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                vmware-names.conf
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf
                • Size 55B
                • SHA256 2001c465639c8b53419ae3ef4069ba573577ed26f592c988463e5db44336d7f8
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                dcagent.dll
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
                • Size 3.1MB
                • SHA256 15ad7ce2ebfda80a19bde288e71b7c63c1b3cd71416b7ee2df6504610de44883
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Lato.woff
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
                • Size 36KB
                • SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                drop_down_icon.png
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
                • Size 449B
                • SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                info.png
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
                • Size 2KB
                • SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Network_Connection.log
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
                • Size 436B
                • SHA256 fb3ab393fd395bb645d35f94dab373bce12f2f73d414cbc8439c280c09ee6bb8
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Network_Connection.log
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
                • Size 1KB
                • SHA256 320b3dbc83b3fb559010eb20e808a169e102b7fd4ddbbf87c89ca4a8953cba8b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                dcagentinstaller.log
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
                • Size 98KB
                • SHA256 8fadef0e37c0b07a5fbe51adedc05e0e026af4e8f0f11d55a05a7d6d201aeaa9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dccomponentregister.log
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dccomponentregister.log
                • Size 30KB
                • SHA256 2c92ce0923f23e89112b58d30984c5f178b7265f5661667005d81ccf5cfadd1d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dcdatatransferdown.log
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
                • Size 1KB
                • SHA256 fb78eecdb36cc8c9394a99949935540eac9d421b5df6ab4dd37980bae1fc723c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                dcdatatransferdown.log
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
                • Size 1KB
                • SHA256 4fa5d7141469a30c8af8e926ddc5c33f0b0e663043bd2f2ea2f9e191f3a732de
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                dcdatatransferdown.log
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
                • Size 2KB
                • SHA256 d4b6ae2aeefc47e0f1050a350ec55c43242793fe469dac40db850555aa556bad
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                dcdatatransferdown.log
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
                • Size 4KB
                • SHA256 537fcfd5242dabdd2d944e173d52fc9a4872aa3e4b3621ee43669640d6d6d084
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                devicepatchaccess.log
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devicepatchaccess.log
                • Size 784B
                • SHA256 d136612d7449b98bc4832b9f011cf73d02ea15ce6d0a45295fe25f72230990cc
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                meaaphelper.log
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\meaaphelper.log
                • Size 23KB
                • SHA256 711691f50612290b8cb471de13e643a4e80b55eac3ed79c564622ca52a7cf722
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                BitLockerMgmt.zip
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip
                • Size 2.3MB
                • SHA256 fbf012237b68d8d289956cee3d811eb780dfeac07671d0a3f557e63952ec234d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DeviceControl.zip
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip
                • Size 8.2MB
                • SHA256 5c8fe933b91bb00c0fe0e907e78a84de10d23dbd8d95ae5908c024b2a4cd19cd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                edrComponent.zip
                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\edrComponent.zip
                • Size 1.5MB
                • SHA256 226d3c27dfcef0ed2f4bb2cace0ad846c4869a46b26226b6371c7ac8fac1591e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                client.p12_3280_4788
                • Path C:\Users\Admin\AppData\Local\Temp\Certificates\client.p12_3280_4788
                • Size 1002B
                • SHA256 98513242022faa3363e4d5c0737b17bb655da5c4a3967e4dfd51bb42cd70536d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                DCAgentServerInfo.json
