9943e14d97490f406d0e40ec0c71e698227b0a566160aeb7e19326aae7473ad0

Analysis

max time kernel
96s
max time network
279s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Purchase_Order_Details_and_Quotation_Sheet.vbs
Size 18KB
Sample260804-vg8rmsdh66
SHA256 9943e14d97490f406d0e40ec0c71e698227b0a566160aeb7e19326aae7473ad0
MD5 e13ed1ef7d5df4274a3abf022dc0905b
SHA1 34502c0894cff3b25df14ff6e2cd7e16ad489f43
SHA512 caf7251b7020994084595b29f1631bba18a9be56df5f3942dcb3055257778c6f0e442aeee1f9563f3a6083e2c8b5f71219ae8a9e0fd4b018ec2cce8c45ce1965
SSDEEP 384:+IhkJoQw/w4TY7hrjGxlfLhKCah7bP5BhchbDh84rJihMpl9hFKFM/DQ7ThcoBx1:xkktyGr9KH7tjCB1SM7UdFcOzIjq
TLSH
T12382CE3DC976FDC403AF31C046A63F4610895613ABB55B68FAC20CFA5870A99EF3959C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence ransomware spyware trojan

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	3752	wscript.exe

Executes dropped EXE 42 IoCs

pid	Process
1192	dcagentregister.exe
4876	UEMSAgentHealthChecker.exe
5788	UEMSAgentHCHelper.exe
876	UEMSAgentHCHelper.exe
1416	UEMSAgentHCHelper.exe
3392	7za.exe
2440	dcagentservice.exe
4748	7za.exe
5780	dcpatchscan.exe
3264	dcstatusutil.exe
2648	dcinventory.exe
4392	dcagentservice.exe
6020	CRU_Reporter.exe
3552	dcusbsummary.exe
2572	dcconfig.exe
2440	dcusb64.exe
6092	dcstatusutil.exe
2100	dcondemand.exe
5096	dcswmeter.exe
2856	dcinventory.exe
4332	dcmetroapps.exe
5904	7za.exe
6024	dcconfig.exe
3956	7za.exe
788	7za.exe
1480	7za.exe
2944	7za.exe
3060	7za.exe
4164	dcinventory.exe
5804	7za.exe
5048	7za.exe
1112	7za.exe
700	7za.exe
3064	DCProcessMonitor.exe
604	7za.exe
3656	dcuploadlogs.exe
4852	7za.exe
5652	7za.exe
3676	7za.exe
5052	7za.exe
904	7za.exe
5884	7za.exe

Loads dropped DLL 64 IoCs

pid	Process
6004	MsiExec.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
2440	dcagentservice.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
5780	dcpatchscan.exe
5780	dcpatchscan.exe
5780	dcpatchscan.exe
5780	dcpatchscan.exe
5780	dcpatchscan.exe
5780	dcpatchscan.exe
5780	dcpatchscan.exe
5780	dcpatchscan.exe
5780	dcpatchscan.exe
1192	dcagentregister.exe
5780	dcpatchscan.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
5780	dcpatchscan.exe
5780	dcpatchscan.exe
5780	dcpatchscan.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
5780	dcpatchscan.exe
1192	dcagentregister.exe
5780	dcpatchscan.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
5780	dcpatchscan.exe
3264	dcstatusutil.exe
3264	dcstatusutil.exe
3264	dcstatusutil.exe
3264	dcstatusutil.exe
3264	dcstatusutil.exe
3264	dcstatusutil.exe

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4608	icacls.exe
3472	icacls.exe
3316	icacls.exe
5056	icacls.exe
4924	icacls.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3500	powercfg.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_7a788f788529d024\usbport.PNF	dcinventory.exe
File created	C:\Windows\SysWOW64\dclibxml2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dcagentlibxml2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\logs\devicepatchaccess.log	dcagentregister.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_a1fe82a86eaecabd\keyboard.PNF	dcinventory.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_6f9a6940085bc1e9\input.PNF	dcinventory.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_097bbd709f0c4972\msmouse.PNF	dcinventory.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
2424	WScript.exe
3752	wscript.exe
4732	cscript.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\drvforceupdate.exe.gz2460.tmp	dcpatchscan.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\WakeOnLan.exe.config	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\checkvolume.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\secaddoncrashanalyser.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcMetroAppslogger.log	dcmetroapps.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcerror.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-1738198120-2966725515-3980530802-1000\Win32_Printer_temp.json	dcinventory.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-mc.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CompVulnDetection.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAService.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHcComHelper.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSLogCollector.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\downloadSuccessAccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\computer.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ImageFactoraccess.log	dcagentregister.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dpinst86.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcswmetercollector.log	dcswmeter.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log	dcagentregister.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_cc0000_256x240.png	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentQPPMupgrade.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\usbconfig_computer.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentupgrade.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dc_icon.ico	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\otp-lock.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\icon_alert.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Find.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\rapchat.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\selfserviceportal.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\usbeDevicelist.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devicescanlogger.log	dcinventory.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\Bit-locker.bat	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dctoolshardware.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuninstallsw.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ToolsIQ.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log	dcusbsummary.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\usbconfig_agentservice.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentaccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcswmeteraccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_button.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dccomponentregister.dll	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProxyFinder.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentserviceaccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\ud-supported-patch-details.json	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\User.svg	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAUser.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcSoftwareInstallAccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\hardware.json	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\hot_mover.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Updates.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz2608.tmp	dcagentregister.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcfilescan.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdservice.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_devsummaryAcccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-dependency-details.xml	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler64.dll	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcaddonsevaluator.dll	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentserviceaccess.log	dcagentservice.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcmisconfigaccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcconfig_vmdrUtils.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\usbconfig_user.log	dcusb64.exe

