Overview

overview

8

Static

static

1

README.html

windows10-2004-x64

3

README.html

windows11-ltsc_2024-x64

3

UEMSAgent.msi

windows10-2004-x64

7

UEMSAgent.msi

windows11-ltsc_2024-x64

7

facai.vbs

windows10-2004-x64

7

facai.vbs

windows11-ltsc_2024-x64

8

setup.bat

windows10-2004-x64

3

setup.bat

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/08/2026, 12:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    facai.vbs
  • Size 1KB
  • Sample260827-plz3eatsft
  • SHA256 3d1a86ad729817d85377f59c3d5dcc67ba59af9824ae64aea8e626f6a4956d52
  • MD5 SHA1 SHA512 TLSH
Score
8/10
defense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Executes dropped EXE 42 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 24 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
    execution
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 23 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies trusted root certificate store through registry 1 TTPs 7 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 56 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 30 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 23 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 25 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\facai.vbs"
    1⤵
    • Executes a VBScript file via the Windows Script Host.
    • Suspicious use of WriteProcessMemory
    PID:4236
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\facai.vbs" /elevated
      2⤵
      • Executes a VBScript file via the Windows Script Host.
      • Suspicious use of WriteProcessMemory
      PID:5852
      • C:\Windows\System32\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA.crt" /qn
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4312
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D596E51AE9376C8129C09BFD357A8A49
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2264
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies trusted root certificate store through registry
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1364
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3360
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2112
        • C:\Windows\SysWOW64\systeminfo.exe
          systeminfo.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Gathers system information
          • Modifies data under HKEY_USERS
          PID:3984
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 22
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        PID:3600
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
        bin\dcinventory.exe -i postinstallation 0 1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:1736
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\metroapps.exe
          metroapps.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          PID:4696
  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:3104
  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5536
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
      7 0 0
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      PID:5436
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3480
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 9
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:2556
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
      bin\dcstatusutil.exe RequestAgentSlotFromServer
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      PID:6084
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      PID:2496
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1244
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      PID:2412
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
      3 0 0
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:5948
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
        bin\dcinventory.exe -p processor compatibility
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        PID:4140
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1868
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1252
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2952
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2160
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3524
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4568
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4532
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe" -m 1 -c Refresh
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:3040
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n d57c4dc4-daa3-496d-85ce-28fc06cd5c6e -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" -c dcm-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json" -a 2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2656
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" bin\dccomponentregister.dll
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5984
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
            dcagenttrayicon.exe -r
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            PID:5364
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
            dcagenttrayicon.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:1972
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip"
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            PID:4380
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
            dcagenttrayicon.exe -r
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            PID:4372
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
            dcagenttrayicon.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:6132
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n a8171afd-f23a-419b-9bb8-146a20bb61fd -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" -c blm -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json" -a 2
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2204
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" bin\dccomponentregister.dll
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5568
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip"
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            PID:5000
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      PID:1372
  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Checks SCSI registry key(s)
    • Suspicious use of WriteProcessMemory
    PID:3348
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driversetup64.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driversetup64.exe" -install "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driver\x64\Win10\DCFAFilter.inf"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:3956
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driversetup64.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driversetup64.exe" -start
      2⤵
      • Executes dropped EXE
      PID:4288
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesFaUser.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\uesFaUser.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Checks SCSI registry key(s)
      PID:4652
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesDevCtrlSummary.exe
      -s ET_ENUM 9 2 "Unknown"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1452
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\devctrlaction64.exe
        -c 9
        3⤵
        • Executes dropped EXE
        PID:4440
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Windows\TEMP\{f5070d38-e61f-f84b-b2c0-629fc63543e4}\DCFAFilter.inf" "9" "4ca28cc43" "0000000000000168" "Service-0x0-3e7$\Default" "0000000000000178" "208" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win10"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:2500
  • C:\Windows\system32\DRIVERS\DCFAFilter.sys
    system32\DRIVERS\DCFAFilter.sys
    1⤵
    • Executes dropped EXE
    PID:5864

