Analysis
-
max time kernel
225s -
max time network
277s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-09-2022 15:47
Static task
static1
Behavioral task
behavioral1
Sample
cmd_fw_installer_138430009_eb.exe
Resource
win7-20220901-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
cmd_fw_installer_138430009_eb.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
26 signatures
150 seconds
General
-
Target
cmd_fw_installer_138430009_eb.exe
-
Size
5.4MB
-
MD5
b48216dca6f745a40645248384659fdd
-
SHA1
3bc265e7282bfb5c63be6cc73a2b7aad9a060904
-
SHA256
9b6394b0d1da147c5c718ebf3aba211ce2d4aefc63eb0dc80ed5cfc0db269bcd
-
SHA512
488fbd2b606c4f829b0ec05217b7d9be687cb885b988bc7cdcf7e1d61da2ef06fc422646696e24c2a1c1a63d793bda2293204037bd5a0178a673c00e91b226ec
-
SSDEEP
98304:n3oeoi7dSeyJ6A89FbeCD25kvriejkx9sZjMK6vx6IF/M8aWzBWcPNkNzt9e:n3oeoYSeyJ6vnKCD25kvmeh6vFF//aFU
Score
9/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 10 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0002000000022570-161.dat acprotect behavioral2/files/0x0002000000022570-160.dat acprotect behavioral2/files/0x0002000000022570-167.dat acprotect behavioral2/files/0x0002000000022c9e-168.dat acprotect behavioral2/files/0x0002000000022570-166.dat acprotect behavioral2/files/0x0002000000022570-165.dat acprotect behavioral2/files/0x0002000000022570-164.dat acprotect behavioral2/files/0x0002000000022570-163.dat acprotect behavioral2/files/0x0002000000022570-162.dat acprotect behavioral2/memory/4652-169-0x00000000030B0000-0x00000000030C2000-memory.dmp acprotect -
Downloads MZ/PE file
-
Drops file in Drivers directory 7 IoCs
description ioc Process File created C:\Windows\system32\drivers\isedrv.sys isestart.exe File created C:\Windows\system32\Drivers\cmderd.sys msiexec.exe File created C:\Windows\system32\Drivers\cmdGuard.sys msiexec.exe File created C:\Windows\system32\Drivers\cmdhlp.sys msiexec.exe File created C:\Windows\system32\Drivers\inspect.sys msiexec.exe File created C:\Windows\system32\drivers\cmdboot.sys MsiExec.exe File opened for modification C:\Windows\system32\drivers\cmdboot.sys MsiExec.exe -
Executes dropped EXE 16 IoCs
pid Process 1176 cmdinstall.exe 224 cmdinstall_138430009_eb.exe 4652 dragonsetup.exe 2620 dragon.exe 3260 dragon.exe 3616 dragon.exe 4160 dragon.exe 4052 dragon_updater.exe 1488 ise_installer.exe 2340 isestart.exe 3212 MSI56D9.tmp 552 MSI56D9.tmp 2484 cfpconfg.exe 4024 cisbf.exe 3928 cfpconfg.exe 1380 cfpconfg.exe -
Registers COM server for autorun 1 TTPs 39 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4D33F09-D11A-485D-AB08-8BFF862E7120}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cisbf.exe\"" cisbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF101135-6584-46E7-8AA1-8FCD1FCA5042}\LocalServer32\ThreadingModel = "Free" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{868A55F7-D79E-4C2E-8091-DEA9042B987F}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvSigChecker" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4D33F09-D11A-485D-AB08-8BFF862E7120}\LocalServer32 cisbf.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{E8718E3A-1985-473C-9196-9A39AFB0028E}\LocalServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67683718-82B8-4557-86A8-E04D169EF883}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67683718-82B8-4557-86A8-E04D169EF883}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C288AC5A-D846-4696-8028-2DF6F508D0D9}\LocalServer32\ThreadingModel = "Free" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10F58851-4358-4E4B-8494-DF34393F41A5}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{868A55F7-D79E-4C2E-8091-DEA9042B987F}\LocalServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{A1850D95-9C38-4D86-AC40-E559BC0E73C9}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C288AC5A-D846-4696-8028-2DF6F508D0D9}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B1E2B7F-DDF5-4722-A450-085CC9EAC96C}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1850D95-9C38-4D86-AC40-E559BC0E73C9}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvDllHost" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\LocalServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{1B1E2B7F-DDF5-4722-A450-085CC9EAC96C}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B1E2B7F-DDF5-4722-A450-085CC9EAC96C}\LocalServer32\ThreadingModel = "Free" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7D729A7-3570-4902-944A-470C9919FCCB}\InProcServer32\ = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cisresc.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0E9D49D-65D1-4AB1-8235-DF90B6ED8483}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvMonitor" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED181758-F11B-4C85-AEA2-199B3DC9F7DE}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7D729A7-3570-4902-944A-470C9919FCCB}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{FF101135-6584-46E7-8AA1-8FCD1FCA5042}\LocalServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{C288AC5A-D846-4696-8028-2DF6F508D0D9}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10F58851-4358-4E4B-8494-DF34393F41A5}\LocalServer32\ThreadingModel = "Both" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05E5F178-256F-42EE-9BF4-A7E080F7B354}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvScanner" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8718E3A-1985-473C-9196-9A39AFB0028E}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvMerger" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B691E6DB-B216-4532-A2F3-1656BAC416FC}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvBoostHelper" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7D729A7-3570-4902-944A-470C9919FCCB}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4D33F09-D11A-485D-AB08-8BFF862E7120}\LocalServer32\ServerExecutable = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cisbf.exe" cisbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF101135-6584-46E7-8AA1-8FCD1FCA5042}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\LocalServer32\ThreadingModel = "Free" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{10F58851-4358-4E4B-8494-DF34393F41A5}\LocalServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{05E5F178-256F-42EE-9BF4-A7E080F7B354}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67683718-82B8-4557-86A8-E04D169EF883}\InProcServer32\ = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cisbfps.dll" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{E0E9D49D-65D1-4AB1-8235-DF90B6ED8483}\LocalServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{B691E6DB-B216-4532-A2F3-1656BAC416FC}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED181758-F11B-4C85-AEA2-199B3DC9F7DE}\InprocServer32\ = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cisresc.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED181758-F11B-4C85-AEA2-199B3DC9F7DE}\InprocServer32\ThreadingModel = "Free" regsvr32.exe -
resource yara_rule behavioral2/files/0x0002000000022570-161.dat upx behavioral2/files/0x0002000000022570-160.dat upx behavioral2/files/0x0002000000022570-167.dat upx behavioral2/files/0x0002000000022c9e-168.dat upx behavioral2/files/0x0002000000022570-166.dat upx behavioral2/files/0x0002000000022570-165.dat upx behavioral2/files/0x0002000000022570-164.dat upx behavioral2/files/0x0002000000022570-163.dat upx behavioral2/files/0x0002000000022570-162.dat upx behavioral2/memory/4652-169-0x00000000030B0000-0x00000000030C2000-memory.dmp upx behavioral2/memory/4652-174-0x0000000070830000-0x000000007083A000-memory.dmp upx -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation ise_installer.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation cmd_fw_installer_138430009_eb.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation cmdinstall.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation cmdinstall_138430009_eb.exe -
Loads dropped DLL 64 IoCs
pid Process 1176 cmdinstall.exe 224 cmdinstall_138430009_eb.exe 224 cmdinstall_138430009_eb.exe 224 cmdinstall_138430009_eb.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 2620 dragon.exe 3260 dragon.exe 3616 dragon.exe 2620 dragon.exe 4160 dragon.exe 4160 dragon.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks for any installed AV software in registry 1 TTPs 64 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer\EnableLogging cmdinstall_138430009_eb.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam\ModeEx msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS cmdinstall.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS\DbgTrace\cmdinstall_138430009_eb cmdinstall_138430009_eb.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer cmdinstall_138430009_eb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\LanguageName = "English (United States)" msiexec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UrlsUpdateHost msiexec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UserEmail msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{0D85521A-A20D-44D9-8380-EFB7C9BE423B} = "1664128277" cfpconfg.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS\DbgTrace\cmdinstall cmdinstall.exe Key queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS cmdinstall.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam cmdinstall_138430009_eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CmdAgent\_Trace_Enabled_To_WinLog = "1" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer\MsiProductCode = "{529CC629-B436-4886-B322-4BE75B97783D}" msiexec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CfpConfg\_Trace_Category_Override cfpconfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UsageStatHost = "cmc.comodo.com" msiexec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\Desktop icon visibility msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{DF77CAAC-D06C-4649-96B0-A6733E364723} = "1664128277" cfpconfg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer\Instance\{48222F79-874D-414E-9563-03C664764923} = "1176" cmdinstall.