Drops file in Windows directory 29 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\DCAgentUpdater.job	dcagentregister.exe
File opened for modification	C:\Windows\Installer\MSIE43E.tmp	msiexec.exe
File created	C:\Windows\INF\c_display.PNF	dcinventory.exe
File opened for modification	C:\Windows\Installer\MSI54BD.tmp	msiexec.exe
File opened for modification	C:\Windows\Tasks\DCAgentUpdater.job	dcagentregister.exe
File created	C:\Windows\Tasks\UEMSLogCollector.job	dcagentregister.exe
File created	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1590A7E39C1EB385.TMP	msiexec.exe
File created	C:\Windows\INF\c_processor.PNF	dcinventory.exe
File created	C:\Windows\SystemTemp\~DF07FB9393F525263E.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}	msiexec.exe
File created	C:\Windows\INF\c_volume.PNF	dcinventory.exe
File created	C:\Windows\INF\c_media.PNF	dcinventory.exe
File created	C:\Windows\INF\c_monitor.PNF	dcinventory.exe
File opened for modification	C:\Windows\Installer\e594f8e.mst	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C31.tmp	msiexec.exe
File opened for modification	C:\Windows\Tasks\UEMSLogCollector.job	dcagentregister.exe
File opened for modification	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst	msiexec.exe
File created	C:\Windows\INF\c_diskdrive.PNF	dcinventory.exe
File created	C:\Windows\Installer\e594f8e.mst	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE01B00194A84C4DC.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json	dcagentregister.exe
File created	C:\Windows\Installer\e594f8d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e594f8d.msi	msiexec.exe
File created	C:\Windows\Installer\e594f96.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF031D36E42060B291.TMP	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3500	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 22 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3088	cmd.exe
4924	cmd.exe
3572	cmd.exe
3828	cmd.exe
1064	cmd.exe
2772	cmd.exe
4296	cmd.exe
5768	cmd.exe
2836	cmd.exe
5980	cmd.exe
3256	cmd.exe
1484	cmd.exe
3364	cmd.exe
1348	cmd.exe
6016	cmd.exe
3048	cmd.exe
2036	cmd.exe
3200	cmd.exe
6008	cmd.exe
688	cmd.exe
5152	cmd.exe
1044	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 18 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7\Blob = 190000000100000010000000abab88db3467ca42cc505b3ec615b8010f0000000100000020000000eb70eeb87155b9bae67525ed29cc95b7bf8ce89f084133d2fe51c9041afcf31d0300000001000000140000008096da182333fed188e09ea3a0dac2dcda93f0a7140000000100000014000000e1f1a443d422bcbc3b86859506b8fa1ef434f77c2000000001000000f0030000308203ec308202d4a0030201020208172469ebda8330b6300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303732383133333933385a180f32303531303732383133333933385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b7ffa62b17f44e461b00ff58d72826c8e78ab62b3e9581d8bef2e5a5f3c6a3e2f997cd00d9180d17189f68a8b151acbd6ab022ab6864f3c4d9a72eca4c7d599990166c7eff5b093d125b8557a5f11fae187d7a9795f433e95ef6ae9ea7e40c41fc01ef94aa5a3202a0f123e43752c837b0df88351522c59a6efb2d3ea6a778bb612bc29b4c4f17d66091ebf8d5a8dd1925f1007464e1c72f5bf5aebc75cbd87007a7b0ad62d2aa7bc6e5d45e73195df8738d6b4c1b576ef8fef97f0366a59e7d4dcf913f4110474e90149cf9e550952e6d373a0c991f5ab8a8b69a3215e721f04bdd91f267581c760d65a4a5e2d7778b27e38d966ab6b96be70aacaba9c86e8b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414e1f1a443d422bcbc3b86859506b8fa1ef434f77c301f0603551d23041830168014e1f1a443d422bcbc3b86859506b8fa1ef434f77c300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100ac57911e9d450349b5e323f5fbd6cbc25107406087f252bb21db0a36814a3946d5b0402c66e8afef09b301fdc69d80458c168dd0bad4919af98b586abf80a89bbf11cc1185f599905d87ba4eba28dc246d0723ad4e7a243c6c4689a3645290fdd581f407b263c64f52219aa27c9ef87ae2d97acac7ea15611ca3a30fa019aa26602f0553a10c4c5f057262510d12e58148f0136935207fb295b4e038f0a1693318e45fe4b37de9352f2b695e660e71b9bfff5c2fc89601a73ace7776509dd0213b5dab32478de0217da63a5526299bb353b9b87f9b2651cbdeb338b078e89b8d9feebc3452d24a7e202ab6c71934b184c8fd98fa0bc18025214d27913bf1f216	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7\Blob = 5900000001000000160000005200530041002f005300480041003200350036000000140000000100000014000000e1f1a443d422bcbc3b86859506b8fa1ef434f77c0300000001000000140000008096da182333fed188e09ea3a0dac2dcda93f0a70f0000000100000020000000eb70eeb87155b9bae67525ed29cc95b7bf8ce89f084133d2fe51c9041afcf31d190000000100000010000000abab88db3467ca42cc505b3ec615b8012000000001000000f0030000308203ec308202d4a0030201020208172469ebda8330b6300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303732383133333933385a180f32303531303732383133333933385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b7ffa62b17f44e461b00ff58d72826c8e78ab62b3e9581d8bef2e5a5f3c6a3e2f997cd00d9180d17189f68a8b151acbd6ab022ab6864f3c4d9a72eca4c7d599990166c7eff5b093d125b8557a5f11fae187d7a9795f433e95ef6ae9ea7e40c41fc01ef94aa5a3202a0f123e43752c837b0df88351522c59a6efb2d3ea6a778bb612bc29b4c4f17d66091ebf8d5a8dd1925f1007464e1c72f5bf5aebc75cbd87007a7b0ad62d2aa7bc6e5d45e73195df8738d6b4c1b576ef8fef97f0366a59e7d4dcf913f4110474e90149cf9e550952e6d373a0c991f5ab8a8b69a3215e721f04bdd91f267581c760d65a4a5e2d7778b27e38d966ab6b96be70aacaba9c86e8b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414e1f1a443d422bcbc3b86859506b8fa1ef434f77c301f0603551d23041830168014e1f1a443d422bcbc3b86859506b8fa1ef434f77c300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100ac57911e9d450349b5e323f5fbd6cbc25107406087f252bb21db0a36814a3946d5b0402c66e8afef09b301fdc69d80458c168dd0bad4919af98b586abf80a89bbf11cc1185f599905d87ba4eba28dc246d0723ad4e7a243c6c4689a3645290fdd581f407b263c64f52219aa27c9ef87ae2d97acac7ea15611ca3a30fa019aa26602f0553a10c4c5f057262510d12e58148f0136935207fb295b4e038f0a1693318e45fe4b37de9352f2b695e660e71b9bfff5c2fc89601a73ace7776509dd0213b5dab32478de0217da63a5526299bb353b9b87f9b2651cbdeb338b078e89b8d9feebc3452d24a7e202ab6c71934b184c8fd98fa0bc18025214d27913bf1f216	dcinventory.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C\Blob = 5900000001000000100000005200530041002f004d00440035000000140000000100000014000000265d0507d82fa26084bd837df52180a7056f5a85030000000100000014000000109f1caed645bb78b3ea2b94c0697c740733031c19000000010000001000000083b65318664e6fa245e0d7609fb958202000000001000000130400003082040f308202f7a003020102020a198b11d13f9a8ffe69a0300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937313030313037303030305a170d3032313233313037303030305a3081c3312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e3141303f060355040b13384d6963726f736f66742057696e646f777320486172647761726520436f6d7061746962696c69747920496e7465726d656469617465204341311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3131302f060355040313284d6963726f736f66742057696e646f777320486172647761726520436f6d7061746962696c69747930819f300d06092a864886f70d010101050003818d0030818902818100e04e100eb8a7ef21ca605adc9f1e3e83775a292ef94ee5085ddee1cf09c01f44b707a84ba422303b190683eef3ac2778aecad6402bce7901e19d568b3672b163905fa0b2c066a649c53cfa26a262c3d3b5cc61154cf23fb4e7450843897f6a8dd566fbd7ff6400c411fd2ca30b75b0fbe5ac2665a381e666493d1d737a9b71d70203010001a381da3081d7300f0603551d130101ff040530030101ff301f0603551d250418301606082b06010505070303060a2b0601040182370a03053081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010016d8587683608be849582c050b644d40ad2d4dc2fc5f7d963cd0afb954522828d5655e8f710eb3080e1509c9d592cc241144242d51dfaf54444b7bd671d4d73a357cd186b405dca7097498b21b166d39a7446aad79eaa2cdff5b2a63d1848422ab98c68762621b539615604731571ee00161ad36efc52d0ab4d01853f3569cb4b7b7050433ad29279351070c9ebe80ff15bc26c741f36ce2c2eaafb4ae5e08bba8c95b509b4a08430ccedcffbb2aa7816f5facbc7528ea363ebc0a94450b5ccdb5e39f238cb507813d5978514639bca7f66d17037fee529a39bc09f2d2baa8d79505eb465254718ee87ecd9a6ee74af3a449f0cac695a5516055bd741ecb2c01	dcinventory.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37\Blob = 140000000100000014000000c389dd4dedf823547314fcf0689457d63161c7a3030000000100000014000000e1397ab0b33aa131ce4114981474d387b1532a370f00000001000000200000009edf3a3e9dd48e21dc1f0c02f6964daa330ba93be23e55a716a6916f16deed812000000001000000d8030000308203d4308202bca00302010202086d358c4d4cd1e55e300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303732383133333933375a180f32303531303732383133333933375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a0e168b5165b877b9f1aa5b4f592349e799bbe5bbaa5526c26aafc7e7a8026968fab75ccbce8fe5361356e35dc7f84b87f5cefa6ccc88cbf994244beaddc1504b988fe2fd2ca4d1473cf2154b9bb3bd18794fd1df9f916ded5ce460cba15fff23baceb1815d3b209e2ac5bd2b4f73d3a6893bcca1a66e20037e05f5c6d828185ec5c89fabd1260ea7f8738797835b77f3e4a6cfcbd9a37410d445859728ad50746fa9eb3f92d29d342d868b93b6e24d54ff62f9696f37023643d470b6e4083f614dee5b2e29aa8396a83140a639a31f3dd653bd2fea47b7fd9ebc56ef57a8f682e82c4e54a40749bd775eaaa01053e1282819cf75981488c6ac4bbd57a6826e90203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c389dd4dedf823547314fcf0689457d63161c7a3301f0603551d23041830168014c389dd4dedf823547314fcf0689457d63161c7a3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010003f9180a72abaa0d631e7d24393461171bcfc5433732f3eec716ffd99cfede73254a3f79019702a347e9c0e29eca2ab9c985aac0611e1f6c3c0149c3ec70e5cb8d382d5fefb5876a783364bd29c16b92abd0780307b339acc208db927a903634c2a31cb70067e90e39d76f09c0df19c1597f35ed25dbf3d7aa1e628d87af46a19318ddb049501f4d30f86f29dbc1c8ff29e702fa06cb78458bae166bcb908224abacba116f4d15e886f12ae710bee3851e03cfd5a886566f0b5b4e2f61a878f9be77a23d89f9fa0c3b2d1fb965782b82fa77666c7c1ffb46f8ffde94a8ab381916183f8ded569619de857e9bc740eae48aa973e4d122212c3e7e8adf4cef33a4	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247\Blob = 5900000001000000100000005200530041002f004d0044003500000014000000010000001400000001f0334c1aa1d9ee5b7ba9de43bc027d570933fb0b00000001000000400000004d006900630072006f0073006f00660074002000410075007400680065006e007400690063006f0064006500280074006d002900200052006f006f0074000000090000000100000016000000301406082b0601050507030406082b060105050703030300000001000000140000007f88cd7223f3c813818c994614a89c99fa3b52470f0000000100000010000000d67576f5521d1ccab52e9215e0f9f74319000000010000001000000007d34ded498d4577f261bd38b6b8736e2000000001000000da030000308203d6308202bea003020102020101300d06092a864886f70d01010405003050310b3009060355040613025553310d300b060355040a13044d53465431323030060355040313294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f72697479301e170d3935303130313038303030315a170d3939313233313233353935395a3050310b3009060355040613025553310d300b060355040a13044d53465431323030060355040313294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100df08bae33f6e649bf589af28964a078f1b2e8b3e1dfcb88069a3a1cedbdfb08e6c8976294fca603539ad7232e00bae293d4c16d94b3c9ddac5d3d109c92c6fa6c2605345dd4bd155cd031cd2595624f3e578d807ccd8b31f903fc01a71501d2da712086d7cb0866cc7ba853207e1616faf03c56de5d6a18f36f6c10bd13e69974872c97fa4c8c24a4c7ea1d194a6d7dceb05462eb818b4571d8649db694a2c21f55e0f542d5a43a97a7e6a8e504d2557a1bf1b1505437b2c058dbd3d038c93227d63ea0a5705060adb6198652d4749a8e7e656755cb8640863a9304066b2f9b6e334e86730e1430b87ffc9be72105e23f09ba74865bf09887bcd72bc2e799b7b0203010001a381ba3081b7300d0603551d0a040630040302078030320603550403042b13294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f7269747930720603551d01046b306980101a1be75b9ffd8c2ac339ae0c622e5332a1523050310b3009060355040613025553310d300b060355040a13044d53465431323030060355040313294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f72697479820101300d06092a864886f70d010104050003820101002dc9e2f6129e5d5667fafa4b9a7edc29565c80140228856e26f3cd58da5080c5f819b3a67ce29d6b5f3b8f2274e61804fc4740d87a3f3066f012a4d1eb1de7b6f498ab5322865158ee230976e41d455c4bff4ce302500113cc41a45297d486d5c4fe8383657deabea2683bc1b12998bfa2a5fc9dd384ee701750f30bfa3cefa9278b91b448c845a0e101424b4476041cc219a28e6b2098c4dd02acb4d2a20e8d5db9368e4a1b5d6c1ae2cb007f10f4b295efe3e8ffa17358a9752ca2499585feccda448ac21244d244c8a5a21fa95a8e56c2c37bcf4260dc821ffbce74067ed6f1ac196a4f745cc51566316cc16271910f595b7d2a821adfb1b4d81d37de0d0f	dcinventory.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25\Blob = 5900000001000000100000005200530041002f004d004400350000001400000001000000140000003edf290cc1f5cc732ceb3d24e17e52dabd27e2f00b000000010000003400000056006500720069005300690067006e002000540069006d00650020005300740061006d00700069006e006700200043004100000009000000010000000c000000300a06082b0601050507030803000000010000001400000018f7c1fcc3090203fd5baa2f861a754976c8dd250f000000010000001000000065fc47520f66383962ec0b7b88a0821d190000000100000010000000e53d34cecb05c17ee332c749d78c02562000000001000000c0020000308202bc3082022502104a19d2388c82591ca55d735f155ddca3300d06092a864886f70d010104050030819e311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e312c302a060355040b1323566572695369676e2054696d65205374616d70696e67205365727669636520526f6f7431343032060355040b132b4e4f204c494142494c4954592041434345505445442c20286329393720566572695369676e2c20496e632e301e170d3937303531323030303030305a170d3034303130373233353935395a30819e311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e312c302a060355040b1323566572695369676e2054696d65205374616d70696e67205365727669636520526f6f7431343032060355040b132b4e4f204c494142494c4954592041434345505445442c20286329393720566572695369676e2c20496e632e30819f300d06092a864886f70d010101050003818d0030818902818100d32e20f0687c2c2d2e811cb106b2a70bb7110d57da53d875e3c9332ab2d4f6095b34f3e990fe090cd0db1b5ab9cde7f688b19dc08725eb7d5810736a78cb7115fdc658f629ab585e9604fd2d621158811cca7194d522582fd5cc14058436ba94aab44d4ae9ee3b22ad56997e219c6c86c04a47976ab4a636d5fc092dd3b4399b0203010001300d06092a864886f70d01010405000381810061550e3e7bc792127e11108e22ccd4b3132b5be844e40b789ea47ef3a707721ee259efcc84e389944cdb4e61efb3a4fb463d50340b9f7056f68e2a7f17cee563bf796907732eb095288af5edaaa9d25dcd0aca10098fceb3af2896c479298492dcffba674248a69010e4bf61f89c53e593d1733ff8fd9d4f84ac55d1fd116363	dcinventory.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8\Blob = 5900000001000000120000005200530041002f0053004800410031000000030000000100000014000000d559a586669b08f46a30a133f8a9ed3d038e2ea818000000010000001000000091161b894b117ecdc257628db460cc041900000001000000100000006ed6ed7df52fc19bdc9e5fe9e2be21fb1400000001000000140000000acfeb4b07e703a01f4cef28ee7256f7517591550f00000001000000140000004973e092cf8a9e2ca5f988493a5bacfe3895942e040000000100000010000000acd80ea27bb72ce700dc22724a5f1e9220000000010000008703000030820383308202eca003020102021046fcebbab4d02f0f926098233f93078f300d06092a864886f70d0101050500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3937303431373030303030305a170d3136313032343233353935395a3081ba311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e31333031060355040b132a566572695369676e20496e7465726e6174696f6e616c20536572766572204341202d20436c617373203331493047060355040b13407777772e766572697369676e2e636f6d2f43505320496e636f72702e6279205265662e204c494142494c495459204c54442e286329393720566572695369676e30819f300d06092a864886f70d010101050003818d0030818902818100d88280e8d619027d1f85183925a2652be1bfd405d3bce6363baaf04c6c5bb6e7aa3c734555b2f1bdea9742ed9a340a15d4a95cf54025ddd907c132b2756cc4cabba3fe56277143aa63f5303e9328e5faf1093bf3b74d4e39f75c495ab8c11dd3b28afe70309542cbfe2b518b5a3c3af9224f90b202a7539c4f34e7ab04b27b6f0203010001a381e33081e0300f0603551d13040830060101ff02010030440603551d20043d303b3039060b6086480186f84501070101302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f43505330340603551d25042d302b06082b0601050507030106082b0601050507030206096086480186f8420401060a6086480186f845010801300b0603551d0f040403020106301106096086480186f842010104040302010630310603551d1f042a30283026a024a0228620687474703a2f2f63726c2e766572697369676e2e636f6d2f706361332e63726c300d06092a864886f70d010105050003818100408e4997968a73dd8e4def3e61b7caa062adf40e0abb753de26ed82cc7bff4b98c369bcaa2d09c724639f6a682036511c4bcbf2da6f5d93b0ab598fab378b91ef22b4c62d5fdb27a1ddf33fd73f9a5d82d8c2aead1fcb028b6e94948134b838a1b487b24f738de6f4154b8ab576b06dfc7a2d4a9f6f136628088f28b75d68071	dcinventory.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7\Blob = 0f0000000100000020000000eb70eeb87155b9bae67525ed29cc95b7bf8ce89f084133d2fe51c9041afcf31d0300000001000000140000008096da182333fed188e09ea3a0dac2dcda93f0a72000000001000000f0030000308203ec308202d4a0030201020208172469ebda8330b6300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303732383133333933385a180f32303531303732383133333933385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b7ffa62b17f44e461b00ff58d72826c8e78ab62b3e9581d8bef2e5a5f3c6a3e2f997cd00d9180d17189f68a8b151acbd6ab022ab6864f3c4d9a72eca4c7d599990166c7eff5b093d125b8557a5f11fae187d7a9795f433e95ef6ae9ea7e40c41fc01ef94aa5a3202a0f123e43752c837b0df88351522c59a6efb2d3ea6a778bb612bc29b4c4f17d66091ebf8d5a8dd1925f1007464e1c72f5bf5aebc75cbd87007a7b0ad62d2aa7bc6e5d45e73195df8738d6b4c1b576ef8fef97f0366a59e7d4dcf913f4110474e90149cf9e550952e6d373a0c991f5ab8a8b69a3215e721f04bdd91f267581c760d65a4a5e2d7778b27e38d966ab6b96be70aacaba9c86e8b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414e1f1a443d422bcbc3b86859506b8fa1ef434f77c301f0603551d23041830168014e1f1a443d422bcbc3b86859506b8fa1ef434f77c300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100ac57911e9d450349b5e323f5fbd6cbc25107406087f252bb21db0a36814a3946d5b0402c66e8afef09b301fdc69d80458c168dd0bad4919af98b586abf80a89bbf11cc1185f599905d87ba4eba28dc246d0723ad4e7a243c6c4689a3645290fdd581f407b263c64f52219aa27c9ef87ae2d97acac7ea15611ca3a30fa019aa26602f0553a10c4c5f057262510d12e58148f0136935207fb295b4e038f0a1693318e45fe4b37de9352f2b695e660e71b9bfff5c2fc89601a73ace7776509dd0213b5dab32478de0217da63a5526299bb353b9b87f9b2651cbdeb338b078e89b8d9feebc3452d24a7e202ab6c71934b184c8fd98fa0bc18025214d27913bf1f216	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37\Blob = 1900000001000000100000004d04dc5b02db0b7a193cd4936d8ccd6b0f00000001000000200000009edf3a3e9dd48e21dc1f0c02f6964daa330ba93be23e55a716a6916f16deed81030000000100000014000000e1397ab0b33aa131ce4114981474d387b1532a37140000000100000014000000c389dd4dedf823547314fcf0689457d63161c7a32000000001000000d8030000308203d4308202bca00302010202086d358c4d4cd1e55e300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303732383133333933375a180f32303531303732383133333933375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a0e168b5165b877b9f1aa5b4f592349e799bbe5bbaa5526c26aafc7e7a8026968fab75ccbce8fe5361356e35dc7f84b87f5cefa6ccc88cbf994244beaddc1504b988fe2fd2ca4d1473cf2154b9bb3bd18794fd1df9f916ded5ce460cba15fff23baceb1815d3b209e2ac5bd2b4f73d3a6893bcca1a66e20037e05f5c6d828185ec5c89fabd1260ea7f8738797835b77f3e4a6cfcbd9a37410d445859728ad50746fa9eb3f92d29d342d868b93b6e24d54ff62f9696f37023643d470b6e4083f614dee5b2e29aa8396a83140a639a31f3dd653bd2fea47b7fd9ebc56ef57a8f682e82c4e54a40749bd775eaaa01053e1282819cf75981488c6ac4bbd57a6826e90203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c389dd4dedf823547314fcf0689457d63161c7a3301f0603551d23041830168014c389dd4dedf823547314fcf0689457d63161c7a3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010003f9180a72abaa0d631e7d24393461171bcfc5433732f3eec716ffd99cfede73254a3f79019702a347e9c0e29eca2ab9c985aac0611e1f6c3c0149c3ec70e5cb8d382d5fefb5876a783364bd29c16b92abd0780307b339acc208db927a903634c2a31cb70067e90e39d76f09c0df19c1597f35ed25dbf3d7aa1e628d87af46a19318ddb049501f4d30f86f29dbc1c8ff29e702fa06cb78458bae166bcb908224abacba116f4d15e886f12ae710bee3851e03cfd5a886566f0b5b4e2f61a878f9be77a23d89f9fa0c3b2d1fb965782b82fa77666c7c1ffb46f8ffde94a8ab381916183f8ded569619de857e9bc740eae48aa973e4d122212c3e7e8adf4cef33a4	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37\Blob = 5900000001000000160000005200530041002f0053004800410032003500360000006b000000010000002000000080fe6bf607a9da3e711406394cb12c8fe21caf7e56a9a1e4cec08faca9c09203140000000100000014000000c389dd4dedf823547314fcf0689457d63161c7a3030000000100000014000000e1397ab0b33aa131ce4114981474d387b1532a370f00000001000000200000009edf3a3e9dd48e21dc1f0c02f6964daa330ba93be23e55a716a6916f16deed811900000001000000100000004d04dc5b02db0b7a193cd4936d8ccd6b5c0000000100000004000000000800002000000001000000d8030000308203d4308202bca00302010202086d358c4d4cd1e55e300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303732383133333933375a180f32303531303732383133333933375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a0e168b5165b877b9f1aa5b4f592349e799bbe5bbaa5526c26aafc7e7a8026968fab75ccbce8fe5361356e35dc7f84b87f5cefa6ccc88cbf994244beaddc1504b988fe2fd2ca4d1473cf2154b9bb3bd18794fd1df9f916ded5ce460cba15fff23baceb1815d3b209e2ac5bd2b4f73d3a6893bcca1a66e20037e05f5c6d828185ec5c89fabd1260ea7f8738797835b77f3e4a6cfcbd9a37410d445859728ad50746fa9eb3f92d29d342d868b93b6e24d54ff62f9696f37023643d470b6e4083f614dee5b2e29aa8396a83140a639a31f3dd653bd2fea47b7fd9ebc56ef57a8f682e82c4e54a40749bd775eaaa01053e1282819cf75981488c6ac4bbd57a6826e90203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c389dd4dedf823547314fcf0689457d63161c7a3301f0603551d23041830168014c389dd4dedf823547314fcf0689457d63161c7a3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010003f9180a72abaa0d631e7d24393461171bcfc5433732f3eec716ffd99cfede73254a3f79019702a347e9c0e29eca2ab9c985aac0611e1f6c3c0149c3ec70e5cb8d382d5fefb5876a783364bd29c16b92abd0780307b339acc208db927a903634c2a31cb70067e90e39d76f09c0df19c1597f35ed25dbf3d7aa1e628d87af46a19318ddb049501f4d30f86f29dbc1c8ff29e702fa06cb78458bae166bcb908224abacba116f4d15e886f12ae710bee3851e03cfd5a886566f0b5b4e2f61a878f9be77a23d89f9fa0c3b2d1fb965782b82fa77666c7c1ffb46f8ffde94a8ab381916183f8ded569619de857e9bc740eae48aa973e4d122212c3e7e8adf4cef33a4	dcinventory.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85\Blob = 5900000001000000100000005200530041002f004d00440035000000140000000100000014000000344f302d25693191eaf7735cabf5868d378240ec030000000100000014000000245c97df7514e7cf2df8be72ae957b9e04741e8509000000010000000c000000300a06082b060105050703080b00000001000000320000004d006900630072006f0073006f00660074002000540069006d0065007300740061006d007000200052006f006f00740000000f00000001000000100000009df0d13100123aeca770130f4ad8d2091900000001000000100000007fdff50729446710244a447ca2a197ea2000000001000000b1020000308202ad30820216020101300d06092a864886f70d010104050030819e3120301e060355040a13174d6963726f736f6674205472757374204e6574776f726b311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e312d302b060355040b13244d6963726f736f66742054696d65205374616d70696e67205365727669636520526f6f74312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e301e170d3937303531333136313235395a170d3939313233303233353935395a30819e3120301e060355040a13174d6963726f736f6674205472757374204e6574776f726b311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e312d302b060355040b13244d6963726f736f66742054696d65205374616d70696e67205365727669636520526f6f74312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e30819f300d06092a864886f70d010101050003818d0030818902818100b75a38f51f37cca943c4dc2418bef28552b41d5b5f18b90b8f4b6da8ffcd40506cd3a0d35c47c2b9f786e4cd7d350569371faf3ddd1ffd8f1534c2c479cc59748a6f8c0ec3e811eb8438479853e1f10c0de4010cf01b1e20da2a7a3dc215528e8aff7b32bf581e25988326cb8ac9c4071424bc499ed77ab3871a2533bc6d08470203010001300d06092a864886f70d010104050003818100505bc56b6f8d525b0dc9bdac347398ca0a87caae4c4aba14a4eb52709521e0b5a1604ef743025101af1e3a70cebf18b686289967eb08e897405c1682fdb825fb366f6f763ec54c8ee2a751facac163ba5e8324470b9372f6449acea7953a8f50109e1db15916abcf3edf838bc7fac36bdc649f402b1f452404ae492ff6df0c91	dcinventory.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\Blob = 5900000001000000100000005200530041002f004d004400350000001400000001000000140000009aa6587f94dd91d91e63dfd3f0ce5fae1893aab7030000000100000014000000fee449ee0e3965a5246f000e87fde2a065fd89d4190000000100000010000000edbccdd5106a071c5d8b4690918e48aa2000000001000000ce010000308201ca30820174a003020102021006376c00aa00648a11cfb8d4aa5c35f4300d06092a864886f70d01010405003016311430120603550403130b526f6f74204167656e6379301e170d3936303532383232303235395a170d3339313233313233353935395a3016311430120603550403130b526f6f74204167656e6379305b300d06092a864886f70d0101010500034a0030470240815522b98aa46fedd6e7d9660f55bcd7cdd5bc4e400221a2b1f78730855ed2f244b9dc9b75b6fb465f42b69d23360bde540fcdbd1f992a105811cb40cbb5a7410203010001a3819e30819b3050060355040304491347466f722054657374696e6720507572706f736573204f6e6c792053616d706c6520536f667477617265205075626c697368696e672043726564656e7469616c73204167656e637930470603551d010440303e801012e4092d061d1d4f008d6121dc166463a1183016311430120603550403130b526f6f74204167656e6379821006376c00aa00648a11cfb8d4aa5c35f4300d06092a864886f70d01010405000341002d2e3e7b8942893fa82117faf0f5c395db62695bc9dcc1b3faf0c46f6f649abde71b2568728367bd56b08d01bd2af7cc4bbd87a5ba87204c421141ad10173b8c	dcinventory.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37\Blob = 030000000100000014000000e1397ab0b33aa131ce4114981474d387b1532a372000000001000000d8030000308203d4308202bca00302010202086d358c4d4cd1e55e300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303732383133333933375a180f32303531303732383133333933375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a0e168b5165b877b9f1aa5b4f592349e799bbe5bbaa5526c26aafc7e7a8026968fab75ccbce8fe5361356e35dc7f84b87f5cefa6ccc88cbf994244beaddc1504b988fe2fd2ca4d1473cf2154b9bb3bd18794fd1df9f916ded5ce460cba15fff23baceb1815d3b209e2ac5bd2b4f73d3a6893bcca1a66e20037e05f5c6d828185ec5c89fabd1260ea7f8738797835b77f3e4a6cfcbd9a37410d445859728ad50746fa9eb3f92d29d342d868b93b6e24d54ff62f9696f37023643d470b6e4083f614dee5b2e29aa8396a83140a639a31f3dd653bd2fea47b7fd9ebc56ef57a8f682e82c4e54a40749bd775eaaa01053e1282819cf75981488c6ac4bbd57a6826e90203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c389dd4dedf823547314fcf0689457d63161c7a3301f0603551d23041830168014c389dd4dedf823547314fcf0689457d63161c7a3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010003f9180a72abaa0d631e7d24393461171bcfc5433732f3eec716ffd99cfede73254a3f79019702a347e9c0e29eca2ab9c985aac0611e1f6c3c0149c3ec70e5cb8d382d5fefb5876a783364bd29c16b92abd0780307b339acc208db927a903634c2a31cb70067e90e39d76f09c0df19c1597f35ed25dbf3d7aa1e628d87af46a19318ddb049501f4d30f86f29dbc1c8ff29e702fa06cb78458bae166bcb908224abacba116f4d15e886f12ae710bee3851e03cfd5a886566f0b5b4e2f61a878f9be77a23d89f9fa0c3b2d1fb965782b82fa77666c7c1ffb46f8ffde94a8ab381916183f8ded569619de857e9bc740eae48aa973e4d122212c3e7e8adf4cef33a4	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7\Blob = 0300000001000000140000008096da182333fed188e09ea3a0dac2dcda93f0a72000000001000000f0030000308203ec308202d4a0030201020208172469ebda8330b6300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303732383133333933385a180f32303531303732383133333933385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b7ffa62b17f44e461b00ff58d72826c8e78ab62b3e9581d8bef2e5a5f3c6a3e2f997cd00d9180d17189f68a8b151acbd6ab022ab6864f3c4d9a72eca4c7d599990166c7eff5b093d125b8557a5f11fae187d7a9795f433e95ef6ae9ea7e40c41fc01ef94aa5a3202a0f123e43752c837b0df88351522c59a6efb2d3ea6a778bb612bc29b4c4f17d66091ebf8d5a8dd1925f1007464e1c72f5bf5aebc75cbd87007a7b0ad62d2aa7bc6e5d45e73195df8738d6b4c1b576ef8fef97f0366a59e7d4dcf913f4110474e90149cf9e550952e6d373a0c991f5ab8a8b69a3215e721f04bdd91f267581c760d65a4a5e2d7778b27e38d966ab6b96be70aacaba9c86e8b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414e1f1a443d422bcbc3b86859506b8fa1ef434f77c301f0603551d23041830168014e1f1a443d422bcbc3b86859506b8fa1ef434f77c300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100ac57911e9d450349b5e323f5fbd6cbc25107406087f252bb21db0a36814a3946d5b0402c66e8afef09b301fdc69d80458c168dd0bad4919af98b586abf80a89bbf11cc1185f599905d87ba4eba28dc246d0723ad4e7a243c6c4689a3645290fdd581f407b263c64f52219aa27c9ef87ae2d97acac7ea15611ca3a30fa019aa26602f0553a10c4c5f057262510d12e58148f0136935207fb295b4e038f0a1693318e45fe4b37de9352f2b695e660e71b9bfff5c2fc89601a73ace7776509dd0213b5dab32478de0217da63a5526299bb353b9b87f9b2651cbdeb338b078e89b8d9feebc3452d24a7e202ab6c71934b184c8fd98fa0bc18025214d27913bf1f216	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37\Blob = 0f00000001000000200000009edf3a3e9dd48e21dc1f0c02f6964daa330ba93be23e55a716a6916f16deed81030000000100000014000000e1397ab0b33aa131ce4114981474d387b1532a372000000001000000d8030000308203d4308202bca00302010202086d358c4d4cd1e55e300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303732383133333933375a180f32303531303732383133333933375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a0e168b5165b877b9f1aa5b4f592349e799bbe5bbaa5526c26aafc7e7a8026968fab75ccbce8fe5361356e35dc7f84b87f5cefa6ccc88cbf994244beaddc1504b988fe2fd2ca4d1473cf2154b9bb3bd18794fd1df9f916ded5ce460cba15fff23baceb1815d3b209e2ac5bd2b4f73d3a6893bcca1a66e20037e05f5c6d828185ec5c89fabd1260ea7f8738797835b77f3e4a6cfcbd9a37410d445859728ad50746fa9eb3f92d29d342d868b93b6e24d54ff62f9696f37023643d470b6e4083f614dee5b2e29aa8396a83140a639a31f3dd653bd2fea47b7fd9ebc56ef57a8f682e82c4e54a40749bd775eaaa01053e1282819cf75981488c6ac4bbd57a6826e90203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c389dd4dedf823547314fcf0689457d63161c7a3301f0603551d23041830168014c389dd4dedf823547314fcf0689457d63161c7a3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010003f9180a72abaa0d631e7d24393461171bcfc5433732f3eec716ffd99cfede73254a3f79019702a347e9c0e29eca2ab9c985aac0611e1f6c3c0149c3ec70e5cb8d382d5fefb5876a783364bd29c16b92abd0780307b339acc208db927a903634c2a31cb70067e90e39d76f09c0df19c1597f35ed25dbf3d7aa1e628d87af46a19318ddb049501f4d30f86f29dbc1c8ff29e702fa06cb78458bae166bcb908224abacba116f4d15e886f12ae710bee3851e03cfd5a886566f0b5b4e2f61a878f9be77a23d89f9fa0c3b2d1fb965782b82fa77666c7c1ffb46f8ffde94a8ab381916183f8ded569619de857e9bc740eae48aa973e4d122212c3e7e8adf4cef33a4	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7\Blob = 140000000100000014000000e1f1a443d422bcbc3b86859506b8fa1ef434f77c0300000001000000140000008096da182333fed188e09ea3a0dac2dcda93f0a70f0000000100000020000000eb70eeb87155b9bae67525ed29cc95b7bf8ce89f084133d2fe51c9041afcf31d2000000001000000f0030000308203ec308202d4a0030201020208172469ebda8330b6300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303732383133333933385a180f32303531303732383133333933385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b7ffa62b17f44e461b00ff58d72826c8e78ab62b3e9581d8bef2e5a5f3c6a3e2f997cd00d9180d17189f68a8b151acbd6ab022ab6864f3c4d9a72eca4c7d599990166c7eff5b093d125b8557a5f11fae187d7a9795f433e95ef6ae9ea7e40c41fc01ef94aa5a3202a0f123e43752c837b0df88351522c59a6efb2d3ea6a778bb612bc29b4c4f17d66091ebf8d5a8dd1925f1007464e1c72f5bf5aebc75cbd87007a7b0ad62d2aa7bc6e5d45e73195df8738d6b4c1b576ef8fef97f0366a59e7d4dcf913f4110474e90149cf9e550952e6d373a0c991f5ab8a8b69a3215e721f04bdd91f267581c760d65a4a5e2d7778b27e38d966ab6b96be70aacaba9c86e8b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414e1f1a443d422bcbc3b86859506b8fa1ef434f77c301f0603551d23041830168014e1f1a443d422bcbc3b86859506b8fa1ef434f77c300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100ac57911e9d450349b5e323f5fbd6cbc25107406087f252bb21db0a36814a3946d5b0402c66e8afef09b301fdc69d80458c168dd0bad4919af98b586abf80a89bbf11cc1185f599905d87ba4eba28dc246d0723ad4e7a243c6c4689a3645290fdd581f407b263c64f52219aa27c9ef87ae2d97acac7ea15611ca3a30fa019aa26602f0553a10c4c5f057262510d12e58148f0136935207fb295b4e038f0a1693318e45fe4b37de9352f2b695e660e71b9bfff5c2fc89601a73ace7776509dd0213b5dab32478de0217da63a5526299bb353b9b87f9b2651cbdeb338b078e89b8d9feebc3452d24a7e202ab6c71934b184c8fd98fa0bc18025214d27913bf1f216	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5900000001000000160000005200530041002f0053004800410032003500360000006b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e5c00000001000000040000000010000020000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	dcinventory.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656\Blob = 5900000001000000100000005200530041002f004d004400350000006b00000001000000200000006b6c1e01f590f5afc5fcf85cd0b9396884048659fc2c6d1170d68b045216c3fd140000000100000014000000ddbcbd869c3f07ed40e31b08efcec4d188cd3b15190000000100000010000000181c2be05851f96993e196f279954b230b000000010000002e0000005400680061007700740065002000540069006d0065007300740061006d00700069006e006700200043004100000009000000010000000c000000300a06082b06010505070308030000000100000014000000be36a4562fb2ee05dbb3d32323adf445084ed6560400000001000000100000007f667a71d3eb6978209a51149d83da200f0000000100000010000000e8a598be84828efeae701115013576b25c0000000100000004000000000400002000000001000000a5020000308202a13082020aa003020102020100300d06092a864886f70d010104050030818b310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311430120603550407130b44757262616e76696c6c65310f300d060355040a1306546861777465311d301b060355040b13145468617774652043657274696669636174696f6e311f301d060355040313165468617774652054696d657374616d70696e67204341301e170d3937303130313030303030305a170d3230313233313233353935395a30818b310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311430120603550407130b44757262616e76696c6c65310f300d060355040a1306546861777465311d301b060355040b13145468617774652043657274696669636174696f6e311f301d060355040313165468617774652054696d657374616d70696e6720434130819f300d06092a864886f70d010101050003818d0030818902818100d62b587861458653ea347b519cedb0e62e180efee05fa827d3b4c9e07c594e160e735460c17ff69f2ee93a8524153cdb470463c39ec4941a5adf4c7af3d9431d3c107a7925db90fef051e730d64100fd9f28df79be94bb9db614e32385d7a941e04ca479b02b1a8bf2f83b8a3e45ac719200b4904198fb5fedfab72e8af888370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010405000381810067dbe2c2e6873d40838637357d1fce9ac30c6620a8baaa048986c2f510080dbfcba2058ad04d363ef4d7ef69c65ee4b0946f4ab9e7de5b88b67bdbe327e576c3f035c1cbb5279b3379dc90a6009e77fafccd279442169cd31c68ecbf5cdde5a97b100a32745413318b85038491b75801301438af28cafcb150191909ac8949d3	dcinventory.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UEMSAgentHCHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcusbsummary.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcuploadlogs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcmetroapps.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UEMSAgentHealthChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcswmeter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcstatusutil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcstatusutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcstatusutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcondemand.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcstatusutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UEMSAgentHCHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UEMSAgentHCHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcpatchscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CRU_Reporter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCProcessMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2600	PING.EXE
3828	cmd.exe