                • Path C:\Users\Admin\AppData\Local\Temp\LocalOfficeInstall_e322b4812f1b4d57a53d0d5d1d028898\DCAgentServerInfo.json
                • Size 1KB
                • SHA256 23edfd9749d4892b6d943c27f7ba13ab382e65fc5a3f193c2e43bc7e4801ec88
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                DMRootCA-Server.crt
                • Path C:\Users\Admin\AppData\Local\Temp\LocalOfficeInstall_e322b4812f1b4d57a53d0d5d1d028898\DMRootCA-Server.crt
                • Size 1KB
                • SHA256 7a0bcd5cc0044edc3eca1375f973436d25e55309367464bb8e508295f0d67442
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                DMRootCA.crt
                • Path C:\Users\Admin\AppData\Local\Temp\LocalOfficeInstall_e322b4812f1b4d57a53d0d5d1d028898\DMRootCA.crt
                • Size 1KB
                • SHA256 a822d1d6a024796f35f712c078da74975d1f22a35984f36d0c94e0facb6c6004
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                UEMSAgent.msi
                • Path C:\Users\Admin\AppData\Local\Temp\LocalOfficeInstall_e322b4812f1b4d57a53d0d5d1d028898\UEMSAgent.msi
                • Size 31.8MB
                • SHA256 92f68fc7f6d0f544a750bf67b4903d1a4062d1372b7f98ab5c2f698eb61359bb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                UEMSAgent.mst
                • Path C:\Users\Admin\AppData\Local\Temp\LocalOfficeInstall_e322b4812f1b4d57a53d0d5d1d028898\UEMSAgent.mst
                • Size 20KB
                • SHA256 180195558475b32abedb88b3103c06ee464148809986b78de32d8fdba897c516
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                LocalOffice_Agentinstall_msi.log
                • Path C:\Users\Admin\AppData\Local\Temp\LocalOffice_Agentinstall_msi.log
                • Size 1KB
                • SHA256 41846d05bf017e4e150111a3c3401d6dc897ffebf78b7affe8bd41e2cc6b1ebc
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                dc2792.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\dc2792.tmp
                • Size 9B
                • SHA256 bac0662712b7b39d4817f00ac40c2d4bbd49c0d1fb3fa45a78e7437620b022c6
                • MD5 SHA1 SHA512
                Submit Download

                MSI3E2D.tmp
                • Path C:\Windows\Installer\MSI3E2D.tmp
                • Size 81KB
                • SHA256 17805948e9d5f51fca01c13bb7dedb1f1a1e17bcf5cc0cb6c01d9f773b712744
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dcagenthttp.dll
                • Path C:\Windows\SysWOW64\dcagenthttp.dll
                • Size 3.6MB
                • SHA256 3de8d74127b797813742dd9fd618c38572b269f8dbb14af4d6014a1addec4e38
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dclibxml2.dll
                • Path C:\Windows\SysWOW64\dclibxml2.dll
                • Size 2.1MB
                • SHA256 a451dd3babd79318b612072cb417fd4848be821a1607dc58ac31676e9312fd7a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SETFD90.tmp
                • Path C:\Windows\Temp\{136c44ce-7525-d04c-92cb-f75e39d562a8}\SETFD90.tmp
                • Size 12KB
                • SHA256 ff370bd017d038fd1b0d2536db051eb131e216a56020bc76a23400c4b4832b9c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SETFD91.tmp
                • Path C:\Windows\Temp\{136c44ce-7525-d04c-92cb-f75e39d562a8}\SETFD91.tmp
                • Size 3KB
                • SHA256 6abdef9568f83803d07d67c3b984042f4b34e60324381382520b7601ea35824f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                SETFD92.tmp
                • Path C:\Windows\Temp\{136c44ce-7525-d04c-92cb-f75e39d562a8}\SETFD92.tmp
                • Size 144KB
                • SHA256 8f65278ad59e2c88707b9ec4e61819c06aac61c109845200f6e09f3297acbe2b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DCFAFilter.cat
                • Path C:\Windows\Temp\{c297ff37-a73f-e24d-9352-23ce4e1962cd}\DCFAFilter.cat
                • Size 11KB
                • SHA256 13ca4fe14d26dd21d435e3574785d13f8812f09e4aec8bde236dfdaf1bd8c45a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DCFAFilter.inf
                • Path C:\Windows\Temp\{c297ff37-a73f-e24d-9352-23ce4e1962cd}\DCFAFilter.inf
                • Size 3KB
                • SHA256 f333d903628f9290d46f127c6cf9db0f1523298a458a42f5fca76aee4326a281
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                DCFAFilter.sys
                • Path C:\Windows\Temp\{c297ff37-a73f-e24d-9352-23ce4e1962cd}\DCFAFilter.sys
                • Size 52KB
                • SHA256 232b51747b0d296e16dfe7de614716e76e04e650939b123250f191eda5831e7b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/3068-0-0x0000000000020000-0x0000000000028000-memory.dmp
                Download