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS\Data cmdinstall_138430009_eb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UserEmail msiexec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data msiexec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\cfpconfg cfpconfg.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data cmdinstall_138430009_eb.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS\Data cmdinstall_138430009_eb.exe Delete value \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam\Countdown end cmdinstall_138430009_eb.exe Delete value \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam\Countdown cmdinstall_138430009_eb.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\VolatileData msiexec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UpdateURL msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam cfpconfg.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CIS\_Trace_Level = "2" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CfpConfg\_Trace_Enabled_To_WinLog = "1" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CfpConfg\_Trace_Level = "2" MsiExec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\LanguageID msiexec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer\MsiProductCode msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer\Proxy = "C:\\Program Files\\COMODO\\COMODO Internet Security\\msica.dll" msiexec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\Langs.cmdres cfpconfg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{0D85521A-A20D-44D9-8380-EFB7C9BE423B} = "1664128276" cfpconfg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{1AB2EC41-A04B-45CB-84CB-11BA5EBA283D} = "1664128276" cfpconfg.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer\Instance cmdinstall_138430009_eb.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS\Options cmdinstall_138430009_eb.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data cmdinstall_138430009_eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\PaarEventIS = "1" cmdinstall_138430009_eb.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options msiexec.exe Key security queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CIS MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CfpConfg MsiExec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CfpConfg\_Trace_Enabled cfpconfg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{1AB2EC41-A04B-45CB-84CB-11BA5EBA283D} = "1664128277" cfpconfg.exe Key security queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer msiexec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\cfpconfg cfpconfg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CmdAgent\_Trace_Level = "2" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{ABB45338-2428-46D5-BCA1-F907810012C7} = "1664128277" cfpconfg.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Testing purposes cmdinstall_138430009_eb.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\ThemeName msiexec.exe Key queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam cmdinstall_138430009_eb.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\CmcHost msiexec.exe Key queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CmdAgent\_Trace_Enabled = "1" MsiExec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options cfpconfg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{AF858DA4-6F8E-4298-84E2-AB5DBB7741DB} = "1664128276" cfpconfg.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer cmdinstall.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: cfpconfg.exe File opened (read-only) \??\A: cfpconfg.exe File opened (read-only) \??\M: cfpconfg.exe File opened (read-only) \??\N: cfpconfg.exe File opened (read-only) \??\P: cfpconfg.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: cmdinstall.exe File opened (read-only) \??\G: cmdinstall_138430009_eb.exe File opened (read-only) \??\T: cmdinstall_138430009_eb.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: MsiExec.exe File opened (read-only) \??\G: cfpconfg.exe File opened (read-only) \??\M: cmdinstall.exe File opened (read-only) \??\N: cmdinstall.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: MsiExec.exe File opened (read-only) \??\R: MsiExec.exe File opened (read-only) \??\T: MsiExec.exe File opened (read-only) \??\V: MsiExec.exe File opened (read-only) \??\K: cfpconfg.exe File opened (read-only) \??\R: cmdinstall.exe File opened (read-only) \??\Z: cmdinstall.exe File opened (read-only) \??\R: cfpconfg.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: MsiExec.exe File opened (read-only) \??\K: cfpconfg.exe File opened (read-only) \??\K: cmdinstall.exe File opened (read-only) \??\P: cmdinstall_138430009_eb.exe File opened (read-only) \??\L: MsiExec.exe File opened (read-only) \??\E: cfpconfg.exe File opened (read-only) \??\Z: cfpconfg.exe File opened (read-only) \??\L: cfpconfg.exe File opened (read-only) \??\J: cfpconfg.exe File opened (read-only) \??\H: cmdinstall.exe File opened (read-only) \??\A: cmdinstall_138430009_eb.exe File opened (read-only) \??\N: MsiExec.exe File opened (read-only) \??\S: MsiExec.exe File opened (read-only) \??\W: MsiExec.exe File opened (read-only) \??\B: cfpconfg.exe File opened (read-only) \??\L: cfpconfg.exe File opened (read-only) \??\S: cmdinstall_138430009_eb.exe File opened (read-only) \??\K: MsiExec.exe File opened (read-only) \??\A: MsiExec.exe File opened (read-only) \??\S: MsiExec.exe File opened (read-only) \??\E: MsiExec.exe File opened (read-only) \??\K: cmdinstall_138430009_eb.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\F: MsiExec.exe File opened (read-only) \??\P: MsiExec.exe File opened (read-only) \??\B: MsiExec.exe File opened (read-only) \??\L: MsiExec.exe File opened (read-only) \??\I: cfpconfg.exe File opened (read-only) \??\O: cmdinstall_138430009_eb.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: cfpconfg.exe File opened (read-only) \??\J: cmdinstall.exe File opened (read-only) \??\X: cmdinstall.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: cfpconfg.exe File opened (read-only) \??\Q: cfpconfg.exe File opened (read-only) \??\B: cmdinstall.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\system32\cmdvrt64.dll msiexec.exe File created C:\Windows\SysWOW64\guard32.dll msiexec.exe File created C:\Windows\system32\guard64.dll msiexec.exe File created C:\Windows\syswow64\iseguard32.dll isestart.exe File created C:\Windows\system32\iseguard64.dll isestart.exe File created C:\Windows\system32\cmdcsr.dll msiexec.exe File created C:\Windows\SysWOW64\cmdvrt32.dll msiexec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\COMODO\COMODO Internet Security\translations\virtkiosk.arabic.lang msiexec.exe File created C:\Program Files (x86)\Comodo\Dragon\swiftshader\libEGL.dll dragonsetup.exe File created C:\Program Files (x86)\Comodo\Dragon\locales\hu.pak dragonsetup.exe File created C:\Program Files (x86)\Comodo\Dragon\locales\lt.pak dragonsetup.exe File created C:\Program Files (x86)\Comodo\Dragon\locales\te.pak dragonsetup.exe File created C:\Program Files (x86)\COMODO\Internet Security Essentials\Translations\vkise.french.xml isestart.exe File created C:\Program Files\COMODO\COMODO Internet Security\scanners\heur.cav msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.english.lang.template msiexec.exe File created C:\Program Files (x86)\Comodo\Dragon\locales\id.pak dragonsetup.exe File created C:\Program Files\COMODO\COMODO Internet Security\scanners\mach32.dll msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.japanese.lang msiexec.exe File created C:\Program Files (x86)\Comodo\Dragon\locales\nl.pak dragonsetup.exe File created C:\Program Files\COMODO\COMODO Internet Security\recognizer.dll msiexec.exe File created C:\Program Files (x86)\COMODO\Internet Security Essentials\Translations\vkise.german.xml isestart.exe File created C:\Program Files\COMODO\COMODO Internet Security\scanners\common.cav msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\Desklist.html msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\virtkiosk.exe msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\virtkiosk.vietnamese.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\cfpver.dat msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe msiexec.exe File created C:\Program Files (x86)\Comodo\Dragon\dragon_register.exe dragonsetup.exe File created C:\Program Files (x86)\Comodo\Dragon\modules\coresys32.dll dragonsetup.exe File created C:\Program Files (x86)\Comodo\Dragon\bundles\ccav_installer.exe dragonsetup.exe File opened for modification C:\Program Files (x86)\Comodo\Dragon\master_preferences dragonsetup.exe File created C:\Program Files\COMODO\COMODO Internet Security\drivers\win10\cmdboot.cat msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\virtkiosk.italian.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\msica.dll msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\installer_init.xml msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\iseupdate.exe msiexec.exe File created C:\Program Files (x86)\Comodo\Dragon\locales\bg.pak dragonsetup.exe File created C:\Program Files (x86)\Comodo\Dragon\locales\fil.pak dragonsetup.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\Config.xml msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\1031.