Checks SCSI registry key(s) 3 TTPs 24 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064	dcinventory.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	dcusb64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dcinventory.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	dcinventory.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LocationInformation	dcinventory.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\	dcinventory.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LocationInformation	dcinventory.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dcusbsummary.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dcusb64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064	dcinventory.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dcusbsummary.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dcusbsummary.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	dcusb64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dcinventory.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dcinventory.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dcinventory.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dcinventory.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dcusbsummary.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	dcinventory.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dcinventory.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5772	systeminfo.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	dcagentservice.exe

Modifies registry class 35 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net	dcagentservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\PackageCode = "DBF1585436CE69C49965D1E81CE639EC"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Transforms = "C:\\Windows\\Installer\\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\\UEMSAgent.mst"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\PackageName = "UEMSAgent.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\1 = "C:\\ProgramData\\7E40E0951F3A4D95887\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B	dcagentservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList	dcagentservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B\DefaultFeature	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\"	dcagentregister.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net	dcagentregister.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Version = "184879680"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net	dcconfig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333\F1322DA684FF95D4CA6204A5AF2ED37B	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products	dcagentservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\ProductName = "ManageEngine UEMS - Agent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\"	dcconfig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer	dcagentservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\"	dcagentservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\7E40E0951F3A4D95887\\"	msiexec.exe