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e5901bf.rbs
        • Path C:\Config.Msi\e5901bf.rbs
        • Size 58KB
        • SHA256 06743a55ea307fad6ebb0eb44d2705a0e02267796053d393917935a2555f04ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e5901c4.rbs
        • Path C:\Config.Msi\e5901c4.rbs
        • Size 546B
        • SHA256 7bbaccbfaeaf7c74bb793c26e49f7a76d40e81e565bf59d6bbd82a59c18454ee
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        client.p12
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
        • Size 1002B
        • SHA256 efb5a153c1ae6bd776bba3473410b935b981c13219039b6c13bcc2c5454f2753
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        7za.exe
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        • Size 802KB
        • SHA256 f00836a63be7ebf14e1b8c40100c59777fe3432506b330927ea1f1b7fd47ee44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ClientAuthHandler.dll
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
        • Size 2.3MB
        • SHA256 7627f75435af64ab72991eb93996df3f61101e7b57cdf5a9d8d2e06d75b76aad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lato-Bold.eot
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
        • Size 250KB
        • SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lato-Medium.eot
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Medium.eot
        • Size 245KB
        • SHA256 1727853b9469a665c3a5573e39503bc592a794d810aed5d03e9a8940f507823c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        agent_binaries.7z
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
        • Size 14.6MB
        • SHA256 6d5bf676a5800214126df113bbf68a8b3f6ea051ccfbf212c11927df89035082
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ca-certs.zip
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ca-certs.zip
        • Size 160B
        • SHA256 7e6debd55c669504ffd364e96b1e539c5d6839472887ecd739ba79b155c62fa1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        cfgUpdate.exe
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cfgUpdate.exe
        • Size 62KB
        • SHA256 7232bb0e4842bf2f8a370dce70df60c72560416a5bb317650cf88afbd7acb820
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cold_normal_msghldr.gif
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cold_normal_msghldr.gif
        • Size 536B
        • SHA256 fc7d90a7546fb0f8c8ad6e617f74d185be15f85aaf5d329919bc2776887bc9d1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dcagentregister.exe
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
        • Size 92KB
        • SHA256 430aad28ddd50d0026f7e547764b2f4cd7c54204519e119614895068397904dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dcagentservice.exe
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
        • Size 1.2MB
        • SHA256 23fa8f503da68dd5724b136f9f401ab747db352e5edd8e2c277bf7426f774773
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dcinventory.exe
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
        • Size 2.0MB
        • SHA256 8e35a7064793a56a8d6f1e08050fa588571c8898f5bcea4f78228cf343ce5016
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dcstatusutil.exe
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
        • Size 1.1MB
        • SHA256 b24ad0ae12c05931f11b66f26166c7ec41a7be318893aebe4cc2babe29bdb080
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dcusbsummary.exe
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
        • Size 2.8MB
        • SHA256 4f8c591982de67c9211011e4a4a9560b93eabd6c08f2856d7638cc4c802a3b64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hot_mover_msghldr.gif
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hot_mover_msghldr.gif
        • Size 172B
        • SHA256 c9657b6062e0798cfb5e39be8d8d1546d901ee339dde4915c82b40460a205f9e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        resources.exe
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.exe
        • Size 318KB
        • SHA256 7e311d65ca1a0461cc6bda079efdcbd4f2f0a7967c2f09be02f2b62b97eb4848
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        topmiddle.bmp
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\topmiddle.bmp
        • Size 1016B
        • SHA256 bb6b032f562a0578070b18e1002c22bec4520cf191f11384af316a0ae33b8cea
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ui-icons_444444_256x240.png
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png
        • Size 6KB
        • SHA256 eaf7c7ee2747275dda6c53e731a10db1a7b15f4fbb46e1b69d6bb2056bc9fd81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-icons_555555_256x240.png
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_555555_256x240.png
        • Size 6KB
        • SHA256 5d04051dfd9d2d740355404f98a683d1ec0feb2fca7d76e533c1a6e5ce92dd2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-icons_777620_256x240.png
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777620_256x240.png
        • Size 4KB
        • SHA256 9dbe4a0d03feed6f65eb2560a0a8b4ba4264545ee8fd31c1763a3b219d0328d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-icons_777777_256x240.png
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png
        • Size 6KB
        • SHA256 e75b27211e16fcf94715168001bb7055ca376d46f928110ba3d0825232452e5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-icons_cc0000_256x240.png
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_cc0000_256x240.png
        • Size 4KB
        • SHA256 02891575d4358e9edde3e42d94057f8e9f82a9d64376f71ee86cef149d30537e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-icons_ffffff_256x240.png
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_ffffff_256x240.png
        • Size 6KB
        • SHA256 b6b06deef2b924cc3835d63f4883d47882734a33e71b212d917a68cede3b8e9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentApplicationResources.properties
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties