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\cisevlog.dll msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\bin\lbfehkoinhhcknnbdgnnmjhiladcgbol.xml msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\drivers\win10\cmdboot.sys msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.danish.lang msiexec.exe File created C:\Program Files (x86)\Comodo\Dragon\locales\hr.pak dragonsetup.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\virtkiosk.polish.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\virtkiosk.serbian.lang msiexec.exe File created C:\Program Files (x86)\Comodo\Dragon\snapshot_blob.bin dragonsetup.exe File created C:\Program Files (x86)\Comodo\Dragon\extensions\ip_dns_leakage_detector.crx dragonsetup.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\images\btnShadow.png msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\images\flip_in.png msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\drivers\win10\cmdguard.inf msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\2052.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\virtkiosk.french.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\platform.dll msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\bin\comodo_dragon.xml msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\drivers\win10\cmdboot.inf msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.persian.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.turkish.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\virtkiosk.romanian.lang msiexec.exe File created C:\Program Files (x86)\Comodo\Dragon\extensions\media_downloader.crx dragonsetup.exe File created C:\Program Files (x86)\Comodo\Dragon\extensions\dragon_install.exe dragonsetup.exe File created C:\Program Files\COMODO\COMODO Internet Security\scanners\fixbase.exe msiexec.exe File created C:\Program Files (x86)\Comodo\Dragon\locales\fr.pak dragonsetup.exe File created C:\Program Files (x86)\Comodo\Dragon\locales\ml.pak dragonsetup.exe File created C:\Program Files (x86)\Comodo\Dragon\locales\tr.pak dragonsetup.exe File created C:\Program Files (x86)\COMODO\Internet Security Essentials\Translations\vkise.romanian.xml isestart.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\1050.lang msiexec.exe File created C:\Program Files (x86)\Comodo\Dragon\dragon_s.dll dragonsetup.exe File created C:\Program Files (x86)\Comodo\Dragon\locales\it.pak dragonsetup.exe File created C:\Program Files (x86)\Comodo\Dragon\locales\sl.pak dragonsetup.exe -
Drops file in Windows directory 22 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI55DD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI245E.tmp msiexec.exe File created C:\Windows\ELAMBKUP\cmdboot.sys MsiExec.exe File created C:\Windows\Installer\e593f41.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\e593f41.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI24FB.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{529CC629-B436-4886-B322-4BE75B97783D} msiexec.exe File opened for modification C:\Windows\Installer\MSI5128.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI56B8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI16BF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI197F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI47AE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4B69.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI5417.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI56D9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI23B1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI25F6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4B58.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4B99.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007c4a2b5d7b48cb040000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007c4a2b5d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff0000000007000100006809007c4a2b5d000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007c4a2b5d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007c4a2b5d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client" svchost.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF101135-6584-46E7-8AA1-8FCD1FCA5042}\ = "CisRmControl Class" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C288AC5A-D846-4696-8028-2DF6F508D0D9} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{C288AC5A-D846-4696-8028-2DF6F508D0D9} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{10F58851-4358-4E4B-8494-DF34393F41A5}\LocalServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{59A8627E-99C2-4995-81D3-44A31D62EA3A}\7.0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1850D95-9C38-4D86-AC40-E559BC0E73C9}\TypeLib\ = "{BAFAD68A-E0A2-4EB2-B2BA-1D0DE7CB2910}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67683718-82B8-4557-86A8-E04D169EF883}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\CISSVC.CisGate msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{C288AC5A-D846-4696-8028-2DF6F508D0D9}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CavWp.AvMonitor.1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CavWp.AvMerger\ = "AvMerger Class" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B691E6DB-B216-4532-A2F3-1656BAC416FC}\TypeLib\ = "{BAFAD68A-E0A2-4EB2-B2BA-1D0DE7CB2910}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7D729A7-3570-4902-944A-470C9919FCCB}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4D33F09-D11A-485D-AB08-8BFF862E7120}\TypeLib cisbf.exe Key created \REGISTRY\MACHINE\Software\Classes\DragonHTML\DefaultIcon dragon.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{BAFAD68A-E0A2-4EB2-B2BA-1D0DE7CB2910}\6.0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED181758-F11B-4C85-AEA2-199B3DC9F7DE}\ = "RescueDisk Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4D33F09-D11A-485D-AB08-8BFF862E7120}\Version\ = "1.0" cisbf.exe Key created \REGISTRY\MACHINE\Software\Classes\.shtml\OpenWithProgids dragon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05E5F178-256F-42EE-9BF4-A7E080F7B354}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvScanner" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{E0E9D49D-65D1-4AB1-8235-DF90B6ED8483}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CavWp.AvDllHost\ = "AvDllHost Class" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CavWp.AvDllHost\CLSID\ = "{A1850D95-9C38-4D86-AC40-E559BC0E73C9}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{A1850D95-9C38-4D86-AC40-E559BC0E73C9}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4D33F09-D11A-485D-AB08-8BFF862E7120}\Version cisbf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1F5B557B-0805-423E-B525-5939F5889232} cisbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DragonHTML\Application\ApplicationCompany = "The Comodo Dragon Authors" dragon.exe Key created \REGISTRY\MACHINE\Software\Classes\.xht dragon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E37FA5BA-9E34-49AE-8C97-2C9E537A5D24}\7.0\0\win64\ = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{59A8627E-99C2-4995-81D3-44A31D62EA3A}\7.0\FLAGS\ = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CavWp.AvScanner\CLSID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CavWp.AvDllHost.1\CLSID\ = "{A1850D95-9C38-4D86-AC40-E559BC0E73C9}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D7D729A7-3570-4902-944A-470C9919FCCB}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\.svg\OpenWithProgids dragon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{59A8627E-99C2-4995-81D3-44A31D62EA3A} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0E9D49D-65D1-4AB1-8235-DF90B6ED8483} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CavWp.AvSigChecker\CLSID\ = "{868A55F7-D79E-4C2E-8091-DEA9042B987F}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BAFAD68A-E0A2-4EB2-B2BA-1D0DE7CB2910}\6.0\ = "CavWp 6.0 Type Library" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\safe\shell\open\command\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\virtkiosk.exe\" -v \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{FF101135-6584-46E7-8AA1-8FCD1FCA5042}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{A70211A1-E8DF-47DC-B336-74BF57292D88}\7.0\FLAGS msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CavWp.AvBoostHelper.1\CLSID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\kiosk\ = "URL:Kiosk Protocol" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{59A8627E-99C2-4995-81D3-44A31D62EA3A}\7.0\0\win64 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BAFAD68A-E0A2-4EB2-B2BA-1D0DE7CB2910}\6.0\0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.html\OpenWithProgIds\DragonHTML dragon.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{59A8627E-99C2-4995-81D3-44A31D62EA3A}\7.0 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05E5F178-256F-42EE-9BF4-A7E080F7B354} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\DragonHTML\shell dragon.exe Key created \REGISTRY\MACHINE\Software\Classes\.svg dragon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{E8718E3A-1985-473C-9196-9A39AFB0028E} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CavWp.AvBoostHelper\CLSID\ = "{B691E6DB-B216-4532-A2F3-1656BAC416FC}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F8C8C537-0997-4D12-BD50-9B6C31A4883E}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DragonHTML\Application\AppUserModelId = "Dragon" dragon.exe Key created \REGISTRY\MACHINE\Software\Classes\.xht\OpenWithProgids dragon.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{FF101135-6584-46E7-8AA1-8FCD1FCA5042}\LocalServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\ProgID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CavWp.AvMerger msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CavWp.AvBoostHelper.1\CLSID\ = "{B691E6DB-B216-4532-A2F3-1656BAC416FC}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4D33F09-D11A-485D-AB08-8BFF862E7120}\ = "USBBurner Class" cisbf.