Modifies system certificate store 2 TTPs 59 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25	dcinventory.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5900000001000000120000005200530041002f00530048004100310000006b00000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade375c0000000100000004000000000800002000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\Remote Desktop	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4	dcinventory.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E\Blob = 59000000010000001a000000450043004400530041002f005300480041003300380034000000190000000100000010000000b009e99a5cfc928a173190106dbb32a95c000000010000000400000080010000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f007400200047003300000062000000010000002000000031ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0140000000100000014000000b3db48a4f9a1c5d8ae3641cc1163696229bc4bc61d0000000100000010000000d0ab39edd1a4d89a5512882deb09cb130300000001000000140000007e04de896a3e666d00e687d33ffad93be83d349e0f000000010000003000000082c80199397722b57ad473ea266b93d47ffc77fe07f09388345f20dab6addd087672f988b4bbfd154c4b133c70c9ecff6b000000010000002000000031ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d02000000001000000430200003082023f308201c5a0030201020210055556bcf25ea43535c3a40fd5ab4572300a06082a8648ce3d0403033061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204733301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f742047333076301006072a8648ce3d020106052b8104002203620004dda7d9bb8ab80bfb0b7f21d2f0bebe73f3335d1abc34eadec69bbcd095f6f0ccd00bba615b51467e9e2d9fee8e630c17ec0770f5cf842e40839ce83f416d3badd3a4145936789d0343ee10136c72deae88a7a16bb543ce67dc23ff031ca3e23ea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b3db48a4f9a1c5d8ae3641cc1163696229bc4bc6300a06082a8648ce3d0403030368003065023100adbcf26c3f124ad12d39c30a099773f488368c8827bbe6888d5085a763f99e32de66930ff1ccb1098fdd6cabfa6b7fa0023039665bc2648db89e50dca8d549a2edc7dcd1497f1701b8c8868f4e8c882ba89aa98ac5d100bdf854e29ae55b7cb32717	dcinventory.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54\Blob = 5900000001000000160000005200530041002f0053004800410032003500360000006b00000001000000200000002399561127a57125de8cefea610ddf2fa078b5c8067f4e828290bfb860e84b3c0f000000010000002000000017fe16f394ec70a5bb0c6784cab40b1e61025ae9d50ecaa0531d6b4d997bbc590b000000010000006000000056006500720069005300690067006e00200055006e006900760065007200730061006c00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004200000030403021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000002399561127a57125de8cefea610ddf2fa078b5c8067f4e828290bfb860e84b3c7f0000000100000016000000301406082b0601050507030306082b06010505070301140000000100000014000000b677fa6948479f5312d5c2ea07327607d19707191d0000000100000010000000439b4d52906df7a01771d729528723b37e000000010000000800000000c0032f2df8d6010300000001000000140000003679ca35668772304d30a5fb873b0fa77bb70d54190000000100000010000000ad6d6ff31b24013151f279e26a8c33245c0000000100000004000000000800002000000001000000bd040000308204b9308203a1a0030201020210401ac46421b31321030ebbe4121ac51d300d06092a864886f70d01010b05003081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f72697479301e170d3038303430323030303030305a170d3337313230313233353935395a3081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c761375eb10134db62d7159bff585a8c2323d6608e91d79098837ae65819388cc5f6e56485b4a271fbedbdb9dacd4d00b4c82d73a5c76971951f393cb244079ce80efa4d4ac421df29618f32226182c5871f6e8c7c5f16205144d1704f57eae31ce3cc79ee58d80ec2b34593c02ce79a172b7b00377a413378e133e2f3101a7f872cbef6f5f742e2e5bf8762895f004bdfc5dde4754432413a1e716e69cb0b754608d1cad22b95d0cffbb9406b648c574dfc13117984ed5e54f6349f0801f3102506174adaf11d7a666b986066a4d9efd22e82f1f0ef09ea44c9156ae2036e33d3ac9f5500c7f6086a94b95fdce033f18460f95b2711b4fc16f2bb566a80258d0203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e04160414b677fa6948479f5312d5c2ea07327607d1970719300d06092a864886f70d01010b050003820101004af8f8b003e62c677be4947763cc6e4cf97d0e0ddcc8b935b9704f63fa24fa6c838c479d3b63f39af976329591b177bcac9abeb1e43121c68195565a0eb1c2d4b1a659acf163cbb84c1d59904aef9016281f5aae10fb8150380c6cccf13dc3f563e3b3e321c92439e9fd156646f41b11d04d73a37d46f93deda85f62d4f13ff8e074572b189d81b4c428da9497a570ebac1dbe0711f0d5dbdde58cf0d532b083e657e28fbfbea1aabf3d1db5d438ead7b05c3a4f6a3f8fc0666c63aae9d9a416f481d195140e7dcd9534d9d28f7073817b9c7ebd9861d845879890c5eb8630c635bff0ffc35588834bef05920671f2b89893b7eccd8261f138e64f97982a5a8d	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\2C85006A1A028BCC349DF23C474724C055FDE8B6	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TrustedDevices	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\Certificates	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\B68D8F953E551914324E557E6164D68B9926650C	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\ClientAuthIssuer\CTLs	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	dcinventory.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5900000001000000160000005200530041002f005300480041003300380034000000190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e46b0000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899885c0000000100000004000000001000002000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\ClientAuthIssuer\CRLs	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\Remote Desktop\CRLs	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2	dcinventory.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\B68D8F953E551914324E557E6164D68B9926650C\Blob = 5900000001000000120000004400530041002f0053004800410031000000030000000100000014000000b68d8f953e551914324e557e6164d68b9926650c2000000001000000200300003082031c308202dba003020102020900f5610f0c1a4d426b300906072a8648ce38040330233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579301e170d3231303331383138343233375a170d3431303331333138343233375a30233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579308201b73082012b06072a8648ce3804013082011e02818100dc1911eb3e0ac27a1b8fcf7b95e6192f5ee6a922eca3cc87df88539244fb3d07d10e2fe7570a602726d0e1ed4ad078a1317746a4dc613eb0629fe4e8272b19454aa3ad2d598dc2fa884e001a5fa009ecb4b5ff6d9996610f3b2b3911a41db558608026ca0d439574a106f09c479e58ee6c7d9e93de57cfed8832798e0d6ad5a10215008453f6990ad5473bab4ebb0f46ce52d5a354596502818070de55e09bdc70d46f414acf263fdb2ff0879f0bceed06ea6789a518fe5cfe025374aacead5cf1d27aca1b085c4b0cd4f4561c387d24c904f96af7db6f57a8a9110901b51dc2a2531532ad06ec4096f288e73d651cc1d6140b2932ee4c95ec4bb09d462800de2765606137d04e8ff9ced03b391c89ebc91d119d312f4f4ba88f0381850002818100d920e184f0439cac6f987f511ef4d45b4a6f693c806c55f143558ffab70deb4f1a92a2a6c8c8ac931094c92a0118011b13fb33701a93bb8569bec9323811d8e8b8ba7b060fe5ca557bb980461dbbf9cb863b3cf7259015c22efd0fabbdffa3b19cbc9f6dd469605ab4aa59ad5126eab69f3de5cb3470b9fc4c8a69b7e87a8832a38198308195301d0603551d0e04160414d8201fdaa7f2d1002bf5eda7be5e8e49897208f030530603551d23044c304a8014d8201fdaa7f2d1002bf5eda7be5e8e49897208f0a127a42530233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579820900f5610f0c1a4d426b30120603551d130101ff040830060101ff020100300b0603551d0f0404030201c6300906072a8648ce380403033000302d021470c61b78deaf41f3cbf42bd3c0f1fd7a5018f1bf0215008399b086c63512f057352a2bf1e6b248d8ab107d	dcinventory.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\2C85006A1A028BCC349DF23C474724C055FDE8B6\Blob = 5900000001000000120000004400530041002f00530048004100310000000300000001000000140000002c85006a1a028bcc349df23c474724c055fde8b620000000010000001f0300003082031b308202dba003020102020900bea900b78b6470ef300906072a8648ce38040330233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579301e170d3136303530393230343035355a170d3231303530383230343035355a30233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579308201b73082012c06072a8648ce3804013082011f02818100a9a733a14a9c9d68b075811ddf231c514c0cdc328087287fd11f1d6eb125b536b88cd5579591bb6e7545b45b98eaa8cdeb0ae38be4781c7d36d97b3d2bb45b9449142130f68e112c6d09e343160cd0d0fbb8aabc8b0cea5b2066b0e3368589dadfd8ae79e9d2bdc5f5836d8fb278be02c260d3a592bda471f1a28e2f925e8b57021500a86236ce56c046d8f3fac8a6bb63e28543e45753028181009eb2085cfbe32af5a25dddeebdeede0d2f2a4475bbca802c7952e078421b4b85528fff6242aba7c75c1e40695db3be422d982972b638679c1b9314a39cad44577d2a71ee3e5738176062d9200be5efcc1b00c16b1b48e8b1771c01b9aa54ce0b5f6679caed531293d92ef822695e20264e23b188489ea3e6dc1c36a90fa0668903818400028180168cdc3d074cf4c9accef116317b85adf100f2454c9ca23203ad296928bb08879c48096c44bcb0dc3f49f69456e871dd45980eacabe735c63ade0281e7a48aca3eabde71aab64c04a6ef72c352be936692c8970a3c7615370d549b931c289810278f5284914f6965df0d93ce0a980ca5dce26e75a331c4da939af3e051d252d3a38198308195301d0603551d0e04160414a353ea5503cd0a69c45870b6ffe3912091c79f7a30530603551d23044c304a8014a353ea5503cd0a69c45870b6ffe3912091c79f7aa127a42530233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579820900bea900b78b6470ef30120603551d130101ff040830060101ff020100300b0603551d0f0404030201c6300906072a8648ce380403032f00302c021468e7a7cdfca81ff04d476fa11b781b7696d1fbf402145ef1c64374ebde4c309b59a9deeb99e556fd1477	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\ClientAuthIssuer\Certificates	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\Remote Desktop\Certificates	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37	dcagentregister.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7	dcagentregister.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\MSIEHistoryJournal\CTLs	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\UserDS	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\MSIEHistoryJournal\Certificates	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\MSIEHistoryJournal\CRLs	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\FlightRoot	dcinventory.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 5900000001000000160000005200530041002f0053004800410032003500360000006b0000000100000020000000cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f0f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f0074002000470032000000620000000100000020000000cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f391d00000001000000100000007dc30bc974695560a2f0090a6545556c7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a419000000010000001000000014c3bd3549ee225aece13734ad8ca0b85c0000000100000004000000000800002000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\Remote Desktop\CTLs	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\ClientAuthIssuer	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CTLs	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\REQUEST	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CRLs	dcinventory.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob = 5900000001000000100000005200530041002f004d004400320000007e0000000100000008000000000010c51e92d201620000000100000020000000e7685634efacf69ace939a6b255b7b4fabef42935b50a265acb5cb6027e44e7009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030119000000010000001000000091161b894b117ecdc257628db460cc04030000000100000014000000742c3192e607e424eb4549542be1bbc53e6174e21d000000010000001000000027b3517667331ce2c1e74002b5ff2298140000000100000014000000e27f7bd877d5df9e0a3f9eb4cb0e2ea9efdb69770b000000010000004600000056006500720069005300690067006e00200043006c006100730073002000330020005000750062006c006900630020005000720069006d00610072007900200043004100000004000000010000001000000010fc635df6263e0df325be5f79cd67670f0000000100000010000000d7c63be0837dbabf881d4fbf5f986ad853000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c07a000000010000000e000000300c060a2b0601040182375e010268000000010000000800000000003db65bd9d5012000000001000000400200003082023c308201a5021070bae41d10d92934b638ca7b03ccbabf300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830313233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c95c599ef21b8a0114b410df0440dbe357af6a45408f840c0bd133d9d911cfee02581f25f72aa84405aaec031f787f9e93b99a00aa237dd6ac85a26345c77227ccf44cc67571d239ef4f42f075df0a90c68e206f980ff8ac235f702936a4c986e7b19a20cb53a585e73dbe7d9afe244533dc7615ed0fa271644c652e816845a70203010001300d06092a864886f70d010102050003818100bb4c122bcf2c26004f1413dda6fbfc0a11848cf3281c67922f7cb6c5fadff0e895bc1d8f6c2ca851cc73d8a4c053f04ed626c076015781925e21f1d1b1ffe7d02158cd6917e3441c9c194439895cdc9c000f568d0299eda290454ce4bb10a43df032030ef1cef8e8c9518ce6629fe69fc07db7729cc9363a6b9f4ea8ff640d64	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54	dcinventory.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4	dcinventory.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\MSIEHistoryJournal	dcinventory.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2600	PING.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5788	UEMSAgentHCHelper.exe
5788	UEMSAgentHCHelper.exe
5788	UEMSAgentHCHelper.exe
5788	UEMSAgentHCHelper.exe
5788	UEMSAgentHCHelper.exe
5788	UEMSAgentHCHelper.exe
876	UEMSAgentHCHelper.exe
876	UEMSAgentHCHelper.exe
876	UEMSAgentHCHelper.exe
876	UEMSAgentHCHelper.exe
876	UEMSAgentHCHelper.exe
876	UEMSAgentHCHelper.exe
1416	UEMSAgentHCHelper.exe
1416	UEMSAgentHCHelper.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe
1192	dcagentregister.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1536	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1536	msiexec.exe
Token: SeSecurityPrivilege	3024	msiexec.exe
Token: SeCreateTokenPrivilege	1536	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1536	msiexec.exe
Token: SeLockMemoryPrivilege	1536	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1536	msiexec.exe
Token: SeMachineAccountPrivilege	1536	msiexec.exe
Token: SeTcbPrivilege	1536	msiexec.exe
Token: SeSecurityPrivilege	1536	msiexec.exe
Token: SeTakeOwnershipPrivilege	1536	msiexec.exe
Token: SeLoadDriverPrivilege	1536	msiexec.exe
Token: SeSystemProfilePrivilege	1536	msiexec.exe
Token: SeSystemtimePrivilege	1536	msiexec.exe
Token: SeProfSingleProcessPrivilege	1536	msiexec.exe
Token: SeIncBasePriorityPrivilege	1536	msiexec.exe
Token: SeCreatePagefilePrivilege	1536	msiexec.exe
Token: SeCreatePermanentPrivilege	1536	msiexec.exe
Token: SeBackupPrivilege	1536	msiexec.exe
Token: SeRestorePrivilege	1536	msiexec.exe
Token: SeShutdownPrivilege	1536	msiexec.exe
Token: SeDebugPrivilege	1536	msiexec.exe
Token: SeAuditPrivilege	1536	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1536	msiexec.exe
Token: SeChangeNotifyPrivilege	1536	msiexec.exe
Token: SeRemoteShutdownPrivilege	1536	msiexec.exe
Token: SeUndockPrivilege	1536	msiexec.exe
Token: SeSyncAgentPrivilege	1536	msiexec.exe
Token: SeEnableDelegationPrivilege	1536	msiexec.exe
Token: SeManageVolumePrivilege	1536	msiexec.exe
Token: SeImpersonatePrivilege	1536	msiexec.exe
Token: SeCreateGlobalPrivilege	1536	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3392	7za.exe
Token: 35	3392	7za.exe
Token: SeSecurityPrivilege	3392	7za.exe
Token: SeSecurityPrivilege	3392	7za.exe
Token: SeRestorePrivilege	4748	7za.exe
Token: 35	4748	7za.exe
Token: SeSecurityPrivilege	4748	7za.exe
Token: SeSecurityPrivilege	4748	7za.exe
Token: SeDebugPrivilege	3552	dcusbsummary.exe
Token: SeDebugPrivilege	5096	dcswmeter.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3752	wscript.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1536	msiexec.exe
3024	msiexec.exe
6004	MsiExec.exe
3552	dcusbsummary.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 3752	2424	WScript.exe	90
PID 3752 wrote to memory of 1536	3752	wscript.exe	92
PID 3024 wrote to memory of 6004	3024	msiexec.exe	94
PID 3024 wrote to memory of 1192	3024	msiexec.exe	95
PID 1192 wrote to memory of 3572	1192	dcagentregister.exe	96
PID 3572 wrote to memory of 5336	3572	cmd.exe	98
PID 5336 wrote to memory of 2112	5336	net.exe	99
PID 3572 wrote to memory of 4924	3572	cmd.exe	100
PID 3572 wrote to memory of 4608	3572	cmd.exe	101
PID 3572 wrote to memory of 3472	3572	cmd.exe	102
PID 3572 wrote to memory of 3316	3572	cmd.exe	103
PID 3572 wrote to memory of 5056	3572	cmd.exe	104
PID 4876 wrote to memory of 5788	4876	UEMSAgentHealthChecker.exe	106
PID 4876 wrote to memory of 876	4876	UEMSAgentHealthChecker.exe	108
PID 4876 wrote to memory of 1416	4876	UEMSAgentHealthChecker.exe	110
PID 1192 wrote to memory of 2836	1192	dcagentregister.exe	113
PID 2836 wrote to memory of 3392	2836	cmd.exe	115
PID 1192 wrote to memory of 4748	1192	dcagentregister.exe	119
PID 1192 wrote to memory of 5780	1192	dcagentregister.exe	121
PID 1192 wrote to memory of 1348	1192	dcagentregister.exe	122
PID 1348 wrote to memory of 5772	1348	cmd.exe	125
PID 1192 wrote to memory of 3264	1192	dcagentregister.exe	127
PID 1192 wrote to memory of 2648	1192	dcagentregister.exe	129
PID 4392 wrote to memory of 6020	4392	dcagentservice.exe	132
PID 4392 wrote to memory of 3552	4392	dcagentservice.exe	134
PID 4392 wrote to memory of 2572	4392	dcagentservice.exe	135
PID 3552 wrote to memory of 2440	3552	dcusbsummary.exe	137
PID 4392 wrote to memory of 6092	4392	dcagentservice.exe	139
PID 4392 wrote to memory of 2100	4392	dcagentservice.exe	141
PID 4392 wrote to memory of 5096	4392	dcagentservice.exe	143
PID 4392 wrote to memory of 2856	4392	dcagentservice.exe	145
PID 2648 wrote to memory of 4332	2648	dcinventory.exe	188
PID 5780 wrote to memory of 5904	5780	dcpatchscan.exe	148
PID 4392 wrote to memory of 6024	4392	dcagentservice.exe	150
PID 5780 wrote to memory of 3956	5780	dcpatchscan.exe	152
PID 3752 wrote to memory of 3828	3752	wscript.exe	154
PID 3828 wrote to memory of 2600	3828	cmd.exe	397
PID 5780 wrote to memory of 788	5780	dcpatchscan.exe	158
PID 5780 wrote to memory of 1480	5780	dcpatchscan.exe	175
PID 5780 wrote to memory of 2944	5780	dcpatchscan.exe	163
PID 5780 wrote to memory of 3060	5780	dcpatchscan.exe	165
PID 6024 wrote to memory of 4164	6024	dcconfig.exe	168
PID 5780 wrote to memory of 5804	5780	dcpatchscan.exe	170
PID 5780 wrote to memory of 5048	5780	dcpatchscan.exe	358
PID 5780 wrote to memory of 1112	5780	dcpatchscan.exe	174
PID 5780 wrote to memory of 700	5780	dcpatchscan.exe	176
PID 4392 wrote to memory of 3064	4392	dcagentservice.exe	178
PID 5780 wrote to memory of 604	5780	dcpatchscan.exe	179
PID 6024 wrote to memory of 3656	6024	dcconfig.exe	181
PID 5780 wrote to memory of 4852	5780	dcpatchscan.exe	400
PID 5780 wrote to memory of 5652	5780	dcpatchscan.exe	204
PID 5780 wrote to memory of 3676	5780	dcpatchscan.exe	187
PID 5780 wrote to memory of 5052	5780	dcpatchscan.exe	263
PID 5780 wrote to memory of 904	5780	dcpatchscan.exe	509
PID 5780 wrote to memory of 5884	5780	dcpatchscan.exe	193

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Purchase_Order_Details_and_Quotation_Sheet.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Purchase_Order_Details_and_Quotation_Sheet.vbs" /elevated
  2⤵
  - Badlisted process makes network request
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\ProgramData\7E40E0951F3A4D95887\UEMSAgent.msi" /quiet TRANSFORMS="C:\ProgramData\7E40E0951F3A4D95887\UEMSAgent.mst" ENABLESILENT="yes" REBOOT="ReallySuppress" INSTALLSOURCE="Manual" SERVER_ROOT_CRT="C:\ProgramData\7E40E0951F3A4D95887\DMRootCA-Server.crt" DS_ROOT_CRT="C:\ProgramData\7E40E0951F3A4D95887\DMRootCA.crt"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1536
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 3 > nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\Purchase_Order_Details_and_Quotation_Sheet.vbs"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3828
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2600

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4B4A1E8FB07F2220E4CED5EB9D11CB30
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6004
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies trusted root certificate store through registry
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3572
  - - C:\Windows\SysWOW64\net.exe
      net session
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5336
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2112
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4924
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /grant:r "DLAWBTBF\Admin":(OI)(CI)F /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4608
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3472
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3316
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5056
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3392
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4748
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe
    bin\dcpatchscan.exe -y 1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:5780
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" *
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5904
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3956
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" *
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:788
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1480
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" *
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2944
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
      4⤵
      Executes dropped EXE
      PID:3060
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data.xml.gz" *
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5804
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchutils.json.gz" *
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5048
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1112
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1480
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.xml.gz" *
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:700
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\hardware.json.gz" *
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:604
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.xml.gz" *
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4852
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchtodepfiles.xml.gz" *
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5652
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\EPMErrorCodes.xml.gz" *
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3676
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4332
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-dependency-details.xml.gz" *
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:5052
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\ud-supported-patch-details.json.gz" *
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:904
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.json.gz" *
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5884
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.json.gz" *
      4⤵
      PID:2008
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\eol-service-packs.json.gz" *
      4⤵
      PID:4080
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\os-servicing-data.json.gz" *
      4⤵
      PID:1824
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\misconfig-scan-data.xml.gz" *
      4⤵
      PID:1360
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" *
      4⤵
      PID:124
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5652
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" coveragex.exe
      4⤵
      PID:4272
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-scan-data\windows-component-details.zip" *
      4⤵
      PID:2780
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json""
      4⤵
      Executes a command shell one-liner
      PID:1064
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so
        5⤵
        
        PID:5484
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json""
      4⤵
      Executes a command shell one-liner
      PID:6016
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so
        5⤵
        
        PID:4888
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json""
      4⤵
      Executes a command shell one-liner
      PID:5152
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so
        5⤵
        
        PID:1920
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json""
      4⤵
      Executes a command shell one-liner
      PID:2772
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so
        5⤵
        
        PID:3580
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json""
      4⤵
      Executes a command shell one-liner
      PID:3048
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so
        5⤵
        
        PID:3148
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" *
      4⤵
      PID:1248
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll
      4⤵
      PID:2828
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" *
      4⤵
      PID:4868
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll
      4⤵
      PID:2624
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml.gz" *
      4⤵
      PID:4660
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\patchresource-vul.xml.gz" *
      4⤵
      PID:3516
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\applications-vul.xml.gz" *
      4⤵
      PID:5952
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\vulnerable-scan-data.xml.gz" *
      4⤵
      PID:6096
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-details.json.gz" *
      4⤵
      PID:124
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\meaap.exe" -m 1 -a 7093261d-e605-4137-be02-f2a185eeaad2
      4⤵
      PID:1444
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr100316-sp100392.xml.gz" *
      4⤵
      PID:2780
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr100397-sp100474.xml.gz" *
      4⤵
      PID:792
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1906-sp3076.xml.gz" *
      4⤵
      PID:5036
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1939-sp3120.xml.gz" *
      4⤵
      PID:4864
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5048
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1949-sp3133.xml.gz" *
      4⤵
      PID:5548
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1110-sp2137.xml.gz" *
      4⤵
      PID:4608
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr100226-sp100296.xml.gz" *
      4⤵
      PID:1224
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr100208-sp100270.xml.gz" *
      4⤵
      PID:1272
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1148-sp2169.xml.gz" *
      4⤵
      PID:5488
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr100241-sp100311.xml.gz" *
      4⤵
      PID:1124
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr81-sp2171.xml.gz" *
      4⤵
      PID:2116
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1201-sp2213.xml.gz" *
      4⤵
      PID:4808
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1200-sp2211.xml.gz" *
      4⤵
      PID:5388
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1259-sp2288.xml.gz" *
      4⤵
      PID:1044
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1258-sp2287.xml.gz" *
      4⤵
      PID:2724
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr102221-sp102329.xml.gz" *
      4⤵
      PID:5200
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1596-sp2707.xml.gz" *
      4⤵
      PID:1156
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr2073-sp3270.xml.gz" *
      4⤵
      PID:5352
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1652-sp2964.xml.gz" *
      4⤵
      PID:4864
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr101483-sp101584.xml.gz" *
      4⤵
      PID:4376
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr100183-sp100239.xml.gz" *
      4⤵
      PID:1208
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1791-sp2902.xml.gz" *
      4⤵
      PID:1648
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1804-sp2932.xml.gz" *
      4⤵
      PID:4712
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1817-sp2968.xml.gz" *
      4⤵
      PID:4668
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1814-sp2952.xml.gz" *
      4⤵
      PID:4336
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1828-sp2985.xml.gz" *
      4⤵
      PID:5188
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1846-sp3000.xml.gz" *
      4⤵
      PID:4076
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1845-sp2999.xml.gz" *
      4⤵
      PID:3264
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\hardware-scan-data\realtek.network.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/patch-resources/hardware-scan-data/realtek.network.json""
      4⤵
      Executes a command shell one-liner
      PID:4296
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\hardware-scan-data\realtek.network.json.gz" -so
        5⤵
        
        PID:1828
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C wevtutil epl application "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\application.evtx"
      4⤵
      Executes a command shell one-liner
      PID:3256
    - - C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil epl application "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\application.evtx"
        5⤵
        
        PID:2304
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C wevtutil epl system "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\system.evtx"
      4⤵
      Executes a command shell one-liner
      PID:1044
    - - C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil epl system "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\system.evtx"
        5⤵
        