        • Size 98KB
        • SHA256 fb1321f35dacb680e3cefb846f65f657b7141ecaaac61ecea2a009f6a0434426
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSDetection.json
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
        • Size 15KB
        • SHA256 d4a4d290a60e27dde19bb6b6183da79ebb8a254bd25ffa41f8c5d3d67f8c2702
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSDetection.json
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
        • Size 28KB
        • SHA256 208ed152aa8e05d49fe2edae354a7f7b4425d883a8e25cba2fd1e0700ead87ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSDetection.json.gz4600.tmp
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz4600.tmp
        • Size 2KB
        • SHA256 74081722259e69e667e2a185d19395d4a0864a48bb43644cda6ae21997da1886
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        agent-settings.xml
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml
        • Size 3KB
        • SHA256 a7fd3ac6570fda2ee1a9cc3d1f6a36e8a723fdd77508cdcbb506f5068c38ba9f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        configuration-settings-dc-win10.xml
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
        • Size 242KB
        • SHA256 1a388c11ac7b14c44ecb605da1f6111274beb11d947442311c5ef1a88d6e4b68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        customer-meta-data.json3800.tmp
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json3800.tmp
        • Size 1KB
        • SHA256 e79d5e4999503c428de3565762f0528a798229c121ca10d47e9e26a3a4bd5113
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        data-dictionary-framework.xml
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
        • Size 415KB
        • SHA256 9e2dcf836433b648d592cf5ea82af6d44cc6f0cb8625436dc164dda3601df2a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        data-dictionary-onpremise.xml
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
        • Size 109KB
        • SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        data-dictionary.xml
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
        • Size 1.6MB
        • SHA256 0c6236f2f6794c79fb2795bea6eb04775d94ea8079ce9d92502236bfb448a706
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dynamic-variables.xml
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\dynamic-variables.xml
        • Size 28KB
        • SHA256 6df9a28cfd8d76f1e41e6f9fcdf28eb8fa3b5a5d67015ba51fdf1c76980bde1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vmware-names.conf4372.tmp
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf4372.tmp
        • Size 55B
        • SHA256 2001c465639c8b53419ae3ef4069ba573577ed26f592c988463e5db44336d7f8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dcagent.dll
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
        • Size 3.1MB
        • SHA256 15ad7ce2ebfda80a19bde288e71b7c63c1b3cd71416b7ee2df6504610de44883
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dcconfig.exe
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
        • Size 7.0MB
        • SHA256 27800f916566d2a564e48eb543d1c511c72b344765ff4f9bdafb113d13669f01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lato.woff
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
        • Size 36KB
        • SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        drop_down_icon.png
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
        • Size 449B
        • SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        info.png
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
        • Size 2KB
        • SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dcagentinstaller.log
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
        • Size 95KB
        • SHA256 01cb5ed89b8959aa20314b1b4fa1df45e501e39a9e43dbdade07b487c4e12b57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dcagentservice.log
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentservice.log
        • Size 4KB
        • SHA256 dd61dbf5c0e27c3f368407d2c01abf6cb55ee2ba3e7844e879aaff973a98e47c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dccomponentregister.log
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dccomponentregister.log
        • Size 29KB
        • SHA256 6d46d254a77a988ee26948ba1a533ae54818d969feccd08ee1f76aae97de9c0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dcdatatransferdown.log
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
        • Size 4KB
        • SHA256 c15b5bce470f940d4fb9150051b6aa0856cb01b520a28d9e4079617d30a9dc16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dcdatatransferup.log
        • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferup.log
        • Size 453B
        • SHA256 87377cce04b41efa2b7e4294c60bde783d4115485709e99966a7e039567cbed5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dc2692.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\dc2692.tmp
        • Size 8KB
        • SHA256 c6762244e877a2961d339c643ca6d59c5b1e54f0844506d40d4ab603ca5e57aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI601.tmp
        • Path C:\Windows\Installer\MSI601.tmp
        • Size 81KB
        • SHA256 17805948e9d5f51fca01c13bb7dedb1f1a1e17bcf5cc0cb6c01d9f773b712744
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e5901bb.msi
        • Path C:\Windows\Installer\e5901bb.msi
        • Size 31.8MB
        • SHA256 92f68fc7f6d0f544a750bf67b4903d1a4062d1372b7f98ab5c2f698eb61359bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dcagenthttp.dll
        • Path C:\Windows\SysWOW64\dcagenthttp.dll
        • Size 3.6MB
        • SHA256 3de8d74127b797813742dd9fd618c38572b269f8dbb14af4d6014a1addec4e38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dclibxml2.dll
        • Path C:\Windows\SysWOW64\dclibxml2.dll
        • Size 2.1MB
        • SHA256 a451dd3babd79318b612072cb417fd4848be821a1607dc58ac31676e9312fd7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download