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 040000000100000010000000a7f2e41606411150306b9ce3b49cb0c90f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb0b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a0065006300740029000000090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703086200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d81d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67087e0000000100000008000000000063f58926d701030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d46190000000100000010000000e843ac3b52ec8c297fa948c9b1fb281920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 cmdinstall_138430009_eb.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\6CD253D636A7B4D0E0981431BC064061A9853ED9\Blob = 0300000001000000140000006cd253d636a7b4d0e0981431bc064061a9853ed920000000010000001b06000030820617308204ffa003020102021032327facb1bd6f1fa93473ccc515fd82300d06092a864886f70d01010b0500308191310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564313730350603550403132e434f4d4f444f2052534120457874656e6465642056616c69646174696f6e20436f6465205369676e696e67204341301e170d3138303132343030303030305a170d3231303132333233353935395a308201153110300e060355040513073339313038303531133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e311a301806035504090c11313235352042726f61642053747265657431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100b7713778a66667b8cd67f828f378f80a5507c4e8aa143cfd5b9b953ab16d04a965dcd386a35efe8378c1e0e5ceaf124f188102958962014e493cd80f11fc2ba339953a8bb71a9f030ebbe8742b4252ab465a2d41a829508a9eef5d34d171fcf0b5be026fe15e1a70288b2ecd4af1332924d53c0eefe5c7033482769cae8b5c5e8d59033fac40e94d714c5cd05e8db6f0edb71bb26565d52a025f35323203e9a7846d00a235f973d1e43f29a81dcd1bfef625d373f94a51cc8d2be8ee69702a73a694da69d9b0fbae7d1dee353683a2037a2019b9260a1b53f6c89d945b384c275670bdfac333301504af00749373356a1e7a422eb9363bdab713f9ad6b5bb1970203010001a38201e2308201de301f0603551d23041830168014df8ff3200ce9caa604d85b58372a3dab46dc8349301d0603551d0e04160414e18081b3e9396b7109e8b2add6c3d20ebf4b4814300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010601302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f43505330550603551d1f044e304c304aa048a0468644687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e63726c30818606082b06010505070101047a3078305006082b060105050730028644687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33393130383035300d06092a864886f70d01010b050003820101004bc17929ea82f3c4787f7b29b69edb09e169797a9f4cd233f035412d2b9c586e352d2c0d1cd530a946a91ccd8858453573f0b45a0cdc743d662af4761420489adadbd9a84915b697f96ed1e49786c53000eb12555d3b2957eec18279326020737e2e3e4d621856026169ad6f6cf18ee7b59d5b6a7e6d8c252fa1a15363ec89a6efe5efdf4b260ad35c6a0e1db0250d1eb66ea7b91f15e0f57ecc0541e1ad74a2069f717dec0b1f03101b6812c13f64264f8c40a3614ffb8ccabedb974cda14eb50c061d5cd23dc7735cd0bcfdcef3fd178c1f95594a591031d05c8554cb5fe6fd23cb95931bf847f5b525a269aeac0336313e8f6e81ccb1692d86993724f709e cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4\Blob = 0f0000000100000030000000761613f4cd8607508c3d520fbefe68773735fc73746f42a9fd6254ba3b72f0047994e5af57677cf6d2c1965984965df1090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003a0000005300650063007400690067006f002000280066006f0072006d00650072006c007900200043006f006d006f0064006f002000430041002900000062000000010000002000000052f0e1c4e58ec629291b60317f074671b85d7ea80d5b07273463534b32b40234140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d41d0000000100000010000000cb39c3d4272cdf63774e1db810c5a89e030000000100000014000000afe5d244a8d1194230ff479fe2f897bbcd7a8cb42000000001000000dc050000308205d8308203c0a00302010202104caaf9cadb636fe01ff74ed85b03869d300d06092a864886f70d01010c0500308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f72697479301e170d3130303131393030303030305a170d3338303131383233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a3423040301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201000af1d54684b7ae51bb6cb24d411400934c9ccbe5c054cfa0258e02f9fdb0a20df520983c132dac56a2b0d67e1192e92eba9e2e9a72b1bd19446c6135a29ab41612695a8ce1d73ea41ae82f03f4ae611d101b2aa48b7ac5fe05a6e1c0d6c8fe9eae8f2bba3d99f8d8730958466ea69cf4d727d395da3783721cd373e0a2479903385dd5497900291cc7ec9b201c0724695778b239fc3a84a0b59c7c8dbf2e936227b739da1718aebd3c0968ff849b3cd5d60b03e3579e14f7d1eb4fc8bd8723b7b6494379855cbaeb920ba1c6e868a84c16b11a990ae8532c92bba10918750c65a87bcb23b71ac22885c31bffd02b62efa47b099198678c1401cd68066a6321750380888a6e81c685f2a9a42de7f4a524104783cacdf48d7958b1069be71a2ad99d01d7947ded034acaf0dbe8a9013ef55699c91e8e493dbbe509b9e04f49923d168240cccc59c6e63aed122e693c6c95b1fdaa1d7b7f86be1e0e3246fbfb138f757f4c8b4b4663fe00344070c1c3b9a1dda670e204b341bce98091ea649c7ae12203a99c6e6f0e654f6c87875ef36ea0f975a59b40e853b2279d4ab9c077218dff87f2debc8cef17dfb7490bd1f26e300b1a0e4e76ed11fcf5e956b27dbfc76d0a938ca5d0c0b61dbe3a4e94a2d76e6c0bc28a7cfa20f3c4e4e5cd0da8cb9192b17c85ecb51469660e82e7cdcec82da6517f21c1355385064a5d9fadbb1b5f74 cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4\Blob = 19000000010000001000000082218ffb91733e64136be5719f57c3a1030000000100000014000000afe5d244a8d1194230ff479fe2f897bbcd7a8cb41d0000000100000010000000cb39c3d4272cdf63774e1db810c5a89e140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d462000000010000002000000052f0e1c4e58ec629291b60317f074671b85d7ea80d5b07273463534b32b402340b000000010000003a0000005300650063007400690067006f002000280066006f0072006d00650072006c007900200043006f006d006f0064006f002000430041002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000030000000761613f4cd8607508c3d520fbefe68773735fc73746f42a9fd6254ba3b72f0047994e5af57677cf6d2c1965984965df12000000001000000dc050000308205d8308203c0a00302010202104caaf9cadb636fe01ff74ed85b03869d300d06092a864886f70d01010c0500308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f72697479301e170d3130303131393030303030305a170d3338303131383233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a3423040301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201000af1d54684b7ae51bb6cb24d411400934c9ccbe5c054cfa0258e02f9fdb0a20df520983c132dac56a2b0d67e1192e92eba9e2e9a72b1bd19446c6135a29ab41612695a8ce1d73ea41ae82f03f4ae611d101b2aa48b7ac5fe05a6e1c0d6c8fe9eae8f2bba3d99f8d8730958466ea69cf4d727d395da3783721cd373e0a2479903385dd5497900291cc7ec9b201c0724695778b239fc3a84a0b59c7c8dbf2e936227b739da1718aebd3c0968ff849b3cd5d60b03e3579e14f7d1eb4fc8bd8723b7b6494379855cbaeb920ba1c6e868a84c16b11a990ae8532c92bba10918750c65a87bcb23b71ac22885c31bffd02b62efa47b099198678c1401cd68066a6321750380888a6e81c685f2a9a42de7f4a524104783cacdf48d7958b1069be71a2ad99d01d7947ded034acaf0dbe8a9013ef55699c91e8e493dbbe509b9e04f49923d168240cccc59c6e63aed122e693c6c95b1fdaa1d7b7f86be1e0e3246fbfb138f757f4c8b4b4663fe00344070c1c3b9a1dda670e204b341bce98091ea649c7ae12203a99c6e6f0e654f6c87875ef36ea0f975a59b40e853b2279d4ab9c077218dff87f2debc8cef17dfb7490bd1f26e300b1a0e4e76ed11fcf5e956b27dbfc76d0a938ca5d0c0b61dbe3a4e94a2d76e6c0bc28a7cfa20f3c4e4e5cd0da8cb9192b17c85ecb51469660e82e7cdcec82da6517f21c1355385064a5d9fadbb1b5f74 cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4\Blob = 0400000001000000100000001b31b0714036cc143691adc43efdec180f0000000100000030000000761613f4cd8607508c3d520fbefe68773735fc73746f42a9fd6254ba3b72f0047994e5af57677cf6d2c1965984965df1090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003a0000005300650063007400690067006f002000280066006f0072006d00650072006c007900200043006f006d006f0064006f002000430041002900000062000000010000002000000052f0e1c4e58ec629291b60317f074671b85d7ea80d5b07273463534b32b40234140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d41d0000000100000010000000cb39c3d4272cdf63774e1db810c5a89e030000000100000014000000afe5d244a8d1194230ff479fe2f897bbcd7a8cb419000000010000001000000082218ffb91733e64136be5719f57c3a12000000001000000dc050000308205d8308203c0a00302010202104caaf9cadb636fe01ff74ed85b03869d300d06092a864886f70d01010c0500308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f72697479301e170d3130303131393030303030305a170d3338303131383233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a3423040301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201000af1d54684b7ae51bb6cb24d411400934c9ccbe5c054cfa0258e02f9fdb0a20df520983c132dac56a2b0d67e1192e92eba9e2e9a72b1bd19446c6135a29ab41612695a8ce1d73ea41ae82f03f4ae611d101b2aa48b7ac5fe05a6e1c0d6c8fe9eae8f2bba3d99f8d8730958466ea69cf4d727d395da3783721cd373e0a2479903385dd5497900291cc7ec9b201c0724695778b239fc3a84a0b59c7c8dbf2e936227b739da1718aebd3c0968ff849b3cd5d60b03e3579e14f7d1eb4fc8bd8723b7b6494379855cbaeb920ba1c6e868a84c16b11a990ae8532c92bba10918750c65a87bcb23b71ac22885c31bffd02b62efa47b099198678c1401cd68066a6321750380888a6e81c685f2a9a42de7f4a524104783cacdf48d7958b1069be71a2ad99d01d7947ded034acaf0dbe8a9013ef55699c91e8e493dbbe509b9e04f49923d168240cccc59c6e63aed122e693c6c95b1fdaa1d7b7f86be1e0e3246fbfb138f757f4c8b4b4663fe00344070c1c3b9a1dda670e204b341bce98091ea649c7ae12203a99c6e6f0e654f6c87875ef36ea0f975a59b40e853b2279d4ab9c077218dff87f2debc8cef17dfb7490bd1f26e300b1a0e4e76ed11fcf5e956b27dbfc76d0a938ca5d0c0b61dbe3a4e94a2d76e6c0bc28a7cfa20f3c4e4e5cd0da8cb9192b17c85ecb51469660e82e7cdcec82da6517f21c1355385064a5d9fadbb1b5f74 cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4\Blob = 