        PID:4540
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C wevtutil epl setup "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\setup.evtx"
      4⤵
      Executes a command shell one-liner
      PID:1484
    - - C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil epl setup "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\setup.evtx"
        5⤵
        
        PID:2968
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell.exe -Command "Get-WmiObject -Class Win32_QuickFixEngineering -Filter \"HotFixID!='File 1'\" | Select-Object Description, HotFixID, InstalledOn, InstalledBy" > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\updates.log"
      4⤵
      Executes a command shell one-liner
      PID:2036
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -Command "Get-WmiObject -Class Win32_QuickFixEngineering -Filter \"HotFixID!='File 1'\" | Select-Object Description, HotFixID, InstalledOn, InstalledBy"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3500
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C C:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\uninstall32.reg"
      4⤵
      Executes a command shell one-liner
      PID:3200
    - - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\uninstall32.reg"
        5⤵
        
        PID:3436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C C:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\uninstall.reg"
      4⤵
      Executes a command shell one-liner
      PID:3364
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\uninstall.reg"
        5⤵
        
        PID:1048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C C:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\patchuserdata.reg"
      4⤵
      Executes a command shell one-liner
      PID:6008
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\patchuserdata.reg"
        5⤵
        
        PID:3856
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C C:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\productuserdata.reg"
      4⤵
      Executes a command shell one-liner
      PID:5768
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\productuserdata.reg"
        5⤵
        
        PID:2916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C C:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\components.reg"
      4⤵
      Executes a command shell one-liner
      PID:688
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\components.reg"
        5⤵
        
        PID:3316
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C C:\Windows\system32\reg.exe export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\CBS.reg"
      4⤵
      Executes a command shell one-liner
      PID:3088
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\CBS.reg"
        5⤵
        
        PID:3556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C C:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\SBS.reg"
      4⤵
      Executes a command shell one-liner
      PID:4924
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\SBS.reg"
        5⤵
        
        PID:4668
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" a updatedetails.7z uninstall32.reg uninstall.reg patchuserdata.reg productuserdata.reg components.reg CBS.reg SBS.reg CBS.log
      4⤵
      PID:2732
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" a updatedetails.7z ..\logs\application.evtx
      4⤵
      PID:5776
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" a updatedetails.7z ..\logs\system.evtx
      4⤵
      PID:5800
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" a updatedetails.7z ..\logs\setup.evtx
      4⤵
      PID:3044
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" a updatedetails.7z ..\History\latestpatchscan.xml
      4⤵
      PID:5332
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" a updatedetails.7z ..\data\latestvulnerablescandata.json
      4⤵
      PID:2144
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1348
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo.exe
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:5772
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 22
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:3264
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
    bin\dcinventory.exe -i postinstallation 0 1
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies trusted root certificate store through registry
    - System Location Discovery: System Language Discovery
    - Checks SCSI registry key(s)
    - Modifies data under HKEY_USERS
    - Modifies system certificate store
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmetroapps.exe
      dcmetroapps.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:4332

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\UEMSAgentHealthChecker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5788
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 2
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:876
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 4
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1416

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2440

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exe
  CRU_Reporter.exe -RegisterCRU
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6020
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 9
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Checks SCSI registry key(s)
    PID:2440
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
  7 0 0
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:2572
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
  bin\dcstatusutil.exe RequestAgentSlotFromServer
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:6092
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:2100
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5096
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2856
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
  3 0 0
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:6024
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
    bin\dcinventory.exe -p processor compatibility
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:4164
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuploadlogs.exe
    refresh
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3656
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\\OSDetection.json.gz" OSDetection.json
    3⤵
    PID:5880
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml2164.tmp" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml2164.tmpnew""
    3⤵
    - Executes a command shell one-liner
    PID:5980
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml2164.tmp" -so
      4⤵
      PID:3424
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
    3⤵
    PID:5976
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
    3⤵
    PID:3672
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
    3⤵
    PID:5864
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" coveragex.exe
    3⤵
    PID:2092
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll
    3⤵
    PID:5368
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll
    3⤵
    PID:2432
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-details.json.gz" *
    3⤵
    PID:5964
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcnacprocess.exe
    3
    3⤵
    PID:3448
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe" -m 1 -c Refresh
    3⤵
    PID:5052
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n a8171afd-f23a-419b-9bb8-146a20bb61fd -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" -c blm -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json" -a 2
      4⤵
      PID:1248
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\"
        5⤵
        
        PID:2664
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n d57c4dc4-daa3-496d-85ce-28fc06cd5c6e -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" -c dcm-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json" -a 2
      4⤵
      PID:2584
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
        
        dcagenttrayicon.exe -r
        5⤵
        
        PID:2304
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
        
        dcagenttrayicon.exe
        5⤵
        
        PID:608
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\"
        5⤵
        
        PID:4196
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
        
        dcagenttrayicon.exe -r
        5⤵
        
        PID:5612
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 50a5c86a-eafc-11ed-a05b-0242ac120003 -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\ECEASetup.zip" -c ei_win_64 -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EndpointIntelligence-metadata.json" -a 1
      4⤵
      PID:2872
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\ECEASetup.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\EndpointIntelligence\installer\"
        5⤵
        
        PID:4376
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\installer\ECEASetup.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\installer\ECEASetup.exe" -install
        5⤵
        
        PID:4196
      - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEABundle.7z"
        6⤵
        
        PID:6064
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n d57c4dc4-daa3-496d-85ce-28fc06cd5c6e -c dcm-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json" -a 0
      4⤵
      PID:4592
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\devctrlaction64.exe
        
        -c 4
        5⤵
        
        PID:1768
      - C:\Windows\system32\gpupdate.exe
        
        C:\Windows\system32\gpupdate.exe /Target:Computer /Force
        6⤵
        
        PID:5364
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
        
        dcagenttrayicon.exe -r
        5⤵
        
        PID:2432
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
        
        dcagenttrayicon.exe
        5⤵
        
        PID:5396
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n a8171afd-f23a-419b-9bb8-146a20bb61fd -c blm -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json" -a 0
      4⤵
      PID:5092
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 50a5c86a-eafc-11ed-a05b-0242ac120003 -c ei_win_64 -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EndpointIntelligence-metadata.json" -e enabled -a 3
      4⤵
      PID:4808
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcwolsettings.exe
    bin\dcwolsettings.exe
    3⤵
    PID:4160
- - C:\Windows\SysWOW64\cscript.exe
    C:\Windows\system32\cscript.exe DisableEnableEthernet.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4732
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg -devicequery wake_from_any
      4⤵
      Power Settings
      PID:3500
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    7za x -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\driverfiles.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\" -y
    3⤵
    PID:5620
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAService64.exe
    DCFAService64.exe -install DFMFilter
    3⤵
    PID:2044
  - - C:\Windows\system32\fltmc.exe
      C:\Windows\system32\fltmc.exe unload DFMFilter
      4⤵
      PID:1376
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAService64.exe
    DCFAService64.exe -install DRMFilter
    3⤵
    PID:5708
  - - C:\Windows\system32\fltmc.exe
      C:\Windows\system32\fltmc.exe unload DRMFilter
      4⤵
      PID:4580
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAService64.exe
    DCFAService64.exe -start DRMFilter
    3⤵
    PID:4340
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
    dcagenttrayicon.exe -r
    3⤵
    PID:5684
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
    dcagenttrayicon.exe -s
    3⤵
    PID:6000
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\mdmregistrationhandler_64.exe
    mdmregistrationhandler_64.exe -c
    3⤵
    PID:2500
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe
    bin\dcpatchscan.exe -y 11
    3⤵
    PID:1568
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSMdmEnroll.exe
    UEMSMdmEnroll.exe
    3⤵
    PID:5300
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\mdmregistrationhandler_64.exe
      mdmregistrationhandler_64.exe -c
      4⤵
      PID:2200
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\mdmregistrationhandler_64.exe
      mdmregistrationhandler_64.exe -u "Admin" "https://jpword.cc:8443/mdm/client/v1/enroll?encapiKey=f0ea57cb&templateToken=41ae00152df79ad241ece5e27d605713&action=discover" "798" "42443288"
      4⤵
      PID:5900
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
      dcstatusutil.exe -mdm 0 0
      4⤵
      PID:756
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuninstallsw.exe
    bin\dcuninstallsw.exe
    3⤵
    PID:3696
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_SUM
    3⤵
    PID:5904
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\secaddoncrashanalyser.exe
    bin\secaddoncrashanalyser.exe
    3⤵
    PID:4264
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exe
    -FetchCRUReport
    3⤵
    PID:2816
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    7za x -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\driverfiles.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\" -y
    3⤵
    PID:3372
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAService64.exe
    DCFAService64.exe -install DFMFilter
    3⤵
    PID:1772
  - - C:\Windows\system32\fltmc.exe
      C:\Windows\system32\fltmc.exe unload DFMFilter
      4⤵
      PID:3104
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAService64.exe
    DCFAService64.exe -install DRMFilter
    3⤵
    PID:2780
  - - C:\Windows\system32\fltmc.exe
      C:\Windows\system32\fltmc.exe unload DRMFilter
      4⤵
      PID:904
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAService64.exe
    DCFAService64.exe -start DRMFilter
    3⤵
    PID:3764
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exe
  DCProcessMonitor.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3064

C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe"
1⤵
PID:5856
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\BitLockerMgmt\bin\4\BitlockerMgmt.exe
  BitlockerMgmt.exe -svd -lff "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\..\data\GlobalVariables.json"
  2⤵
  PID:3932
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesDevCtrlSummary.exe
  -s ET_ENUM 9 2 "Unknown"
  2⤵
  PID:5004
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\BitLockerMgmt\bin\4\BitlockerMgmt.exe
  BitlockerMgmt.exe -genblrk -lff "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\..\data\GlobalVariables.json"
  2⤵
  PID:2620
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driversetup64.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driversetup64.exe" -stop
  2⤵
  PID:5612

C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAService.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAService.exe"
1⤵
PID:1776
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAReplication.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAReplication.exe" --version_manager_db_size=10485760 --ea_replication_root_path=client-data/intelligence/v1/ei-meta-data.json
  2⤵
  PID:4104
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data/intelligence/v1/ei-meta-data.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\temp\ei-meta-data.json" --registry-key=ECEAConf_ei-meta-data --reporting-server=0
    3⤵
    PID:4240
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\alertprofiles-meta.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\alertprofiles-meta.json" --reporting-server=0
    3⤵
    PID:4812
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\target-meta.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\target-meta.json" --reporting-server=0
    3⤵
    PID:1872
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\emitter-policies.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\emitter-policies.json" --reporting-server=0
    3⤵
    PID:3944
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\rule-templates.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\rule-templates.json" --reporting-server=0
    3⤵
    PID:1444
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\rulesets-meta.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\rulesets-meta.json" --reporting-server=0
    3⤵
    PID:4232
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\rulesets\1.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\rulesets\1.json" --reporting-server=0
    3⤵
    PID:4916
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\telemetry-definition-agent.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\telemetry-definition-agent.json" --reporting-server=0
    3⤵
    PID:1272
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\criteria-meta.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\criteria-meta.json" --reporting-server=0
    3⤵
    PID:1476
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\agent-config.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\agent-config.json" --reporting-server=0
    3⤵
    PID:5056
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\score-profiles.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\score-profiles.json" --reporting-server=0
    3⤵
    PID:2720
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\score_profiles\1.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\score_profiles\1.json" --reporting-server=0
    3⤵
    PID:4828
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\cg-meta.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\cg-meta.json" --reporting-server=0
    3⤵
    PID:2588
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\deployment-meta.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\deployment-meta.json" --reporting-server=0
    3⤵
    PID:5128
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEADataManager.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEADataManager.exe"
  2⤵
  PID:2148
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=send --url="/intelligence/telemetry?customerId=1" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Summary\DataPost.json"
    3⤵
    PID:3272
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEATelemetry.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEATelemetry.exe" --telemetry_ids=0 --mode=record
  2⤵
  PID:2720
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAAlerts.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAAlerts.exe" --type=0
  2⤵
  PID:4812
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAEventTracer.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAEventTracer.exe" --conf_path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAEventTracer.json"
  2⤵
  PID:2600
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAPerfmon.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAPerfmon.exe" --conf_path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAPerfmon.json"
  2⤵
  PID:4180
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4852
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAScore.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAScore.exe" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\score_profiles"
  2⤵
  PID:1872
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEATelemetry.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEATelemetry.exe" --telemetry_ids=113,114,115,116,206,213,304,406,410,504,505,601,602,611,612,613,621,631 --telemetry_params=113:aggregationType:1,113:endTime:1785862953891,113:startTime:1785776553891,114:aggregationType:1,114:endTime:1785862953891,114:startTime:1785776553891,115:aggregationType:1,115:endTime:1785862953891,115:startTime:1785776553891,116:aggregationType:1,116:endTime:1785862953891,116:startTime:1785776553891,213:aggregationType:1,213:endTime:1785862953891,213:startTime:1785776553891,406:aggregationType:1,406:offset:604800000,410:aggregationType:1,410:offset:604800000,504:aggregationType:2,504:offset:604800000,505:aggregationType:2,505:offset:604800000,601:aggregationType:1,601:endTime:1785862953891,601:startTime:1785776553891,602:aggregationType:1,602:endTime:1785862953891,602:startTime:1785258153891,611:aggregationType:1,611:endTime:1785862953891,611:startTime:1785776553891,612:aggregationType:1,612:endTime:1785862953891,612:startTime:1785258153891,613:aggregationType:1,613:endTime:1785862953891,613:startTime:1785258153891,621:aggregationType:1,621:endTime:1785862953891,621:startTime:1785776553891,631:aggregationType:1,631:endTime:1785862953891,631:startTime:1785258153891 --mode=query
    3⤵
    PID:5104
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=send --url="/intelligence/telemetry?actionToCall=metricScores" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\FileUpload\EAScore\temp_1.json"
    3⤵
    PID:1296
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAScanner.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAScanner.exe" --scan_type=Disk --file_path=intelligence\diskspace/3-Disk.json --filter=1
  2⤵
  PID:1644
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAScanner.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAScanner.exe" --scan_type=Disk --file_path=intelligence\diskspace/2-Disk.json --filter=0
  2⤵
  PID:5364
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAScanner.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAScanner.exe" --scan_type=EventViewerQuery
  2⤵
  PID:3952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6040

C:\Windows\system32\drivers\DFMFilter.sys
C:\Windows\system32\drivers\DFMFilter.sys
1⤵
PID:4616

C:\Windows\system32\drivers\DRMFilter.sys
C:\Windows\system32\drivers\DRMFilter.sys
1⤵
PID:4916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p
1⤵
PID:3240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WManSvc
1⤵
PID:3340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p
1⤵
PID:3820

C:\Windows\system32\deviceenroller.exe
"C:\Windows\system32\deviceenroller.exe" /o "FCBC87C7-F079-4727-8CC0-5F30962CE3DF" /c
1⤵
PID:1272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s EntAppSvc
1⤵
PID:1444

C:\Windows\system32\DeviceEnroller.exe
C:\Windows\system32\deviceenroller.exe
1⤵
PID:4660

C:\Windows\system32\omadmclient.exe
C:\Windows\system32\omadmclient.exe
1⤵
PID:1544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e594f91.rbs

Path C:\Config.Msi\e594f91.rbs
Size 63KB
SHA256 4b7a1107a9d887d83b48f6195b4a3f431c0f7a27540a9fea141c4a7118b00b8c
MD5 bee943dcfd5d38ce16dea859dd9fab64
SHA1 14cd9a6d3186688ceeb490d16facd9feb30abec4
SHA512 a1277c53e0801b6ddfdd7086f469762aa5e911c629100b7a556c592da11554643ea0706f094cc4d776d7da0df346e526f900f596d6122c0398c9e3ae0da0fa7d
SSDEEP 768:DJcvw1oOjihMzYXyjDO+GLLtjD8OKqO6IjiNi64I5BVbx:W8oGihXUDO+EhWCYwbx
TLSH
T135538266DB26E2CBD1152AF63381AD1806098C7B66F0C47E13186D37C4DBB457EBF868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e594f97.rbs

Path C:\Config.Msi\e594f97.rbs
Size 546B
SHA256 22e9048eaed5dd4fee930da7968b2f23095384e0679946965982e750c4250575
MD5 a8b428e94a45058a41185784256c6d4f
SHA1 479fbe9ad7d89bd6eae252c1c519f320eedf7f3f
SHA512 c8b7e930f84c531aaa327d1dcda8b8a1ac75fe51f8b5f43fe13e4f4f570b6bf50ae1692ba6a1a53bf7718a15089d03a2da538ecdd0a061b11ad429cdfd3a5359
TLSH
T190F09E97F74C46F2D5A16A3B12030F22162BE57A919483752D4922346D2630A9EBA1CC
MD5 SHA1 SHA512 TLSH

Submit Download

client.p12

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
Size 1KB
SHA256 072cacb6bacf6bc4b9f8137e90678dd6829f8442324126c9c66b3683f562c16e
MD5 bd8bf8f3fbf2451142e8db7e01b870a1
SHA1 63f320a151089ece251db46b05d3ac3b5fb5c1bc
SHA512 0c8ac31e53faa48a8fd7e3185cb1f059c0e7f7fe318cb9483a5bd25ef48ab6d25c2c4f33efe530b6986893515541cd61a9074fb7feabc0c0bba879cfd6bffbd5
TLSH
T1B6217443027FC542BF3DDFB9444C9D56A198CB2369D5110FB67156828E205ACFE0B0B2
MD5 SHA1 SHA512 TLSH

Submit Download

7za.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
Size 839KB
SHA256 0c1874ed0b16b12d4adbb56a89a009a7647337fa509bc90ff00189d92dd46925
MD5 4d3c1bffc7d1cb8f9539d3d5856646e2
SHA1 c33c0a5de8dfb721024e8bf35884a0becc4c4041
SHA512 8e5f6eae54d3d8d936a73be54b3f9508191eaa4e4d8c72b80de6df666749fccfd3ed66d29a4af80bcf7364ed5ebe9afaf8cfcd598cb0e0d68bfeafe2b84d6ca1
SSDEEP 24576:+cyxh7By5I3a+m8H/v9rgC1zCjz/qNdChzDsa4X+we:+cU7Ssa+m09UAWzKRa0e
TLSH
T19F05AE127BE5D0BBD25211318B1DBBF691F993680B2448CB67808F5C7B319D1DA3AA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClientAuthHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
Size 3.1MB
SHA256 8f695827d5da38e3212f12a793d7edd812c988377e8d9dd705c0c05054c60eab
MD5 25373dbd9ee688b020e82bdee137d004
SHA1 ad2724eab9af8c5e3abcbbccc0e30fd066026262
SHA512 29807698c145cba23e442048fc8982afbb66da8fad448392e130eabc328eb81fa0f09b1aab67cad1fd1a28f6927e18180e0df8d52409a11960628e1f63d9f696
SSDEEP 49152:oBFbCjco4g+HbEiuNIRym0ez9KyVkQ1jGsAisPvEzUmoT4qG9Ad4vfqUhcFkF:qFb+cFEiumRzl4yVkGjGsbMXx4v
TLSH
T1F9E59E07FB87D1B1DD8E027811F69B7F4D3A8E148B24C9D39B9028AED8761D0563A36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UEMSAgentCryptoHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
Size 459KB
SHA256 164bbf4957fc038c81f91a9f524be23ba0efe669743c20a81a327a7a82772e37
MD5 bd6830ac847d73a6e7fa3546b2bdaef2
SHA1 0a6be17ab3bdd3e1b1b0f4b5bd4ffd735a5d5c62
SHA512 0c950f18bb25b92e256441cfe0479687252ec74a866c07975157f0d82148cf6ac9354460732e11658cfe1f71a9ca8e334b69f6d87637dd3be3106526b855ae42
SSDEEP 12288:TKaInplDFACLFsvMcJsUAKF/z5xG6U+w79:epnplZ7svgUJ7bs9
TLSH
T13FA48F117545C036D5BE11B10669AFB57ABDAE300FAA08CB93C85D3F4A741C27B36E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UEMSAgentHCHelper.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
Size 1.6MB
SHA256 4653b5fcf1a5b647730a61f8149bbf76ad25711dacc0e3d9aa5e2609499e389f
MD5 de5cf867faab8ddab246b2d05a35c10c
SHA1 9d5cc3592a4da9fe7ae7305a4b0efab918cc4b27
SHA512 a4e05dce500e9bef91258af547da77422cf5e7e7971fc22fa87529b65c7304da5bb06672a9ec72c2fe8e35cfb35671e589c3ff22f283aeb673b4949de88b57ae
SSDEEP 49152:pvbUARdxQ64B6ii+QC8M7lYPZPwDKOeSop:pvFRdSYZPwDKOQ
TLSH
T122756D317981C036F6A212B259BCBF755BECD5340B6505DB53D80E3E9BA02C36A31A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UEMSAgentHealthChecker_Temp.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker_Temp.exe
Size 567KB
SHA256 e6eab9dac5ce954d987fbcb833e00b4f9cee56f021395125abecd897d0e1c546
MD5 b74d111d45b9733a45a195c409335f19
SHA1 2198b9007524413cb8a4ff810fe845f1598d4ac0
SHA512 bbc19bb45a4c6a3b13435cbbc2c3319cc7ec257fed047ddfa34be7eb1dec01bb8428522e1b64879a115f413d17524b4340cf6166b8cc83becb41201640a8daf0
SSDEEP 12288:YOHP4P2qU1YYiavV6x9kkWVm9NaRM3DDjxdAyButi7:YOgP2qCLMWVm9GgDDj94i7
TLSH
T1C9C49D15F5409437E1A251F1497CEB78656DF9304BAF09C7B3C88E695A30AC3BB3263A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_binaries.7z

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
Size 22.2MB
SHA256 73156df8d0597b80590cff13fa813aacb98be09f56e5b92a68951453c1a3ed18
MD5 a117d7e51991c3ce45bee5f90d925fb7
SHA1 d95fdc821b6521d16ce02906d1e6fcd7bc099d0c
SHA512 1091fd12fab9401ffa4c0460c1434f7ceb5e2b4e4fb496222ee1b2bed2d350d3b8225a27608befe62cdaa65beb7b3503a563049fb614d1bbbd7f876e7801f477
SSDEEP 393216:zfsmnXorkeaEAzwUz3vnImQhKYMpyO+6/NduwjBln8LwOlFxKZwkdPrXgdYJdCqQ:zEmnXorNhd0vIhK5UWjAwyaZwkJriYJo
TLSH
T11B3733D50C9436B4C9837830A872CF5E606BCC511456EC203BDDEF6E2FBA625ADC76A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentregister.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
Size 244KB
SHA256 5795a796e0aad7012072372c05f9a078e050eb4e9107b67a8d696e63b252f1c8
MD5 9f9be678bcb37b3cc164f6c05484fb2c
SHA1 a9dac245fcb8ead402651f3b4c77e72a0a6c92fe
SHA512 e6e29a9c8508b7b10c7b6ff13b01de0a9f90d766f5c3d655575111f3e204ee344d3aac23a1342e673dac882686b93ce79f18cd1621145b5ec1a69172ae0a02ab
SSDEEP 6144:eYerSzjG+FvQlPDJiJ1MBlHBIKCKd7DJ0d:eyTFvoDJiLp7YI
TLSH
T157349E61B5D0C032D872143749B8DBB56A7DB9200B7699CF63984E7FDF302C29B31A5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentservice.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
Size 1.5MB
SHA256 32855e5a5b0c9aa3f86d049113a6c0b34f9eb16d888c952db9019ffea67a7d59
MD5 ab2f669d3962659567fa28407ce495c5
SHA1 0256585c6e592041145979fc6633743bbdcce332
SHA512 4bbbb56935ffdce4262ed5dfb8ab6c14828b1abc2eb4d7bb46a804a498728947b9ea9d3f490d36bb595cd0e420e5baa1627078f2074508de21007c2a03478da7
SSDEEP 24576:kTHbv2Ovm5DIi7aj+6ZuGlxfstEfVWptZ4LtYOF28wVHG36k4PtxKIyS9:++7aJDkiMtZqYG36K3S9
TLSH
T12B65B003B2428071D1A141F15A39ABB1EF7D9D680B65C4F3E3C46DBD05E0AE1A67E72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentupgrader_temp.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentupgrader_temp.exe
Size 6.2MB
SHA256 89a2df9972bc6dd36f7e4800341de07a3d81a0be52ba2b5a09042d075013c624
MD5 7ea61e516c101efaa2311b2d6c486ecc
SHA1 045fa0e415bcdd57f6a15a928ba941e86db90a00
SHA512 db66646fb2eb7e8f08d5068cba4c3967f3601ecd3aade2351783879a875f5f79c3a1ff80015b949e3b85dc44d463ee0adcb3f617c4efecc405c92755ee158d24
SSDEEP 98304:IFdefN5LWaq3PYE3iO72E8XL1fv4FH4TW/JYCV:IFdqN5i3wU72E8fAqMV
TLSH
T1CF66AE02B783C071EAD2027449B5BBBB197EEE104F35C6C7A3903A6D9C726C19937769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcstatusutil.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
Size 1.3MB
SHA256 beae6d45d0cc4e5550d6f9978b71abe90a04c7a64c05c4bc28095c28e3c2bb84
MD5 5bbc5ab7883d472450290757d7eb6243
SHA1 3c026d111ca4178e972bfc8d2b75b510b5a2106b
SHA512 f0416a064272fd847e813d7df934b670669841c8febbfaefdefbab0b2d380a22a8074b8cc6d1c7477515860f0a86d04110bd92c8bad7d24376968a83c8ff0388
SSDEEP 24576:EgZR70XTWGFRxNVI4uqnsLjjZNy74xIvDvyJWTo0YuiTNDbdDQdCYuzL8PtGif/y:DRCDVgqn4R074xIvDvyJWTo0YuiTNDbF
TLSH
T1AB55AF13B5428071D1A080F5592DEB71EB6D99780B71C8F3A3C9DABE01E12D2A73F65E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

global-meta-data.xml2164.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\global-meta-data.xml2164.tmp
Size 43KB
SHA256 3a454fba926cec93f8f407f0f7760251d8e1817240455cfa8fb5caab3b48d6de
MD5 b66cfc9673c2d6300dc027cfdb59ec29
SHA1 18dc4d21a6ac1640758cf8d5bac0beddc0917034
SHA512 7b1f9caa57c2237b3be6f8522406bc3b27a60c4a063edb7d99bb45c80552aa18e7d48d1872771309a8ce6cd22e767feb0cc6a76bf841b24a7d92b2a947d30d21
SSDEEP 768:JO8WQ03+vVJl1csxNnRG7xbPyyMmNgNxQk9kQNfH0ei0xMyzB1JyjEqeGaa:JO9xuvVJbcsxNnRqRrMmNgNxQk9vNfHs
TLSH
T13F1364E637C21A250591B1CE8BFD4F8162B7F7DF896A1BC830A06875931B6F73A47601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

quick-updates.json2460.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\quick-updates.json2460.tmp
Size 100KB
SHA256 2026ea1db35ba71a00c5c745b692b373ef43700db00ec3e546fb066ba88ca2e3
MD5 73b931ffb22a8494c777c9726693a5bb
SHA1 53bf2940f426d92ce4b35ba09229cf1a1d20144e
SHA512 de792417fec2a137117a863163fb9e11cabf21896a071e9c5e0c40d0da7946b928f748ce7170ec5c758e0efd509f227fab2065afe7625058be6a1750e272c938
SSDEEP 3072:TkvWRAryd8HF6TI5e3sNiS9gL2xEPq17QtC/0hmzo4llozmh9SLgxV8GB8q:TkvWRAryd8HF6TI5e3sNiS9gL2xEPq13
TLSH
T195A3AC1ADB60DE43A60AA6B150084C00322E13BBBD897FE4375E663C9F4D15F597E29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

component-details.json.gz2164.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-details.json.gz2164.tmp
Size 258KB
SHA256 f8c389b08a9a90da5b7e50efec3a310d50eb0c99b45abc7283e6145d64001295
MD5 e538e6a93bfb3553e6e1c6c81d554f6c
SHA1 c3e455c5dc67c6690700a976341eded56bc24557
SHA512 43faba8851641dcc094e0c3d8dd41a2b874bd11d8fe56b49392973094af4818fdd490d2c461f7f4ef0e9d8b5874c13f300b8bb292b9a35ca9246eab428882c68
SSDEEP 6144:66bb26gF2s9QZQks+LFgvaqIpcymPpJQK6FcKoA+LRZrrvNn:Bv2xy3s+L4avmRJQv+LRZrhn
TLSH
T1AB44230A5C19FFBFC4E40AE2EA9052F397C71C64A798CF27EA24D13B3C2516897844C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
Size 28KB
SHA256 c94170a5dc3bdc23b7597f4e17be2f4ea660dba2fc992071492bb16d0b0a7b3f
MD5 3032e0f27f4d8a8eae51171fcae76e3e
SHA1 6f052dc37f0e79a075da778bb7b3dc288c1030bc
SHA512 82ab58449198e4c728a592bff8810714a2ffb0b01bcd879f4fe3ee5380b5504bc3fe82416fae798379f7eca0603a25a44001109efcf5a4c39df838711036f103
SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fp1Tc1aHz82aEgEZ:0PY/kG
TLSH
T19ED24297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json.gz2164.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz2164.tmp
Size 2KB
SHA256 5cbc36ed2b88e9ecb6ad8d4d68c98cb191cf82807fc1092a1eb93cf34a0dd67f
MD5 2753952dbc7aa26752c1f36db853c800
SHA1 4ea38945bd0c241753f19d857687e7d084123e2f
SHA512 ae992e2c5d83e9eb7c27addc49701aafa5f0920de7c2c04b65e38c694150ac9e18391052bb047d8c0856152335877d95628c1dc2c03fd5ddd4bf242dd337ee55
TLSH
T154513B003C98BA73331A92966CE3AD1A4F33E2F0005D1968E9BE0D01438F17E3792F5A
MD5 SHA1 SHA512 TLSH

Submit Download

OSDetection.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
Size 15KB
SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
MD5 cf5799838289c42502297f17ca89b49b
SHA1 fedc0c8cfb1f9776e096511f8adcd0be5309ca8c
SHA512 98eb1c47b5d10093e202c6259ace58d2e7ef4957c20892fbd067eaf0c88baba994337c2f1bd802191a0e31ca2b3fee72508559acf54a4653b8c2544b440f7556
SSDEEP 96:q0SOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:q0BhBAO8b0Obx9nFLnnmI
TLSH
T19362D593A51D099F0222039999DF7AD3A1BC94384C7328FEF8C259256FDAC1923737B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent-settings.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml
Size 5KB
SHA256 23fdaac56354c3eb63117a21a63df996acd7afb51b85d335d1d5666a162ff4d5
MD5 94fcdf7e1968de08a08322484fbdd9a1
SHA1 9a3d30a47da6a25bb41049ec5aa65963ed3e02bd
SHA512 480e14ff36a8a819d7989e403536629f6c16ca050a5856b5122f6bb35e248f4b95128850e69c15eb3515d0f8ac2e82018350e1be6588630fb8ef5fbb2b4bd611
SSDEEP 96:CWdv4W+Ep6S4cVF6cNZcGRD8wjFbvsiNhSK/EAA:gUGHElZhvl/HzA
TLSH
T148B14110A0A28F6913B17B5C999AEA45CD160266360E1E05F02D39A70B3EFC23DB74F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

configuration-settings-dc-win10.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
Size 247KB
SHA256 4a84d8cc08ffa3e45d7e350550fd32d4a0416788eabe3fba77c8c2df2dc1fe6c
MD5 ff5c89c88fe59a341aa4fe80b6f58215
SHA1 82f86c6bde49bef92565d6f23e79f84bcdc14e20
SHA512 16f1a2208c4c9af43635c676a3e2cad98f8d4fcac0facb91cb3d5b9f5e144c45e42978454783abbadd3f29d3d3d02b9f1a455b0ca0f59cd21bcfeaf3a777a3dd
SSDEEP 768:HtMVQuZ14/++C1TFgSNwbEO6oHJfIb5+qXBi+kpWc2twcIugeIbMjnK8jUEAavAR:HtMzZZ1uSNABIpkIU1
TLSH
T1584417969DFEAC53A2D4091D8E921C087D9A4B874DC91CA035BC7BE4FF634C341A72B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

customer-meta-data.json3212.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json3212.tmp
Size 5KB
SHA256 4635369159dfdcba26389c6fb375f31ba295c7799d89d5d1892afb78b05d195d
MD5 927c3c311340e570640884c28765dacc
SHA1 bfb7997b3243ef8ce290d5c68f9abffd211b4edb
SHA512 0fe69e6cb2fd626a545a84d8f3a2e5fb6438fe44208f0d186465aa31714ef932dd061532b560fbe88c5c38eadfe013295df6ba6f66192cda03776752a946bce8
SSDEEP 48:YM8QDvAsv5Zhug4nP8NcReGFmtFwNgO+lt+v020p0bF07FgiDVSWDWYhv52h/VTr:6QDvAsv5ZhugmENcReGWiWW
TLSH
T1A5B1B3D4B1AF4CFD46C6F64A4D4EC06ABAA6F122F0E95C0C3749FC48CECA099B392514
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-framework.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
Size 413KB
SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
MD5 a450789f0d23503c895bafaed3d4be27
SHA1 459cfaa1cae6090bb8d98b75452e54a3d85f42e5
SHA512 4d2983551e8de9a883ca7efcf555c5a5e83d32a17fcdabdcc36db7ee16c8b895d2b593b4717cc5fe476b9d9ca7ccbcbdd50aa453a5decbd844beeaa05718892d
SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZnxFYYh:6fufQiiNJY7tYFSYh
TLSH
T13694B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-onpremise.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
Size 109KB
SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
MD5 b39316c180a11c7cbefd08019ad9c97d
SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
TLSH
T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
Size 1.6MB
SHA256 9bb5a846f684955701902ab6779cde226f4a0248ce81e0b7adf309fa90ee164e
MD5 90b4360ad2575910355760e6d5f56ac9
SHA1 ece2466ad3d9483004826300858c346e6143f763
SHA512 658bd567e8855c94f6d8c507165d3aaf58f45397254456c889c073823c29828f977c8f40e5b55430a4795017bc327d835922a592a8575ccb6cd1718f7353ead8
SSDEEP 49152:pIvq3iwEiiWbHTKRU0YCNDZK+/0KLEDKtKzK5xFKOQFKNoDKlW83wKFC+KFE20:2vqSwE1WbHTKi0YChZK+/0KLEDKtKzKd
TLSH
T12B75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dynamic-variables.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\dynamic-variables.xml
Size 28KB
SHA256 6df9a28cfd8d76f1e41e6f9fcdf28eb8fa3b5a5d67015ba51fdf1c76980bde1d
MD5 889d10168a96d01a40af825a606ffbe8
SHA1 d1a75fea9d9aedd31dd581b8cdf7b45791d790d8
SHA512 4536452db3e0d32cc7129bab4180a509b71d5affa0fb98599cf7ae4d21671cce0fcb7335cc891a0ce247de2a6674197f6ba74409a14b6bfc15a7a03d1511b90b
SSDEEP 768:LXRI9jcxa3qsbOFtm60CVmqPC21XxmYOXNe/pR71KRa2GG4q+V5No5hVMKD4idqH:LXRI9jcxa3qsbOFtm60CVmqPC21XxmYL
TLSH
T10AD2753E61A0FC4CBAD0E85C14CC8A188855D313518D7AF1FBE84F2E0BA59A5525FDFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

inv-common-settings.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\inv-common-settings.xml
Size 681B
SHA256 6981dd03ed27e0725434188b064f52b9f6dd9150466c073caf5e956d440c7bbc
MD5 27c3503bab0053d7735d9b3d091ce176
SHA1 4b6140a02dd0c2e6ecf699baa6291298ad211f60
SHA512 aba73b4d744d8a14c2fc6874ed445eaa88c51be597cd9e244a92e13a56927534fe58d799d4cf4bfe11ff4b768f7d3e86147b5027f35136150930f0f23a6c3b7b
TLSH
T16901192469869C9013F4FBC1A68CEC515C695297330F2EA4B1B07E5206BEF872A3B4D6
MD5 SHA1 SHA512 TLSH

Submit Download

dcagent.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
Size 4.6MB
SHA256 91b4a18435bde1fca37bc214c9a1b74c0b653a0a9792723e58c042b47829aa31
MD5 0f74097f3f1ac3007bbc0f1445a0a1bf
SHA1 2e47ac7cc0c35c4cea44d203e7cea068a320df6e
SHA512 98f00e7c7759f656c4bc108401443c8e6a698e0fd3e4cc89bcc9aebd8c11651823da23bac367c214c7b5e73cc3be25236635a69095a263b1ef4c7b1c24f52f66
SSDEEP 98304:CC0ZuLHjD4zWjvw/QrbgI1MAR8lsjqJ6piAP7mThgpIZQBNyytp49Sl/:CCP7jMzWjvw/QrbgI1MAR8lsjqJ6piAf
TLSH
T18726CF13BB43D070DD9E01B855BA9B7B5D3D8A244B30C8E3A7D068AD88A24D1673F76D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato.woff