5c00000001000000040000000010000019000000010000001000000082218ffb91733e64136be5719f57c3a1030000000100000014000000afe5d244a8d1194230ff479fe2f897bbcd7a8cb41d0000000100000010000000cb39c3d4272cdf63774e1db810c5a89e140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d462000000010000002000000052f0e1c4e58ec629291b60317f074671b85d7ea80d5b07273463534b32b402340b000000010000003a0000005300650063007400690067006f002000280066006f0072006d00650072006c007900200043006f006d006f0064006f002000430041002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000030000000761613f4cd8607508c3d520fbefe68773735fc73746f42a9fd6254ba3b72f0047994e5af57677cf6d2c1965984965df10400000001000000100000001b31b0714036cc143691adc43efdec182000000001000000dc050000308205d8308203c0a00302010202104caaf9cadb636fe01ff74ed85b03869d300d06092a864886f70d01010c0500308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f72697479301e170d3130303131393030303030305a170d3338303131383233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a3423040301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201000af1d54684b7ae51bb6cb24d411400934c9ccbe5c054cfa0258e02f9fdb0a20df520983c132dac56a2b0d67e1192e92eba9e2e9a72b1bd19446c6135a29ab41612695a8ce1d73ea41ae82f03f4ae611d101b2aa48b7ac5fe05a6e1c0d6c8fe9eae8f2bba3d99f8d8730958466ea69cf4d727d395da3783721cd373e0a2479903385dd5497900291cc7ec9b201c0724695778b239fc3a84a0b59c7c8dbf2e936227b739da1718aebd3c0968ff849b3cd5d60b03e3579e14f7d1eb4fc8bd8723b7b6494379855cbaeb920ba1c6e868a84c16b11a990ae8532c92bba10918750c65a87bcb23b71ac22885c31bffd02b62efa47b099198678c1401cd68066a6321750380888a6e81c685f2a9a42de7f4a524104783cacdf48d7958b1069be71a2ad99d01d7947ded034acaf0dbe8a9013ef55699c91e8e493dbbe509b9e04f49923d168240cccc59c6e63aed122e693c6c95b1fdaa1d7b7f86be1e0e3246fbfb138f757f4c8b4b4663fe00344070c1c3b9a1dda670e204b341bce98091ea649c7ae12203a99c6e6f0e654f6c87875ef36ea0f975a59b40e853b2279d4ab9c077218dff87f2debc8cef17dfb7490bd1f26e300b1a0e4e76ed11fcf5e956b27dbfc76d0a938ca5d0c0b61dbe3a4e94a2d76e6c0bc28a7cfa20f3c4e4e5cd0da8cb9192b17c85ecb51469660e82e7cdcec82da6517f21c1355385064a5d9fadbb1b5f74 cmdinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46 cmdinstall_138430009_eb.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 0f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb0b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a0065006300740029000000090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703086200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d81d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67087e0000000100000008000000000063f58926d701030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4620000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 cmdinstall_138430009_eb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\D70D7D00CA12E1B3E20F3BF7534DEB2C2E7C2404 cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\D70D7D00CA12E1B3E20F3BF7534DEB2C2E7C2404\Blob = 030000000100000014000000d70d7d00ca12e1b3e20f3bf7534deb2c2e7c24042000000001000000530500003082054f30820437a00302010202102f9f0a1d6764b5a6378747247087ba73300d06092a864886f70d01010b0500307d310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312330210603550403131a434f4d4f444f2052534120436f6465205369676e696e67204341301e170d3138313231313030303030305a170d3139313231313233353935395a3081b8310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303116301406035504090c0d313235352042726f616420537431223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100c1b2eafc6255d7a7780082967ba911a65b8160e697a9c81ae0816002356644b714895808a67b22551d87b879e80d0c1bff7bd847e1486bad3c3caa8c6f3258a7311f8b03c68c9ec5947950e57a1f99f4b47b8faaf46e282f68155ae6e8f13c9c125b5eb83ae4e63ee6081d0e8aae4f090175a538422b38e0600bd94b21b313567934ee959ddd6ab7ef62bce25dada05d7de6a75cefeffdcba6a1fc8e1ef7aa6d3e5ab328732c3d31759a20d7e69cef60ac9d152041dbd85167a78329f3a80fee19ea9edb102448aa9f5774794ecb560de2faa348f278b846a2a5d8238d5e4e4cd2a82f0e37415af2dc63f34f3e179aa1cae7290b411aaf5aa6acf5404ebe98130203010001a382018d30820189301f0603551d23041830168014299160ff8a4dfaebf9a66ab8cff9e64bbd49ce12301d0603551d0e041604146c5f99825f4ba8d4c19bae5169bab32fae7816ca300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e63726c307406082b0601050507010104683066303e06082b060105050730028632687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010b050003820101000f718c2aa40e9c44a95e1eca3844097ddb7fba896b5f5c73a6b9aede1d29f0e432f41c8a45ce38b1f52df73f45e67907a03ac58d407b3077b1cae246a54544ee365bcee4bf0f4cecc47b01e98d0478d8f4c93e2c582aa472577de9c67a0a8c2e37635e626258675e0e6669babee331594abed516679e8f1b14d7a65dc1b76ab33412689b135cf855335748e2d1998759e5b95f68d418d5486d385d0db7a8fa30e58e84f57bb7ec3f45efa549fab71775c822ec846545b6fc0ef1d3c2dad34940657088fc5f773a1cbe24f9228f9dd7e9611d5d682998c6041ba580a789f5571da01d6723784bbcec4fded61d0ba31e37fbc10c3dfe06169df4670c8d454019f7 cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd cmdinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\31D019FC7AB697D57D9C4AFB340ED7C4D10400DF\Blob = 03000000010000001400000031d019fc7ab697d57d9c4afb340ed7c4d10400df2000000001000000250600003082062130820509a00302010202101b427b060e2866bfb586cc267e1c3eaa300d06092a864886f70d01010b0500308191310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564313730350603550403132e434f4d4f444f2052534120457874656e6465642056616c69646174696f6e20436f6465205369676e696e67204341301e170d3138313230343030303030305a170d3231313230333233353935395a308201093110300e060355040513073339313038303531133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b3009060355040613025553310e300c06035504110c053037303133310b300906035504080c024e4a3110300e06035504070c07436c6966746f6e3116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100ad390c8bc919005d5894a91a9585ef887fbd7c2341ff5ebb3efc6f645a66c55e6da11febce740e53ed9416284dfc7d142e4dc21f99753b5f60ae9aadc764b59efd9ffd33b20ae1c54eba629408a1b095a59cf4af0ad9db9bc494250154dcd0edefcec62e4b248d9a793b703aa15255baf3553fa59d4dc558ba4303af630bb626cd6627e0c4a45764ec3b286c38ab2499f9dc13eefdffa7841297ff533b47061b9aa3ff09ee3f04a7b10ba70894e53f3352b1f60eddfc021a66546e3392795bb6ae49a92f189ec2a7cdd9a935fab33a5ce7fc16c4b7e8ca13b4551d38a6a7c0658298a5adf5f6796675f58e1bb4ce410ff704bc5e845bc1ef83c18a0d50e137370203010001a38201f8308201f4301f0603551d23041830168014df8ff3200ce9caa604d85b58372a3dab46dc8349301d0603551d0e041604142d99b81962209042dc650eb36ec07ad996e48c4d300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010601302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f43505330550603551d1f044e304c304aa048a0468644687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e63726c30818606082b06010505070101047a3078305006082b060105050730028644687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30440603551d11043d303ba02306082b06010505070803a01730150c1355532d44454c41574152452d33393130383035811473636f742e7765697240636f6d6f646f2e636f6d300d06092a864886f70d01010b050003820101007f4d3e6594a3e380fac36b00e97ccacce4786be2ecc13cf37e737aaca0328bb8bfdcd513daff94aba1c7ee00cc8a3bd073157a812f6e31f772781d0bb922a8b86932b296c2312cdf3b239c42bb443b4b1b89b36de34a7fae65ac63eb6ead8812f8d373fa6f1a4e8d9e62eb004caae3639e41e08ed48d640b04725b09b4411dc083587e7fe24b33d90677677960efa6299cc85c4b2bfae4cdfe36581d25e029f6af1a7e77f502882d87597f3cc5bb450a71f9fd57f43b321baa4cbe5213a48a2c5b785a9de4103d5029e4db79403e98784e51379d45a86996b183469e98470731d1a603eaa443a05527aca62f51631722dc0dfe5d74c8298d2aed885d34c9be61 cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E35E6F46A1A9A4D18A4DAA298BDA4D1E8879236E\Blob = 030000000100000014000000e35e6f46a1a9a4d18a4daa298bda4d1e8879236e20000000010000005f0500003082055b30820443a003020102021100d9218e2757ec45d84ec08b3e6700c85e300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3138313231313030303030305a170d3139303730373233353935395a3081a8310b3009060355040613025553310e300c06035504110c053037303133310b300906035504080c024e4a3110300e06035504070c07436c6966746f6e3116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100b73a668ff7984c8d990d7c6e51df5176c7842cc1bf351c27286c6139f4831fc718a35b0fa9145f0887de8bce335e8e3e12fce763cab5deeae08e0bf325cd79a4fbb328d7c7f7d53de51bd3c05c5966b634a9b1fc4362afd0267f927dd90a52b6a5f5f0e29c8e94dfe4199b2cf31142bb480e95ecb92b6ca20ecd71ff210df9655e9e9ac856ad7aab929b843052d4a21c27ea4054a9f4e8c4cd88943b1a4d3a58b3e06eb654c6c09cef472d6fb0d05a841ce229b53a5d36bd08cbfdc552f7c758efaa7824c1d27e30a83d7a9cecaab4bd91b2cbd60d1335fc4ac0f0294dd2eeb3f65139467761f091840246ff644edbfacb9ffd7ef2823fd9eea312dd299a39af0203010001a38201aa308201a6301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604147c4f2b645af103043ca7675e8c129c16dee7164c300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d301f0603551d1104183016811473636f742e7765697240636f6d6f646f2e636f6d300d06092a864886f70d01010505000382010100b33c0fee4668b9e86cd777fa94eb47dcaee7fb5b9b897b9458b12e511a194b6ad495ea4b6b820d1c7cd26badf92cfc13aaa9e66157a55545c7ea71460a4fa4e30e46b9ac16a36e94a1fcbc62b2abe402d2a58773344c4b23a0d907a9760029595421e478da67167f80876012443cd22573dc3806cdedbc6c8c4ed255bd926cecc7796ec36fb225d084f31afb5e5a2e86d26149212dda8aed2058ef0d7e7e677b463a7722431a0b5c0b9dc385b7d2e73bd781ee111c8f7e36d76e1db1f6ac98784227ed97cde3762d079741984d146a8ff96e411c1b1e4e711cd00a6150532ffaa13702a81f4514eae48ca0b98d8642a6cfe7711dc67d1b857bfecb4e863bc1f9 cfpconfg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4 cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 5c00000001000000040000000008000019000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b688518687e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b0400000001000000100000001d3554048578b03f42424dbf20730a3f20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 cmdinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E35E6F46A1A9A4D18A4DAA298BDA4D1E8879236E cfpconfg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F8DB7E1C16F1FFD4AAAD4AAD8DFF0F2445184AEB cfpconfg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\31D019FC7AB697D57D9C4AFB340ED7C4D10400DF cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F8DB7E1C16F1FFD4AAAD4AAD8DFF0F2445184AEB\Blob = 