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
Size 36KB
SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
MD5 171937a8fad6a1c8a37344d09d4fc20c
SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
TLSH
T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcmsghandler.ico

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico
Size 14KB
SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
MD5 3f93e0ea97079b1f5b356166db334740
SHA1 ea3022d31459c8904df1e8f406741960fe9ce653
SHA512 24584bb387c1981ac08f4266f7312444ee922486f1d20a3d9f655df09048e347c8c2df8be64e3ec99b8d603e4e088296a2abb3e68fc2e85eb5431efba3971c36
SSDEEP 384:1w////ncRy/wUwRRR0RRZRXUuPPPPPP3opSLhRRwyRRWFRRyRDRRjRRRRRKRRRR+:5C
TLSH
T182624886C4054ACDCADA9B33C6EE56BF8A9508B88007504503FC3DF5EB53B19FE6A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drop_down_icon.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
Size 449B
SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
MD5 60bd20b51eb0483e93aa6f4cb0a84288
SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
TLSH
T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
MD5 SHA1 SHA512 TLSH

Submit Download

info.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
Size 2KB
SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
MD5 d4893659007e98de701a47cd39991be3
SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
TLSH
T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
MD5 SHA1 SHA512 TLSH

Submit Download

minimize_icon.svg

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
Size 161B
SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
MD5 10006715631c28cd1cca4302987b6371
SHA1 6a69a91b69b7cf310bbb4295496d3314211de6f9
SHA512 6c43259b84e93b7ed9d6a7202fde26482b934bc8fc67f6963e55788a8cbb08116535b266c07821bb2835058102baf3831d838fff00efc84e9cbc57fd881cc0e5
TLSH
T19DC08C26C2ACCB594322C6B0AA28A220946E4092A884D0A595E34B245173872FD8D8DA
MD5 SHA1 SHA512 TLSH

Submit Download

ECHttpHandler.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ECHttpHandler.log
Size 70KB
SHA256 8ac3750680f13862aa51f24fd89b13d721d20481da20ccbfecc5e26979f4c2af
MD5 c20c38700f45b83889ec5e69bf0469b3
SHA1 8c10b1f432247dc18336a1ff395d8e993ac16ad2
SHA512 08e927777786490112f46e5cdff3494ffb42a766684d6831eaec6f982d079e0f5dc434b68535a2c59b9bbc0cf5646b448953bfdae8e4a5b104de0f224bca4ab4
SSDEEP 384:51VQGffDQiw3SvBwlYIZMLiSAnVKyK2o6XpTTxTzTEt6WWqXenltbxLVKM6btX2k:xwQ4451j4TEsbtdapZsNNs
TLSH
T1D7638A126B9D74948F2F299D8A045BC3A98BB5150843BC11BBFCF8957FED9405F2EC28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EAHttpHandler.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\EndpointIntelligence\EAHttpHandler.log
Size 8KB
SHA256 0527729aacfa8f363a3983b4873f03095fdf28b7c5193c95e09b58f0b5511d28
MD5 576bf6c2e96ded41fcab27cef08c1d1e
SHA1 2a131d4af3ed89eba4ccbcce3e97d56370768d57
SHA512 4d908db8f2368be4ab360dd21eb288fe5d1ce25e03c911de68e3af6bb532fe29cb95624f136ce423b4da83ff978d22cdc4b91481130903db149b0891022b1fa1
SSDEEP 192:jMEWMkM7CXMDMwMEaM5M7cMKMRMEKMXM7UMGMVMEBMNM7MMYMcMEGMiM7dXMsMM4:v17ADmzvo7jwB9lFh
TLSH
T1C802FE8B878B42955B2F24AF73053F563B03B5195AE89CB233BA41BF78D591037A9037
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network_Connection.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
Size 436B
SHA256 707ed0fb5489a31c01befcf229a71fe0dc099c1aea12774945978af8209f1aa3
MD5 34d378fe9326fd472c730ed5c3f88466
SHA1 d1f4fe17b83f64db33538b81a65564a8dc9c2969
SHA512 f37b0e2498bc1da83d4b9c869c4eef71253931734c171273c60cfb8db529a155f9416358f705ec89f6d73509890cc819019977e21efda9d1243b1cf726cbaaef
TLSH
T12DE0E576E1F548E8787BE09C0F48583BBC1E079461C48BA03296C134D09344B60E0BF3
MD5 SHA1 SHA512 TLSH

Submit Download

Network_Connection.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
Size 1KB
SHA256 ef7a20580e014777a2416e4c9d114974e1d4cfe240ed1b25660c02a308cabe24
MD5 8f35921b132035ffea53ef1b6c8d5e1e
SHA1 5fde202d6968b72ce80ac0c1e22f9373ca657fc0
SHA512 2eeaa7477065e56dc46f706f96184198dcdf2fb8d9f8628e495e0b6bd1addbf90bfa63621b874ffda840f1503069f52722c1666de901ce99aff0a738b8c2700c
TLSH
T1E921E133E2F41CFD7D6FA44D1E48583BFD5E076A16804A903286D235606719BA1F17A3
MD5 SHA1 SHA512 TLSH

Submit Download

UEMSAgentHCHelper.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UEMSAgentHCHelper.log
Size 560B
SHA256 2248f6f20a11208368a97719916c895a16900e39f93a58ace2f26280a020a30e
MD5 1a8a1e81958bd5be7b279c6578924fe6
SHA1 56689c95c521a469ea1ce019391e59edf4518371
SHA512 5280e7c24683d755624598b3776dc4f08085803d1bc8e913364c07761fa70c203dcf7cef6ef34acc66816facf2a30e2d0350fc264d1a261df66759d04b8cf649
TLSH
T167F01D4B199C70FB1E86158F898E7E8C4B4EF6738C496D28AFA0D49438C3D149DA2E08
MD5 SHA1 SHA512 TLSH

Submit Download

UEMSAgentHCHelper.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UEMSAgentHCHelper.log
Size 862B
SHA256 8dedd4eeb79fe054d0f1010c8ecbcebd4cce8b140fe15dc1b94f3d3470c4d9e7
MD5 d83e8f8b9c1a82d4434a8b8c7c4ebacf
SHA1 e221d46ffb4c592906e45f8a82d8601f4c331679
SHA512 95f5437e134c374779e98eb7bc167e4418c541863cdb7220192dbe0705205f6bde2b98d1b70fde0b9918f5fd6566b2e44c81c10f100058bb00b3c14788ea34dd
TLSH
T182113C4B199C74FB1E42158B899E7E8C4B4EF7738C496D28EFA0C49838C3E145DA2D08
MD5 SHA1 SHA512 TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 1KB
SHA256 ec66ab14495f264c61908b650844d57f636d2eb010c362cb0f9fbb4fbcf2118e
MD5 f94f37644cb712d069f483159d2c0be4
SHA1 0e33748e5cce08523f1fd5e79a31c5ffa4433e26
SHA512 f0d95092126e8f41075b726d74d60e0dc575878860233ea22816f5faa4e9475c972b50e3595538dc04e2709c95bf3abd013c821cd442807e162e6ae65e3a76c8
TLSH
T10C11D8038DCCC9C6DE89D73BA7A09C42E081011719AFB8BA37AE11D89395504FEED69C
MD5 SHA1 SHA512 TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 3KB
SHA256 9928ec70114f8cb5363171809a7bc746c2c647810d7944ae0409750f5b647ffc
MD5 8069fa62dcbe38d2f429001b3a5e061b
SHA1 a7fd89c9b10565dfdda7e4d50d52bd4fc7a3eaa7
SHA512 ceee2649f3178e82c980247d90acbbf8baa6b1bd4f27e1a00a24b87a3f54730e277d05779f65f9b6ff9493feb41cba28710d94992f9349498ec7c29c97810bf9
TLSH
T17471A6035DCCCDC6DE4EDB2B9768DC45608001271ABFA8BA766E10D86752904FFEE65C
MD5 SHA1 SHA512 TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 3KB
SHA256 b4827c0001d86ab2e70fe19fac59c82d282c6b577db29d87a7813a8f2e6cc9aa
MD5 1a87b7622bd1f56dc8e95d22e815d139
SHA1 c28719111a6383f2ffc394830403c205510e4a54
SHA512 9df9edccb6cbe61247ca4f23e785c7d3538a2b2bacd51640f6e8a267efecf1d41c06a476ed25a0aa6e723e7818daf532bbac9a84b4082437e164ea7e85f5fad5
TLSH
T1E281D7035DCCCDC6DA4EDB2BD7589C45608001171ABFA8BA766E10D86352804FFEE65C
MD5 SHA1 SHA512 TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 5KB
SHA256 6f972195994d197fdd5b2111b2fffb354142d38955ce6c5c1989e988f8faae33
MD5 f8f0c92dd24ffc9e5b2629f834308b14
SHA1 b522f0772a1c1f0e7d1b64582382f8b5c13b7505
SHA512 6ff614fe3226774738044c7a1b9982fcfe792af4ebcda564cbafc6d525d889ed5eefa8f11b4d552247caabf1130192f47a325670b0762952b9c7317311841926
SSDEEP 96:eY0ItyXOuXSXn8XSXnOuhMkXRXoaHeXRXoAXRXoAXRXoAXY:90ItyXtXSX8XSXzXRXWXRXVXRXVXRXVo
TLSH
T199B1E6035DCCCDC6DA4EEB2BD7589C456080015717BFA8BA762E11D8A3A2804FFED65C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentinstaller.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
Size 7KB
SHA256 9db7e37b0c1531ffdd324fe40f4c2dc8b1bf7864661ce3f4099809242cf8dcc8
MD5 3b9bc1769825e178960f1f4885757a0a
SHA1 c8869ee10eb6cbb01d600bb65bdbd7092aabe336
SHA512 be58be7acddbda3e14194e5b2f701e8b2c9c6952f9087d19f54dd80547792a48b4b4540e2d5ead20705173fad62c736b0b4d8fe53bbb277e3948ad98cecca0d4
SSDEEP 192:tBUzZDEqj8nOnO6O8ON5OwO55Hhneh8qON5Ohjj1CC1BcexCa7t447qCrDirZrRH:/UzZDwaz5+X66+FFGk
TLSH
T1FCF160123AD870D66F724B8F958027D66B8FB5684C437C7EF778B4C029A8C1B5E5D828
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentinstaller.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
Size 12KB
SHA256 ffa243062cf5a5d53a6da4b860f46a15b4ec2a57da4fd3adfea077cb45cc0e54
MD5 936312a7c866d2a9863cb821244a5bef
SHA1 c0f9c386c9e05737f20351351f47977089ddb212
SHA512 8a6885605bbca758fb1684dc38cc53e8d9db2c571aa536a7fc02de878fe6a4b4bb55f21c79f5fe81fb33f4eb3a28cb003eba43481c159d4941370135ecd87572
SSDEEP 192:tBUzZDEqj8nOnO6O8ON5OwO55Hhneh8qON5Ohjj1CC1BcexCa7t447qCrDirZrRe:/UzZDwaz5+X66+FFG1/
TLSH
T116425B133ED870E66F665B8FA58017D76B8FB52808537C79B778B4C02DA8C162E4E858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dccomponentregister.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dccomponentregister.log
Size 31KB
SHA256 03c3bb2b2dff51f862778b8a5453485ae9397a119ae2484e1e0d2eff2eddf185
MD5 c03677e992bd46f44e1a24ded1bdbe79
SHA1 892768c23fd4e67a27dee5f05ad2add670d4eaf0
SHA512 c59d257815f628f418cdfa7a61c0f7fd59fe0e858023ad85416169052809d68e18930c3437cd34891a0491fd2bbbf8715ec79781c94ae0a64f546f73268c1a68
SSDEEP 768:FrRzEE+x+5J+tdA1rrzf4uCSp9VERDrd1ajq:L+x+5J+td1ajq
TLSH
T132E26B012B6E30A46FAF198FAB041B97488B751C4DA36C50B7BCF8D06FED4165F6D868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcdriver.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdriver.log
Size 12KB
SHA256 4744790ef5ec9b1011a8460000ca1c038627cbfc8ff960196982f8def16f1df7
MD5 f92829c550bd8e81e8b5c8a62c608897
SHA1 f9e884c2e79695451054d9503dad02c901a4fcf2
SHA512 c9e8d9c746f324740416ae9e1731d569180520e72fc7e624b6a67591716fd9a0b5bbba9601872142cce65aa863e64bc308e0c8ab71f4ebb21889db4c6be40814
SSDEEP 96:oAS2tUb1/uKJ/Y/ES2tUbp/uKJ/Y/rSuSRo1mx/NPJ/5/1SRo1mF/NPJ/5/iSI:m1gN1g+XB+XBS
TLSH
T177429506D5EE14FE4FAA395E80036FA6DA83F6381C40DD16FBB088557CDEC281D6E958
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcpatchcpu.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcpu.log
Size 256B
SHA256 2051ca9e46eaffcd9a5751b20df4189c74ea860526d04765722234c5a32bd678
MD5 d0035835a97090e55c95278bf4ae0cce
SHA1 158dfecfee24e4b5577748a6975b0601e27d8518
SHA512 9174b33dfa5bd688107b0c30618941684df695d6dc023171cb4a7b6ffff5cbf09fb561f016307f9f2627ab3d7dacb8c28f1e4a1607e451dc69c1aff1c9ccd758
TLSH
T12FD0C70A782960001CE127232D12E78892486B202361E02E7725B02653E3EDF3726C08
MD5 SHA1 SHA512 TLSH

Submit Download

dcrotatelog.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
Size 29KB
SHA256 a90175e616168cc240dfa3b9b3c917833163938d32e8a316323e26b8abb86d0b
MD5 5c549a3273766480b52dffb6fa2cdd83
SHA1 9af22f0fda80e67dce7c73b21260826fb6f6d216
SHA512 833718bbdaf21135ddc43d2efda1162c719162925910531f0ad79c7cab5fbd7ba165ea0f48839dffb81a86e5fbd25f42558165112efa38e3f47605abfd2fadd5
SSDEEP 192:4jvCTvIGz8B72Zsnzz7O6/gou3+kjTktLgmVtCZyJtLd0WhqI79LFsG+eSK3kSdQ:caTwd+T8L2qR2Heunn
TLSH
T1AAD2D1012E9C58F95B2F4669AB492B53810EFE690053ED71EBB6DCE478E8C114DCE89C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcrotatelog.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
Size 28KB
SHA256 0f8824dcf5d562dfc2e11dfeec978175d8b0bbed269fb21bd5c41753bf369e8b
MD5 ac23306d915a87d0efde19102ad2751e
SHA1 f10c3274f3cbc9030e24eb87d6b1d39864ee721c
SHA512 cb58637c3f49ddcd83610b84ddfd22a3fd4dd7c52c2a957388fd647f1a8187317b4239a3d0eb9098f26d2f3df1808f64c69d1c3b182f773f1cb001510a49631a
SSDEEP 192:ExVCRVIurEBzSp8bTnPOqjAUSRU2jR2tDoWVnORWVtvZYCtG4JRxjsyo6QKfSQd6:2sRCJUR6hoiX6u9m
TLSH
T17AD2D201AFBC54B59F3F755CAB4C37A3A40AFD490083E911BBF668B465F88028D4E85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcrotatelog.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
Size 649B
SHA256 a31bbeeac3f248dcb30b8c15fb9371266195811b0d2e9d626408aadcf7005299
MD5 b757f44371e5dbc98eea1ffaada11b63
SHA1 8cc574762fb4edf259d55aaf8442f1d3d74eee19
SHA512 2c51c89340ccaaac7cbc872b5df1da07eaa96d2185e4869c3576cc6daf0e7e492668feed65a9a390e172e28848121e5c969be1d2c6db3ff7c0dfa1cf078f5025
TLSH
T1D5F08102399C61F26F67878FAB041BB2F386F9304436FC75A379E4C41CA4C121E5E429
MD5 SHA1 SHA512 TLSH

Submit Download

ecdatatransfer_access.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log
Size 5KB
SHA256 df60ae34b2b9c38e3066b1cdd3570d2bc91cd98f321a24a67ff608766764319e
MD5 6825880a9385fe2da14674776cc39604
SHA1 5992f8043d2535c71d42b7d0b8729cc0cbe68bfb
SHA512 f5b6b082e60c5928f8a0527393c4ea5a598b4187c4e31ac8b33ccda6591b4f5785c5a05bf920d4e5a178586f4d964747f323726f650814a666805106a41d59f6
SSDEEP 96:uIv423VAWZ2bDwwelzf/oJcEGB8SqRMTU3aAinIKD1IKo2bE2bPAr:uIv7AWCcwq/oclB5pUeIKDiKZVIr
TLSH
T1BBC1EF1E4784B8F59B295217714A9C04C846F82FE8F4BE39F9604C59CEE678BE2B0F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

meaaphelper.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\meaaphelper.log
Size 18KB
SHA256 69c4b7441ee987ecbcfe4400eff4ba668bed733223cf0c4087657085dfeb0641
MD5 bb7a0af8b8159ba5bf64db18f489fca7
SHA1 179c07c1883c6ab9ffa71f71595d905bd1b78047
SHA512 06732db5bab1c99db8beff594b1d7a2bc0867543cee73c8def6e22b2c5b31ec69423ced2a6732286532697e7cbfff1bd40f3678b1688eb073902c406a3135908
SSDEEP 192:67H8oBc305pIAEuzVi7c79i7c57i7xDAEusE+TGUYSeioBU05pHAEutKife9ifOu:jPEnyM7ZnfVBPnWb
TLSH
T165829C815E2E6DD22B57EB9F57001FC7C047B55C09935C01B3ACB8A06EAE4266B3E47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ues_BitLockerToGoRecKeyScan.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_BitLockerToGoRecKeyScan.log
Size 893B
SHA256 6f3f46bc7ceca106640cc1c845fbb98e63b64c9be23434d39f0bd0df825325b2
MD5 54ed69923b74612d6c70ea888d4eec68
SHA1 516e85796d7f83d5cb8e20743c8b89d5910df115
SHA512 e873999e318b928530a9a687a25e7a8d3f9bfd51742de8e3d789cfbb7b8c48ad29b5c5bd603f093e5d900b0a8f4430eb08fe6a877b298baf5373354ad121061b
TLSH
T17C11869251FCA602340FB69FA3149B3437983C92245648C9F0DDF885FBBAD6735EE045
MD5 SHA1 SHA512 TLSH

Submit Download

ues_BitLockerToGoRecKeyScan.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_BitLockerToGoRecKeyScan.log
Size 1KB
SHA256 26ec8f3477e284efb4cc28f9920962ec1ccb7034124d3a8fe8f61a7f5e0af562
MD5 2d1a1f092a7818afcadf34944e2e0f8b
SHA1 31576595ca138ae3eb49a56405bbb11b72c17130
SHA512 5fa4d77d4090d731a7e86b955116d7d684217729ea63b608c29c7b28e31da9eadc70a65ebff074391818379c66bb31dd0c18d8295311684a54d44c42c2b302e6
TLSH
T13031C95294FCA646350F728ED3209B293B983C52648748CDB0CDF485BFBAD6B38EA441
MD5 SHA1 SHA512 TLSH

Submit Download

ues_BitLockerToGoRecKeyScan.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_BitLockerToGoRecKeyScan.log
Size 2KB
SHA256 64eafbfb53498fe7a2e6761128172fca815985d46b0fc127363bb714bb893617
MD5 abfecc37b16afb9a3dd2b7a2729ad446
SHA1 dad4e084f3f7802de74153433c39754f30afb2e6
SHA512 96bd9e1b1317ece50abc916202296393bee20ab5d7c847710084b29ed95b6bab50dc76d2b116e9bfd1a4ca419d67c9797efdecf80959afc8da2e4c54e624e2c5
TLSH
T13F511B9294BCA645750F714ED324AF293B983C92A4CB48DDB1CDF484BB77C5B38EA441
MD5 SHA1 SHA512 TLSH

Submit Download

ues_BitLockerToGoRecKeyScan.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_BitLockerToGoRecKeyScan.log
Size 5KB
SHA256 57f1f6cfd94a80958f7ce474ecc099a98c38428c1307b2072cf0434ba75de308
MD5 b94ad2a03e7af510cc8b2096e5703459
SHA1 3ae6d7b3c642ff397e017b91d01a1a9ef0fd01a0
SHA512 039efe6bba6f2fe5d160c40e7fc6d2a68233c822b8ec80c03c4560cbbb215c80501778ddadbc6a13b177596185e462ddea1e5e08efef5fdab64afffeaad9d1a3
SSDEEP 96:42ciZSdCBzTEEYrx/w3onxyOQASbMBMhMiyOQu0EqDvYeVTOiqpt:42zSdCBzTEDl/wshSba8hADvYkCiqpt
TLSH
T148B15B9258B8A251340F719FD3149B183BA83DA6A4970CDDB4EEE4C4F767C2738FA445
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ues_BitLockerToGoVolScan.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_BitLockerToGoVolScan.log
Size 889B
SHA256 37da68824d643a1799f066f62310eebf13366d1cf9af7f33762cb7a16722f10d
MD5 b5cc99e01b21a05254268a37c03d786c
SHA1 884d65e3ac2e0c257707c457812118c0a2a310cd
SHA512 4b6e3be65fb3b9c043d44596b424c316410d7cbbffff19eeceff625300736c0f940d47f57a08329f0433225a221adc103a9ea5c4ccb3aee0949d0897269f5337
TLSH
T19011A36262B82282540B768D83005B3077D8769675221C09F2DEF8C6F7E2D6639FA175
MD5 SHA1 SHA512 TLSH

Submit Download

ues_BitLockerToGoVolScan.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_BitLockerToGoVolScan.log
Size 1KB
SHA256 13bab63ac14143c3ba675716b01e9ba3e3d8b9863da77ce35fbf0169e9f8d2f1
MD5 4a36cd92942bceeb53729559787a7a5f
SHA1 2cf1033b4b067c53727ec1371d5b5e7184c1b6e1
SHA512 a9355dcd1c8045e344d2c412755e2889eda07496aac68c24e8c5632e6c993b90dc0f91e9bc87c84177773de14404bd9f15b847e2e35792c0d9bdd8e671dcb00b
TLSH
T13431C562A57C2246650B758DC3005B247BD43A5AB5531C0DF2DEF8C5B7F2C2B38FA561
MD5 SHA1 SHA512 TLSH

Submit Download

ues_BitLockerToGoVolScan.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_BitLockerToGoVolScan.log
Size 2KB
SHA256 12af5eadd4897e85149e86c12e161bc6e8a49714a52b3dd1a9a09742536ea3dd
MD5 702a588d4a325258dcd40d82b4b59772
SHA1 b51cb9a1aa5f9c1c36c2ae3c6ae073e0bf0deebe
SHA512 69217ce4ec0e3ea4ac2af86c52feb57004714b924e2eb3ef383ae1f0c572f667337bfa397e3fc05aa0b3ae8be27ed7d8691502cbebc305b7e7574ef7fa5d5aa2
TLSH
T15B510752A57C2246650B715D83006F243BD43A9AB5935C1CF2DEF8C5B7F2C1B38FA561
MD5 SHA1 SHA512 TLSH

Submit Download

setAppPermission_Internal.bat

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
Size 957B
SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
MD5 e300d6f5c088aee55f0b91f4efc72035
SHA1 97d081d6ea84780f8f556cc6dde8dadd10f09e63
SHA512 366f99f7c3387c5b45daf7d3875ddc246ed00d49bb846b5e21dcf3208b910a65d56cce5a211e13a8f10c698d44b4a814069b6ca06fb28a8614dbfdaf952bdea2
TLSH
T14611DC1EF610053C09AE7AD47BB00D66BA29E0E770151A5E3E06135DDF84A80BFB53DB
MD5 SHA1 SHA512 TLSH

Submit Download

DMRootCA-Server.crt

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
Size 1KB
SHA256 79271d822d196e6160f761321206154a1497b22ffcf4d66a8082c9bed0bb781e
MD5 3382c86ad9af9a4f64728a946d8dfe9b
SHA1 71c1b26f0234730d19fb720522b55f635eb5b763
SHA512 1ba4eac616ace083e5051ea75f1d66ef88c9c4298aa31c22fe3dc333c176132d2b62ca9f080db22914d51a2837efa9016b59e20f238e882a15f3d82e044f1585
TLSH
T10A21EBA04F8118319877E2E4D4B7D59DF4911F1A5EDD676605F37D00B6D24A00BBC8D3
MD5 SHA1 SHA512 TLSH

Submit Download

DMRootCA.crt

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
Size 1KB
SHA256 0c09b7c678a92ad47ff7cbb93110dd2963097ec2447d897cd64b6cfbd5f7a11b
MD5 719d5de9ccf1280f0815fbc3b21a059f
SHA1 8e8ed72f61d8ee6ed9c280762d83a0b270ff981a
SHA512 9daf6959869c22ea6f0a3025e989391c330816d36bc4e13938175aed48181cbd4777c9706fc26f4c560e7eab9ff3834c2cc615f3ec0d19e691a5987aed234ae2
TLSH
T1CA21C6866C186068BED7DACCC95EB9216C410222DEE277EBA8367E0BD4C644027AC4D4
MD5 SHA1 SHA512 TLSH

Submit Download

DCAgentServerInfo.json

Path C:\ProgramData\7E40E0951F3A4D95887\DCAgentServerInfo.json
Size 4KB
SHA256 7c418c459393584ee6437ada9a060ea3256dac94a0bec680400e4aabe5a95146
MD5 d07f38363b976e9105a1285be83c0a3a
SHA1 bdd51b79319ce84cf67aa99aee2bf2f112fd36ca
SHA512 8a112104247867cdc414320c128c90b9c0686ba19468d1b7055d448de9ebcea8b65521f32282bfcdfa5347918daec438f14ae3508fc42be193c43f42f4fa12c1
SSDEEP 96:vb0moO4iW6Jv08OE8RBkjve4RYMbj9YITotG2UkdvZYpLlX4YAolYPUwitkDE:v4xO4iRJv08580LdYftG2/3Y0YAo6TiR
TLSH
T141A13AE2CA473D791FCBC18CCE66B8A7649801145FD6235649FA7E48F8D910003AD8F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UEMSAgent.mst

Path C:\ProgramData\7E40E0951F3A4D95887\UEMSAgent.mst
Size 20KB
SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
MD5 0273976d2ecf588a5514b0f5069968e5
SHA1 b906399f51bffff670d20c5f5d66800a78b1e638
SHA512 da06fe4cf771c3a4840ced5b95a421cbec98023766d0d382b44798fefdf04f794119d3c17eb2165f35df1745bf3ffad600af10b7f89cce24f788a57f6e67a809
SSDEEP 24:J+U2p5gxBuP2xjl/Zd8pJPSgHiHJoxIzxhK:IU2p4gI7dyJaz
TLSH
T109927202FBA1EA16D0490A358E96C3DC0B36FC81DD42836B35E6776FBD721C54D62AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.zip

Path C:\ProgramData\setup.zip
Size 50.0MB
SHA256 d4252da8242cf44ecfaad45a78a350fe602613a8c38eaa36812a6eaac4bb7e6a
MD5 f4e927c6d954ea37d60ed4660b406ded
SHA1 7b41b80c5fcdd6011cb857e08e0f1bf9fde4fa9a
SHA512 2c0717e3be94087d269ce2c3754e0e4294f7544f64c0a920409e1bd9fd1d3e0a68e50554d65383137e826e66fb3e85f9bc70673baa184db56a0836d245257213
SSDEEP 1572864:ZhIo2Q3LnaB9YF4nvhB1QcGvUfxyx2L9MTE6l98O:rZBG9YF4nvRXxyxY9MTN9r
TLSH
T178B733D60C696BB2FED73A24A82B8E4FD2329D9060919C92377CCF2D3551B166BD7090
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_volume.PNF

Path C:\Windows\INF\c_volume.PNF
Size 4KB
SHA256 f96da3374c24c3ce1f98ffb8592521e55a41032f54c95d7b7019d7dbaecf8473
MD5 9dd0eec7c752bb1591bc2fb4ec33c02f
SHA1 4e460139b5a3feda7b9e6d383636792b9d3b2a82
SHA512 019a377658ffbc74f945b078a86b3b157e0612b42006d1414013a3cd0109c9c5495b05840cea1be398aa05bf02812fc55d07eb0d29873e7484adb5a085708669
SSDEEP 48:FQ9AgrNDt7/Wyki5m6MRu3owYWeaIDbsRbXcVMRTplqEEt45a/U:FQ93rht7/Wy3owY0usNXl3OKP
TLSH
T128A14445B7E88E24F27A9935BCF060E64266BC924C15DA5F3384730D5CB3794E7B071A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI54BD.tmp

Path C:\Windows\Installer\MSI54BD.tmp
Size 409KB
SHA256 73dc5ff1e4368071d6ff9bdd1581f222fa1a8ef5ed2e6dd7ce748771fcde2727
MD5 02782cff038ce43bb7bb143d90c6f927
SHA1 ab977ce0342ad7f66456e51a91ac17406800c8e6
SHA512 8a042ca56a4cacc174f9a7be4906e9a7c65961a3f467edd6cf0c9957348e5f0e0ecb03aa9fb5a2e7b934dd47c620e06d6dde3b0a17a9b9d82aef422f8824c780
SSDEEP 6144:YkZl0m+q1LyPMY/iWu7E+RRJ4Kq0bGSQWpz17CVt0AT61wNHeZ/AfOP0duIM+L01:YK0m+qIMUv0bGSQWeRfSeXMl
TLSH
T16794AE1175C48031E56F11315A789F726A7DFE704F6898CBE3C8886F0E645C2EB36E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagenttrayicon.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log
Size 36KB
SHA256 b362ee1126a2fe11a9b5a9a7fb45d8fc4903696a44ac5010ca6ee58f5b940ecf
MD5 3dff643b46cf34ffe3afb456b27d7261
SHA1 a168da2939ff222b72abd56ea176f7f77d94b5b9
SHA512 2673e4575d6ac232b00b1b9fc5c076e79b38b03c66dac07eb241ded6eb1877e4457ec62b6b92b05fca4dfed3239c0e44e5aedb31c9c23d91a58f311ca25b3dbc
SSDEEP 384:/+e8Lvvr4SYX7btPmmgWDRqLr7zzzbc2IuMsq/MM4QdfRtNjcRRhwQO9:oYPR2IffuO9
TLSH
T1C6F204266FAD29E45B6B298D96459BC39547F5580883FC00F3FCF8817BED6015E2EC28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentlibxml2.dll

Path C:\Windows\SysWOW64\dcagentlibxml2.dll
Size 2.0MB
SHA256 0e727eae47198ee6ad18504f6bda3415e2b3f65750a2d839533d5e0fb176ed85
MD5 2c359e52645365be679a9a0007ab55fd
SHA1 819f4181f5c54f689c2333bfc4d06499300f96c0
SHA512 714ce333c90919eccaa041fcabee71e0ad21f58efc5b783bd4f5cf3aef95e71fcdad93372c42a6aaa720e6ea1db78c10a407316fb1d6073e5d0c2bdcd4acc45a
SSDEEP 49152:IOJoM8eunky64XuwcHuJGaX3cBAUZLYdZ:ICCeunazBAUZLy
TLSH
T13EA5BF40F580C53AF5AA82B087FDBBB9892DDC283725A5E3E7E136E44D315D1223971E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_swdevice.PNF

Path C:\Windows\System32\DriverStore\FileRepository\c_swdevice.inf_amd64_845d51425d14f98b\c_swdevice.PNF
Size 6KB
SHA256 88598c54154eebe5b4331debbd8e6724232d7a6c3125bb05d98e21622aa239fd
MD5 7245cb544d1a673de209a422a635df10
SHA1 6ad09e9ad79460572ebee255242c37463ed52873
SHA512 593a70aef1ab32f6a766e580caf87224314f492da14900687e4654220b5ad5ef1120a1c67b2d1503857c20e4ac0e00eae5c3e9909865217a11f06254bc8fdff5
SSDEEP 96:LjWC3Smlt72iZOpMA5ROAvesBk2tR80hdh1eyMAM++7Z5G:/JH7JOe3m3tN8KQ2
TLSH
T1CBE15495B7E58F19F1B69E70ACF474EA58A1BC412C01CA5F3524B31E2C72EC4DAA0726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

machine.PNF

Path C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_d807fc8146278f4c\machine.PNF
Size 151KB
SHA256 d2d6701454866aa0cbdc1c9e2adfd671b111e55692ce9c2298364fe383ed1770
MD5 5c3deb9203aa388d9ead86e762768244
SHA1 4a55139e6592d44f0b8494129bca14b0620e5f84
SHA512 94eaaf38e22aa48f60efaa6b9a3a921443c171f78e9a60f34cc024c9a463a40eef3b90c3dc5b35dd253e01df9787a5f7d9aea4750da4f5e7d6f79872f7a3a49f
SSDEEP 3072:ok1abNAHpR1Zr9N5PdpxbcXeZfl0vUy+Yk:7dBncOZf2vU1Yk
TLSH
T172E3DD147AC88D1CF36365B0AFE2C2AF7919BCE4BE42D72E5484734F59B2E416E41239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CM25595.tmp

Path C:\Windows\System32\config\systemprofile\AppData\Local\CM25595.tmp
Size 1KB
SHA256 0ed81b6a3507e2ea087cd92494a43ae25bee30c345842836d982db6cba1a8aa5
MD5 0c537a0f77f299315fe430df0dfdc399
SHA1 065e3237839f1ebd9f427af73dc0502b56d717c1
SHA512 d9bc93f314ab123e0cc413ae44babf3adf022438c3d45047fe0db73c40530bddc2f4bdb191d7e550c059adb22b0df8119548ee8c48bb449f595e3d47eaa7b65c
TLSH
T19121240977FA774CF0E2A7B8DA3703274631EE3AAC45814D0360660948A6D10AF77B77
MD5 SHA1 SHA512 TLSH

Submit Download

DC60DD05154746A8177B098839A13C793070A85C

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\DC60DD05154746A8177B098839A13C793070A85C
Size 979B
SHA256 dd3c7b8b739396c19dc494224f434d794db36fe586e781c580445569e4700352
MD5 ca7b59fd00718b027d6656b976c4a37b
SHA1 f29ccfe2b4409ed952e3ec8fa4264a65433221e5
SHA512 c7633aa14f841191d60b48c58ceaae473a431e8b29013210d6f3b7bc9a88c5b35b9977bfc9aaa44997dc59c8eb5d505e2706669ff377760ced041126362a21c1
TLSH
T1B611842333723C2CFC019C721BA48E7B7EF2F9D04C61E46A15B1129E0594632D8203A7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2620-3834-0x00000000051E0000-0x000000000553B000-memory.dmp

Download

memory/3500-6228-0x00000000053C0000-0x0000000005A0A000-memory.dmp

Download

memory/3500-6237-0x00000000063E0000-0x00000000063FA000-memory.dmp

Download

memory/3500-6239-0x0000000008110000-0x000000000878C000-memory.dmp

Download

memory/3500-6238-0x0000000006430000-0x0000000006452000-memory.dmp

Download

memory/3500-6236-0x0000000006E70000-0x0000000006F06000-memory.dmp

Download

memory/3500-6235-0x0000000005F60000-0x0000000005FAC000-memory.dmp

Download

memory/3500-6234-0x0000000005B40000-0x0000000005B5E000-memory.dmp

Download

memory/3500-6227-0x0000000002650000-0x0000000002686000-memory.dmp

Download

memory/3500-6232-0x0000000005BC0000-0x0000000005F1B000-memory.dmp

Download

memory/3500-6229-0x0000000005270000-0x00000000052D6000-memory.dmp

Download

memory/3932-3680-0x0000000000120000-0x00000000001AC000-memory.dmp

Download

memory/3932-3682-0x0000000003990000-0x00000000039FE000-memory.dmp

Download

memory/3932-3694-0x0000000003E20000-0x0000000003EB2000-memory.dmp

Download

memory/3932-3759-0x00000000050F0000-0x000000000544B000-memory.dmp

Download

memory/3932-3696-0x00000000049D0000-0x0000000004A36000-memory.dmp

Download

memory/3932-3744-0x0000000005050000-0x00000000050E4000-memory.dmp

Download

memory/3932-3754-0x0000000005000000-0x0000000005022000-memory.dmp

Download

memory/3932-3681-0x0000000003EE0000-0x000000000449A000-memory.dmp

Download