030000000100000014000000f8db7e1c16f1ffd4aaad4aad8dff0f2445184aeb20000000010000000906000030820605308203eda0030201020210078f0a9d03df119e434e4fec1bf0235a300d06092a864886f70d01010b0500308194310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313e303c060355040313354d6963726f736f667420446576656c6f706d656e7420526f6f7420436572746966696361746520417574686f726974792032303134301e170d3134303532383136343334365a170d3339303532383136353134385a308194310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313e303c060355040313354d6963726f736f667420446576656c6f706d656e7420526f6f7420436572746966696361746520417574686f72697479203230313430820222300d06092a864886f70d01010105000382020f003082020a0282020100c20f7f6d49bb39f04d943fe8fb4dc5eb3be1285ab9892a467ea5c333271d82893feb33a1876aeae882b9dac39d77d135c0cb833672a6571912bc15e2c83c7b83623414d5abb6de368ba15a71a65196a70633b3221d146253c2a5af9a40cabe2c485499e72a9368a769190b99693bc1b2acae94dc5fab7e02cade3ca774a68c10a0e5aeb69c35ef838b10e5972aba916b9a6a4595d9d054718e653fc48a53ca1e38470ae9d04184a5da1e66016504e6505b7735f5b42e29320cc6bf5f61ee3220b77c39f911faff605efec669f46f1e1ded1d06e7651e9a112e6344065f31431733e9a32682d44b83124fd2a126032548e13abd84f58ad5b46e1ae871200e45530167ade31e6be8b2e4abfdf53b8eba67af5984cc5c75d09daa5c72c42636a2ac324c6ab1f8331744d2a77d70eeeb70949abceaba1c104b635b38ddd2254504b2f0b35a7c0b0a8e21406437114d96694533e493839ef9b3b51c2b0571ea6dcce748b6b6de805010ca4938b35905704ebd9e880222586489eb40dab12d2d6a40885d23c33ed0f5d5b7908a28543962a2c5c6b1bf74cd8695f9456bccf207eaac5cd336f7a27ab5b472532a063ec337945858b14a71bb5ccd9cb2af109ad943363e528519e7422891118c8ce7bbdfe6c855087375f3960d86b7d2e506b2c08a54a86177207d6cd1feba68f3454aaf1184eb867d2f04f354ea20ffd5db3d250270870203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604148570009f77591e8cac3c9f77262819cc9ac18f32301006092b06010401823715010403020100300d06092a864886f70d01010b050003820201004f2574bd1f624f5f0ff74222d7d1d65304232ec5d5d7072b6b793b5f6d90ed1355d382f1f5028f3ef996267e0d421876fc6055825a86bd113339690fcee0b02bf15d19dfd8d2fa86a4cccdacf0d0ae9a8b2b248f03c1350d20b3dfc742ea77292e0a12fc0b1a458dd931840d8d02c0acfad212bf1e6a343eea8300a348754e72662da1a5129f37a85d4a7759cfd63afc30c5a609a5bfb108e3fb2c9f76c4fb4e611d6d23f3766985eb49bb0df73dd0aa05bcdd3d6e80445ed99a68ecc989c7e61a18f860a0e78cf6e6516f0ee025b863f9f9c20b8c3c9cb2f042cdbec3f5fe4929559c5e8696fba1ed6d2686e8b8208b5cc6e72d31c5aaca7d4b7da059a41efb5071e9afcfd6aa0d99de8e95269731a5f47f6df46815b8e3f7add8efd13875025ffd6d4efcb6fc2f451ba9cad11e7aff75181536c120e45f483a95eb7be4f5f6f4fec94b21a2a9ea8a9925cbe8444090d539b46b239b52bcc0c17e17666e650bf5741596a866ed856854b224e87588644589853c7a656b96e0f259ea4725660f6a1b0c3fd44ae64b26174709fed4d7b8e0cee72f94ad808b6770ccb77bcf1b2bb9d15bbdb8035cb1f01b412ce6535516e74a0e41089937e2a9d76d0e6a45e5ece388a9fdb69bc32820ceabc2936b516553bfa05e7b9d26349a514c8ca638d5865b3c55ee50ec000bcaacdcca10abdf189bd2ac0c8d084515af8535355ae526bc cfpconfg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0400000001000000100000001d3554048578b03f42424dbf20730a3f0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70103000000010000001400000002faf3e291435468607857694df5e45b6885186819000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 190000000100000010000000e843ac3b52ec8c297fa948c9b1fb2819030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d467e0000000100000008000000000063f58926d7011d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d86200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703080b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a00650063007400290000000f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb20000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 cmdinstall_138430009_eb.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 5c000000010000000400000000080000190000000100000010000000e843ac3b52ec8c297fa948c9b1fb2819030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d467e0000000100000008000000000063f58926d7011d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d86200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703080b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a00650063007400290000000f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb040000000100000010000000a7f2e41606411150306b9ce3b49cb0c920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 cmdinstall_138430009_eb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\6CD253D636A7B4D0E0981431BC064061A9853ED9 cfpconfg.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 4652 dragonsetup.exe 2340 isestart.exe 2340 isestart.exe 2340 isestart.exe 2340 isestart.exe 2340 isestart.exe 2340 isestart.exe 2340 isestart.exe 2340 isestart.exe 4332 msiexec.exe 4332 msiexec.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTcbPrivilege 1176 cmdinstall.exe Token: SeTcbPrivilege 224 cmdinstall_138430009_eb.exe Token: SeDebugPrivilege 224 cmdinstall_138430009_eb.exe Token: SeDebugPrivilege 2340 isestart.exe Token: SeDebugPrivilege 2340 isestart.exe Token: SeDebugPrivilege 2340 isestart.exe Token: SeDebugPrivilege 2340 isestart.exe Token: SeShutdownPrivilege 224 cmdinstall_138430009_eb.exe Token: SeIncreaseQuotaPrivilege 224 cmdinstall_138430009_eb.exe Token: SeSecurityPrivilege 4332 msiexec.exe Token: SeCreateTokenPrivilege 224 cmdinstall_138430009_eb.exe Token: SeAssignPrimaryTokenPrivilege 224 cmdinstall_138430009_eb.exe Token: SeLockMemoryPrivilege 224 cmdinstall_138430009_eb.exe Token: SeIncreaseQuotaPrivilege 224 cmdinstall_138430009_eb.exe Token: SeMachineAccountPrivilege 224 cmdinstall_138430009_eb.exe Token: SeTcbPrivilege 224 cmdinstall_138430009_eb.exe Token: SeSecurityPrivilege 224 cmdinstall_138430009_eb.exe Token: SeTakeOwnershipPrivilege 224 cmdinstall_138430009_eb.exe Token: SeLoadDriverPrivilege 224 cmdinstall_138430009_eb.exe Token: SeSystemProfilePrivilege 224 cmdinstall_138430009_eb.exe Token: SeSystemtimePrivilege 224 cmdinstall_138430009_eb.exe Token: SeProfSingleProcessPrivilege 224 cmdinstall_138430009_eb.exe Token: SeIncBasePriorityPrivilege 224 cmdinstall_138430009_eb.exe Token: SeCreatePagefilePrivilege 224 cmdinstall_138430009_eb.exe Token: SeCreatePermanentPrivilege 224 cmdinstall_138430009_eb.exe Token: SeBackupPrivilege 224 cmdinstall_138430009_eb.exe Token: SeRestorePrivilege 224 cmdinstall_138430009_eb.exe Token: SeShutdownPrivilege 224 cmdinstall_138430009_eb.exe Token: SeDebugPrivilege 224 cmdinstall_138430009_eb.exe Token: SeAuditPrivilege 224 cmdinstall_138430009_eb.exe Token: SeSystemEnvironmentPrivilege 224 cmdinstall_138430009_eb.exe Token: SeChangeNotifyPrivilege 224 cmdinstall_138430009_eb.exe Token: SeRemoteShutdownPrivilege 224 cmdinstall_138430009_eb.exe Token: SeUndockPrivilege 224 cmdinstall_138430009_eb.exe Token: SeSyncAgentPrivilege 224 cmdinstall_138430009_eb.exe Token: SeEnableDelegationPrivilege 224 cmdinstall_138430009_eb.exe Token: SeManageVolumePrivilege 224 cmdinstall_138430009_eb.exe Token: SeImpersonatePrivilege 224 cmdinstall_138430009_eb.exe Token: SeCreateGlobalPrivilege 224 cmdinstall_138430009_eb.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeTcbPrivilege 1420 MsiExec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeTcbPrivilege 1420 MsiExec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeTcbPrivilege 1420 MsiExec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeTcbPrivilege 1420 MsiExec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeTcbPrivilege 1420 MsiExec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeTcbPrivilege 2608 MsiExec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeTcbPrivilege 2608 MsiExec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4940 cmd_fw_installer_138430009_eb.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 224 cmdinstall_138430009_eb.exe 224 cmdinstall_138430009_eb.exe 224 cmdinstall_138430009_eb.exe 224 cmdinstall_138430009_eb.exe 2340 isestart.exe 2340 isestart.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4940 wrote to memory of 1176 4940 cmd_fw_installer_138430009_eb.exe 82 PID 4940 wrote to memory of 1176 4940 cmd_fw_installer_138430009_eb.exe 82 PID 4940 wrote to memory of 1176 4940 cmd_fw_installer_138430009_eb.exe 82 PID 1176 wrote to memory of 224 1176 cmdinstall.exe 83 PID 1176 wrote to memory of 224 1176 cmdinstall.exe 83 PID 1176 wrote to memory of 224 1176 cmdinstall.exe 83 PID 224 wrote to memory of 4652 224 cmdinstall_138430009_eb.exe 93 PID 224 wrote to memory of 4652 224 cmdinstall_138430009_eb.exe 93 PID 224 wrote to memory of 4652 224 cmdinstall_138430009_eb.exe 93 PID 4652 wrote to memory of 2620 4652 dragonsetup.exe 97 PID 4652 wrote to memory of 2620 4652 dragonsetup.exe 97 PID 4652 wrote to memory of 2620 4652 dragonsetup.exe 97 PID 2620 wrote to memory of 3260 2620 dragon.exe 98 PID 2620 wrote to memory of 3260 2620 dragon.exe 98 PID 2620 wrote to memory of 3260 2620 dragon.exe 98 PID 3260 wrote to memory of 3616 3260 dragon.exe 99 PID 3260 wrote to memory of 3616 3260 dragon.exe 99 PID 3260 wrote to memory of 3616 3260 dragon.exe 99 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 2620 wrote to memory of 4160 2620 dragon.exe 100 PID 4652 wrote to memory of 4052 4652 dragonsetup.exe 102 PID 4652 wrote to memory of 4052 4652 dragonsetup.exe 102 PID 4652 wrote to memory of 4052 4652 dragonsetup.exe 102 PID 224 wrote to memory of 1488 224 cmdinstall_138430009_eb.exe 104 PID 224 wrote to memory of 1488 224 cmdinstall_138430009_eb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\cmd_fw_installer_138430009_eb.exe"C:\Users\Admin\AppData\Local\Temp\cmd_fw_installer_138430009_eb.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe" -log -setupname "cmd_fw_installer_138430009_eb.exe" -sfx "C:\Users\Admin\AppData\Local\Temp" -theme lycia -type web -mode cfwfree2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks for any installed AV software in registry
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall_138430009_eb.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall_138430009_eb.exe" -log -theme "lycia" -setupname "cmd_fw_installer_138430009_eb.exe" -type "web" -mode "cfwfree" -sfx "C:\Users\Admin\AppData\Local\Temp" -logfile "C:\Users\Admin\AppData\Local\Temp\\cmdinstall.exe_22-09-25_17.47.38.log" -parent 1176 "Admin" 18643⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks for any installed AV software in registry
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:224 -
C:\ProgramData\Comodo Downloader\cis\download\installs\8050\xml_binaries\dragon\dragonsetup.exe"C:\ProgramData\Comodo Downloader\cis\download\installs\8050\xml_binaries\dragon\dragonsetup.exe" --silent --do-not-auto-launch --disable-secure-dns --defer-start-updateservice --cid=138430009 --cv=12.2.2.8012 --nt4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Program Files (x86)\Comodo\Dragon\dragon.exe"C:\Program Files (x86)\Comodo\Dragon\dragon.exe" --no-first-run --register-dragon-browser5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Program Files (x86)\Comodo\Dragon\dragon.exe"C:\Program Files (x86)\Comodo\Dragon\dragon.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Comodo\Dragon\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Comodo\Dragon\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Comodo\Dragon\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Comodo\Dragon\User Data" --annotation=plat=Win32 --annotation=prod=Dragon --annotation=ver=75.0.3770.100 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1d4,0x1e8,0x7071a250,0x7071a260,0x7071a26c6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Program Files (x86)\Comodo\Dragon\dragon.exe"C:\Program Files (x86)\Comodo\Dragon\dragon.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Comodo\Dragon\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Comodo\Dragon\User Data\Crashpad" --annotation=plat=Win32 --annotation=prod=Dragon --annotation=ver=75.0.3770.100 --initial-client-data=0x200,0x204,0x208,0x1f8,0x20c,0x4387f0,0x438800,0x43880c7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3616
-
-
-
C:\Program Files (x86)\Comodo\Dragon\dragon.exe"C:\Program Files (x86)\Comodo\Dragon\dragon.exe" --type=gpu-process --field-trial-handle=1644,17347105090028249957,10679344311844919078,131072 --gpu-preferences=KAAAAAAAAADgAgAwAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=11585275952041506385 --mojo-platform-channel-handle=1656 --ignored=" --type=renderer " /prefetch:26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4160
-
-
-
C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe"C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe" install -15⤵
- Executes dropped EXE
PID:4052
-
-
-
C:\ProgramData\Comodo\Installer\ise_installer.exe"C:\ProgramData\\Comodo\Installer\ise_installer.exe" /quiet /chid=138430009 /aff=1384300094⤵
- Executes dropped EXE
- Checks computer location settings
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\bin\ise_installer\isestart.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\bin\ise_installer\isestart.exe" /quiet /chid=138430009 /aff=1384300095⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2340
-
-
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
PID:2660
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Drops file in Drivers directory
- Registers COM server for autorun
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4332 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 8901CBF7A6AD0239135D78E5A3AFD4552⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1420
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding ECCA3862B5C68CB91443DE6C7BAEBB6C E Global\MSI00002⤵
- Drops file in Drivers directory
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2608 -
C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --langID 1033 --createConfig "active=fw;dplus=opt;esm=0;av=0;fw=1;cesfw=1;cesav=0;cessandbox=1;free=1;noalerts=1;cloud=1;sendstats=1;configfile=;fwstate=0;dfstate=0;avstate=0;bbstate=0;avservers=0;standalone=1;useblob=1;trustnewnets=0;"3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
PID:1380
-
-
C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --upgradeBackuped=""3⤵PID:3464
-
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r3⤵PID:652
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o4⤵PID:3888
-
-
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r3⤵PID:1468
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o4⤵PID:4812
-
-
-
-
C:\Windows\Installer\MSI56D9.tmp"C:\Windows\Installer\MSI56D9.tmp" -rptype 0 -descr "Installing COMODO Firewall" -logfile "C:\Users\Admin\AppData\Local\Temp\COMODO Internet Security dbgout.log"2⤵
- Executes dropped EXE
PID:3212 -
C:\Windows\Installer\MSI56D9.tmp"C:\Windows\Installer\MSI56D9.tmp" -rptype 0 -descr "Installing COMODO Firewall" -logfile "C:\Users\Admin\AppData\Local\Temp\COMODO Internet Security dbgout.log" -working3⤵
- Executes dropped EXE
PID:552 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:24⤵PID:5008
-
-
-
-
C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --installCertificates2⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
- Modifies system certificate store
PID:2484
-
-
C:\Windows\system32\regsvr32.exe"regsvr32.exe" /s "C:\Program Files\COMODO\COMODO Internet Security\cisresc.dll"2⤵
- Registers COM server for autorun
- Modifies registry class
PID:2836
-
-
C:\Windows\system32\regsvr32.exe"regsvr32.exe" /s "C:\Program Files\COMODO\COMODO Internet Security\cisbfps.dll"2⤵
- Registers COM server for autorun
- Modifies registry class
PID:4520
-
-
C:\Program Files\COMODO\COMODO Internet Security\cisbf.exe"C:\Program Files\COMODO\COMODO Internet Security\cisbf.exe" /RegServer2⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
PID:4024
-
-
C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --updateHtml2⤵
- Executes dropped EXE
- Enumerates connected drives
PID:3928
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1120
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵PID:4164
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files\COMODO\COMODO Internet Security\drivers\win10\inspect.inf" "9" "471514ecf" "0000000000000154" "WinSta0\Default" "00000000000000E8" "208" "C:\Program Files\COMODO\COMODO Internet Security\drivers\win10"2⤵PID:3792
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD57ab2202a75327a097a7f007283cc4ae2
SHA1855a518b2abd49cf5b04c01f9d1abe4b0bb164b3
SHA256d24935b73cc6a95d9a66cc7ef3648c4b8f43192ab14cc2c0bfa6ca992959c219
SHA51233f8afd8316df6071d32f51d11b8dea711895d38f6b0818b61e2c6fde1345782db5f71045354fbe6e7c397a6ad2058c7d309a3b099c331828953bb439448f262
-
Filesize
1.9MB
MD57ab2202a75327a097a7f007283cc4ae2
SHA1855a518b2abd49cf5b04c01f9d1abe4b0bb164b3
SHA256d24935b73cc6a95d9a66cc7ef3648c4b8f43192ab14cc2c0bfa6ca992959c219
SHA51233f8afd8316df6071d32f51d11b8dea711895d38f6b0818b61e2c6fde1345782db5f71045354fbe6e7c397a6ad2058c7d309a3b099c331828953bb439448f262
-
Filesize
1.9MB
MD57ab2202a75327a097a7f007283cc4ae2
SHA1855a518b2abd49cf5b04c01f9d1abe4b0bb164b3
SHA256d24935b73cc6a95d9a66cc7ef3648c4b8f43192ab14cc2c0bfa6ca992959c219
SHA51233f8afd8316df6071d32f51d11b8dea711895d38f6b0818b61e2c6fde1345782db5f71045354fbe6e7c397a6ad2058c7d309a3b099c331828953bb439448f262
-
Filesize
1.9MB
MD57ab2202a75327a097a7f007283cc4ae2
SHA1855a518b2abd49cf5b04c01f9d1abe4b0bb164b3
SHA256d24935b73cc6a95d9a66cc7ef3648c4b8f43192ab14cc2c0bfa6ca992959c219
SHA51233f8afd8316df6071d32f51d11b8dea711895d38f6b0818b61e2c6fde1345782db5f71045354fbe6e7c397a6ad2058c7d309a3b099c331828953bb439448f262
-
Filesize
2.2MB
MD5e8cc20617d1adc73fea895455f744f4e
SHA1f239535c76d475fca81413b2b09c8e4d2930baee
SHA256b85fadce340f8e3aba5db4a095b711a05505ded72378c870e78bddf034f32a51
SHA512a721adf625c8b2d3f6977ddce95d6aa3c15d16360d09d2e2268283ecf038dec303c194ca663f88e473749ece1605c11ee59a19bcf792d405785e6682948792e0
-
Filesize
2.2MB
MD5e8cc20617d1adc73fea895455f744f4e
SHA1f239535c76d475fca81413b2b09c8e4d2930baee
SHA256b85fadce340f8e3aba5db4a095b711a05505ded72378c870e78bddf034f32a51
SHA512a721adf625c8b2d3f6977ddce95d6aa3c15d16360d09d2e2268283ecf038dec303c194ca663f88e473749ece1605c11ee59a19bcf792d405785e6682948792e0
-
Filesize
2.2MB
MD5e8cc20617d1adc73fea895455f744f4e
SHA1f239535c76d475fca81413b2b09c8e4d2930baee
SHA256b85fadce340f8e3aba5db4a095b711a05505ded72378c870e78bddf034f32a51
SHA512a721adf625c8b2d3f6977ddce95d6aa3c15d16360d09d2e2268283ecf038dec303c194ca663f88e473749ece1605c11ee59a19bcf792d405785e6682948792e0
-
Filesize
86.9MB
MD55584e2a25c094a529e0349ccd0af6f10
SHA1ea6416c89d3c2361e34d9ce9dbb047315910d101
SHA2566798e0f7855777fc990a721a4d9e6ecc32cbdfaf112169701032282dc5960582
SHA5124001748dc60e4121e0dd151f5b776c1b1ec65039fa89b3376205f52f9f9605767a69472f7742a9f9b15a5ef14f72e5d1ffc741eb8ebe0179619e7c3174266239
-
Filesize
86.9MB
MD55584e2a25c094a529e0349ccd0af6f10
SHA1ea6416c89d3c2361e34d9ce9dbb047315910d101
SHA2566798e0f7855777fc990a721a4d9e6ecc32cbdfaf112169701032282dc5960582
SHA5124001748dc60e4121e0dd151f5b776c1b1ec65039fa89b3376205f52f9f9605767a69472f7742a9f9b15a5ef14f72e5d1ffc741eb8ebe0179619e7c3174266239
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5F26A2159BA21EA573A1C5E3DE2CF211_7541962669C96CEAB06421EC12621007
Filesize766B
MD517cfe62564a6b310227c5fc95378114a
SHA1c3a5418ffa08de215051be2e0769c0efde52583d
SHA2565b01d994181b300d81ceaa1dd0161abaab33bd2f087b159913efb5809af80768
SHA512aa6aa75a9739b6caf58cfbccdb6362e1f77f9a911681cca6f3f42dfd8b5c4346a7a78a59641ba0bd5ac8b1c9db6a0e2dee1594ca39611b0e9c33a6d86dd75412
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D11549FC90445E1CE90F96A21958A17_941A5BE5FAF3230B9FC294754AF2A1C3
Filesize509B
MD51159ed3ce95e32c6fe2352115b416b35
SHA1ef786f05960c7908dd21499d45d3f984131a949c
SHA2569ebd7cc2b9121fd382da780e84b859ced93d40e5b60b014980055a75b049b22f
SHA5122711543830960168ef79457517629e4eb5984c54901467071317bf9c363970288005c43399a5d64a31de58c8fc2cd71f354aba3365d53a66804c47599e5c9a4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5F26A2159BA21EA573A1C5E3DE2CF211_7541962669C96CEAB06421EC12621007
Filesize484B
MD5a28bedc78023ca121ff494de0a1a53be
SHA1b9348153bc8e8fa232cd54029325c9f7fdc1fd54
SHA256346dacf7e6dd6c1ff5c363651132f990f23191388f0c06804e66aaacc528841b
SHA51299228417a8eb7b6e36160fe683a8341ab26190379d389087fca108e4e03bb12fd03ec9506887b4a8f9ef939e3338dd6205fb9369eb9b62f6679b0e412efd539b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D11549FC90445E1CE90F96A21958A17_941A5BE5FAF3230B9FC294754AF2A1C3
Filesize490B
MD589d1e7f8b9c8d796b45556b83a4cd526
SHA1a1faa2ba84c3816eb94e9450fbba4f4f505bcb73
SHA256fcaba9c6c062d98e791f224aaa2daeb71a809e25fee5c7b4394d3ca9c19af135
SHA512853994ec68c56b05ffd4bc6634138937f1761cf2bb023a9a59f82cd177b15b18a77095cfe99dc9814b650311b34c0103646300dde3140e8642b83fed76b43b9b
-
Filesize
277KB
MD57baac18fb157c76574ca3d7a2f5eb193
SHA16460577ce621fa28133096073376f6a88f8acd61
SHA256347144ae998d96c6b8664abf56f3ff8cfa4dcdfd6e13205d7e8ee2f3b77eefc2
SHA512513cc213da81db470f8675c29162f4b724bb92a690edd451025eb68588971eebb937f88cc5a659222f2bbbd99440aa56800bf4167bb8912ea87a0b2648b002ea
-
Filesize
277KB
MD57baac18fb157c76574ca3d7a2f5eb193
SHA16460577ce621fa28133096073376f6a88f8acd61
SHA256347144ae998d96c6b8664abf56f3ff8cfa4dcdfd6e13205d7e8ee2f3b77eefc2
SHA512513cc213da81db470f8675c29162f4b724bb92a690edd451025eb68588971eebb937f88cc5a659222f2bbbd99440aa56800bf4167bb8912ea87a0b2648b002ea
-
Filesize
277KB
MD57baac18fb157c76574ca3d7a2f5eb193
SHA16460577ce621fa28133096073376f6a88f8acd61
SHA256347144ae998d96c6b8664abf56f3ff8cfa4dcdfd6e13205d7e8ee2f3b77eefc2
SHA512513cc213da81db470f8675c29162f4b724bb92a690edd451025eb68588971eebb937f88cc5a659222f2bbbd99440aa56800bf4167bb8912ea87a0b2648b002ea
-
Filesize
277KB
MD57baac18fb157c76574ca3d7a2f5eb193
SHA16460577ce621fa28133096073376f6a88f8acd61
SHA256347144ae998d96c6b8664abf56f3ff8cfa4dcdfd6e13205d7e8ee2f3b77eefc2
SHA512513cc213da81db470f8675c29162f4b724bb92a690edd451025eb68588971eebb937f88cc5a659222f2bbbd99440aa56800bf4167bb8912ea87a0b2648b002ea
-
Filesize
4.2MB
MD56d9aa26bb18af69dc74ae8e822eb53dd
SHA16ef20da9b9e70afa742f047f1c6f9d3e58290450
SHA256cf140523b8834de1c37efa29b02adcdc88babc0f8ee90ba93dd98c260d7036c3
SHA5123a9e8f15d207e98bb182f8d1838e93dba9750e6cfc79b72aab0706f969866447e50b3ab28bc1768a7cac7e7733cde80085cabcefefae0d287f08374578935c36
-
Filesize
4.2MB
MD56d9aa26bb18af69dc74ae8e822eb53dd
SHA16ef20da9b9e70afa742f047f1c6f9d3e58290450
SHA256cf140523b8834de1c37efa29b02adcdc88babc0f8ee90ba93dd98c260d7036c3
SHA5123a9e8f15d207e98bb182f8d1838e93dba9750e6cfc79b72aab0706f969866447e50b3ab28bc1768a7cac7e7733cde80085cabcefefae0d287f08374578935c36
-
Filesize
5.7MB
MD574cf93a3d559a630911fc94568b99e1e
SHA1a5f164154e164174c715e493f440b1935ec53af8
SHA256fe82eb2103b177370e742aee40a2b840805516ff23867f6b9bd3655a401eb50b
SHA512c000d512e270d7f89058fe52a3ecfac6f60462eed21b134ebb57640cc6425e7ece9b6ce683acc666d8358875c8d621497a8e3eb95b4ad72311efb9d12c03100a
-
Filesize
5.7MB
MD574cf93a3d559a630911fc94568b99e1e
SHA1a5f164154e164174c715e493f440b1935ec53af8
SHA256fe82eb2103b177370e742aee40a2b840805516ff23867f6b9bd3655a401eb50b
SHA512c000d512e270d7f89058fe52a3ecfac6f60462eed21b134ebb57640cc6425e7ece9b6ce683acc666d8358875c8d621497a8e3eb95b4ad72311efb9d12c03100a
-
Filesize
5.7MB
MD574cf93a3d559a630911fc94568b99e1e
SHA1a5f164154e164174c715e493f440b1935ec53af8
SHA256fe82eb2103b177370e742aee40a2b840805516ff23867f6b9bd3655a401eb50b
SHA512c000d512e270d7f89058fe52a3ecfac6f60462eed21b134ebb57640cc6425e7ece9b6ce683acc666d8358875c8d621497a8e3eb95b4ad72311efb9d12c03100a
-
Filesize
367KB
MD5a4b3e07a9d407bca7a0ed76ea7c4945f
SHA1af16d87110e2f9e64d5c35a6d522151b69377bbc
SHA256b115a17e7500dbc34cce1f8e84a59f072a26ad49be5dcde6ac5908e4d2ad3555
SHA51277c6ba298f5bd4c04192660d365d2a45ecb23fa441818735bd01050677037e1976670dcb457b6684343fbccb02a6fcfd98f22ae9f2de263057157917ee28d981
-
Filesize
5KB
MD5b80eda6258e28b537651f8e5ebd997ff
SHA1826741e138e8342f4bc3303838e347a44bb93546
SHA2566e960dfed451c2dfb99352d25d3df8dd46fe7d80c9af79805c0cfbd1a99a2709
SHA5129fce1cb5fe8b6a2bc4d13c1ca3ec31c926c6dd33717f145da6952ae33144eb11a6ee9e751e1d3e2d5d6ce7768e9f9602773a917d9f5f8473670e6d631b932b74
-
Filesize
764KB
MD57b85f91536c8342ac64d3edece2af7fe
SHA11e28c62364f606f03078e985222a2e3400a483c6
SHA256918e7aad857776a895ecdf850665c355026882bcf1e0eba279ff4f7aa4b6bbae
SHA51242cbaca95018eba8b05d3d586dbe8537ec1130af9edd813c4e7affef88c804a4ae65d9a446a95326508cd21da03a7e6a7969f6de5a68e69ce86c827f4308ac5a
-
Filesize
10KB
MD5a796b7e767a14497c29f40c75e61c5d5
SHA1e2055cab3d6e81baef092e5c66b7a68e0f246585
SHA256bbd166f1675c40d6376ca71c25658db321170dedf35e06f3dbfc821db336cf6e
SHA512586a7a8de7a0934ddfd12dbf657f21bd989991af960705c3f059074ddbf05f7b322ace7b5be003585c59cd4cde3d68a5f1ec450fda6e9557d7fc08556baefaa3
-
Filesize
12KB
MD5e378224790dc97b0b3045a5c5326f203
SHA160ab41d4b32b7778481c8f8e1dfc570dccd9098e
SHA256ed4054fa42caf43da96c6284103c457a0ebfeb58b68a7849d03bc5bae70fedd9
SHA512e08a18d3da16ffc30d9912a64d5fc8c004644a8ab4d96f2d51b2111de2f046ff7d158c678460fb911a363b873476b2c7b725e4f74fbe3927514f64400856bb78
-
Filesize
12KB
MD5e378224790dc97b0b3045a5c5326f203
SHA160ab41d4b32b7778481c8f8e1dfc570dccd9098e
SHA256ed4054fa42caf43da96c6284103c457a0ebfeb58b68a7849d03bc5bae70fedd9
SHA512e08a18d3da16ffc30d9912a64d5fc8c004644a8ab4d96f2d51b2111de2f046ff7d158c678460fb911a363b873476b2c7b725e4f74fbe3927514f64400856bb78
-
Filesize
12KB
MD5e378224790dc97b0b3045a5c5326f203
SHA160ab41d4b32b7778481c8f8e1dfc570dccd9098e
SHA256ed4054fa42caf43da96c6284103c457a0ebfeb58b68a7849d03bc5bae70fedd9
SHA512e08a18d3da16ffc30d9912a64d5fc8c004644a8ab4d96f2d51b2111de2f046ff7d158c678460fb911a363b873476b2c7b725e4f74fbe3927514f64400856bb78
-
Filesize
12KB
MD5e378224790dc97b0b3045a5c5326f203
SHA160ab41d4b32b7778481c8f8e1dfc570dccd9098e
SHA256ed4054fa42caf43da96c6284103c457a0ebfeb58b68a7849d03bc5bae70fedd9
SHA512e08a18d3da16ffc30d9912a64d5fc8c004644a8ab4d96f2d51b2111de2f046ff7d158c678460fb911a363b873476b2c7b725e4f74fbe3927514f64400856bb78
-
Filesize
12KB
MD5e378224790dc97b0b3045a5c5326f203
SHA160ab41d4b32b7778481c8f8e1dfc570dccd9098e
SHA256ed4054fa42caf43da96c6284103c457a0ebfeb58b68a7849d03bc5bae70fedd9
SHA512e08a18d3da16ffc30d9912a64d5fc8c004644a8ab4d96f2d51b2111de2f046ff7d158c678460fb911a363b873476b2c7b725e4f74fbe3927514f64400856bb78
-
Filesize
12KB
MD5e378224790dc97b0b3045a5c5326f203
SHA160ab41d4b32b7778481c8f8e1dfc570dccd9098e
SHA256ed4054fa42caf43da96c6284103c457a0ebfeb58b68a7849d03bc5bae70fedd9
SHA512e08a18d3da16ffc30d9912a64d5fc8c004644a8ab4d96f2d51b2111de2f046ff7d158c678460fb911a363b873476b2c7b725e4f74fbe3927514f64400856bb78
-
Filesize
2.2MB
MD5493664f7387714f6edc32b3f0cf51357
SHA1f033c54d581c996e7efa44bbfd775ee0689b61ea
SHA2560865eaf55253dc9d5b0b94e57147bb6a2577f14959627be13acf4ac1cdbb7139
SHA512b7a055d3cec1b57d7ba3ddf035ef88fcae2682501c925295391919f2d79c264b47986aff9d28f8354379716906d9270deb3d546caa64aeb07dd6e3e69889ee4e
-
Filesize
2.2MB
MD5493664f7387714f6edc32b3f0cf51357
SHA1f033c54d581c996e7efa44bbfd775ee0689b61ea
SHA2560865eaf55253dc9d5b0b94e57147bb6a2577f14959627be13acf4ac1cdbb7139
SHA512b7a055d3cec1b57d7ba3ddf035ef88fcae2682501c925295391919f2d79c264b47986aff9d28f8354379716906d9270deb3d546caa64aeb07dd6e3e69889ee4e
-
Filesize
2.2MB
MD5493664f7387714f6edc32b3f0cf51357
SHA1f033c54d581c996e7efa44bbfd775ee0689b61ea
SHA2560865eaf55253dc9d5b0b94e57147bb6a2577f14959627be13acf4ac1cdbb7139
SHA512b7a055d3cec1b57d7ba3ddf035ef88fcae2682501c925295391919f2d79c264b47986aff9d28f8354379716906d9270deb3d546caa64aeb07dd6e3e69889ee4e
-
Filesize
2.2MB
MD5493664f7387714f6edc32b3f0cf51357
SHA1f033c54d581c996e7efa44bbfd775ee0689b61ea
SHA2560865eaf55253dc9d5b0b94e57147bb6a2577f14959627be13acf4ac1cdbb7139
SHA512b7a055d3cec1b57d7ba3ddf035ef88fcae2682501c925295391919f2d79c264b47986aff9d28f8354379716906d9270deb3d546caa64aeb07dd6e3e69889ee4e
-
Filesize
2.2MB
MD5493664f7387714f6edc32b3f0cf51357
SHA1f033c54d581c996e7efa44bbfd775ee0689b61ea
SHA2560865eaf55253dc9d5b0b94e57147bb6a2577f14959627be13acf4ac1cdbb7139
SHA512b7a055d3cec1b57d7ba3ddf035ef88fcae2682501c925295391919f2d79c264b47986aff9d28f8354379716906d9270deb3d546caa64aeb07dd6e3e69889ee4e
-
Filesize
2.2MB
MD5493664f7387714f6edc32b3f0cf51357
SHA1f033c54d581c996e7efa44bbfd775ee0689b61ea
SHA2560865eaf55253dc9d5b0b94e57147bb6a2577f14959627be13acf4ac1cdbb7139
SHA512b7a055d3cec1b57d7ba3ddf035ef88fcae2682501c925295391919f2d79c264b47986aff9d28f8354379716906d9270deb3d546caa64aeb07dd6e3e69889ee4e
-
Filesize
2.2MB
MD5493664f7387714f6edc32b3f0cf51357
SHA1f033c54d581c996e7efa44bbfd775ee0689b61ea
SHA2560865eaf55253dc9d5b0b94e57147bb6a2577f14959627be13acf4ac1cdbb7139
SHA512b7a055d3cec1b57d7ba3ddf035ef88fcae2682501c925295391919f2d79c264b47986aff9d28f8354379716906d9270deb3d546caa64aeb07dd6e3e69889ee4e
-
Filesize
2.2MB
MD5493664f7387714f6edc32b3f0cf51357
SHA1f033c54d581c996e7efa44bbfd775ee0689b61ea
SHA2560865eaf55253dc9d5b0b94e57147bb6a2577f14959627be13acf4ac1cdbb7139
SHA512b7a055d3cec1b57d7ba3ddf035ef88fcae2682501c925295391919f2d79c264b47986aff9d28f8354379716906d9270deb3d546caa64aeb07dd6e3e69889ee4e
-
Filesize
2.2MB
MD5493664f7387714f6edc32b3f0cf51357
SHA1f033c54d581c996e7efa44bbfd775ee0689b61ea
SHA2560865eaf55253dc9d5b0b94e57147bb6a2577f14959627be13acf4ac1cdbb7139
SHA512b7a055d3cec1b57d7ba3ddf035ef88fcae2682501c925295391919f2d79c264b47986aff9d28f8354379716906d9270deb3d546caa64aeb07dd6e3e69889ee4e
-
Filesize
2.2MB
MD5493664f7387714f6edc32b3f0cf51357
SHA1f033c54d581c996e7efa44bbfd775ee0689b61ea
SHA2560865eaf55253dc9d5b0b94e57147bb6a2577f14959627be13acf4ac1cdbb7139
SHA512b7a055d3cec1b57d7ba3ddf035ef88fcae2682501c925295391919f2d79c264b47986aff9d28f8354379716906d9270deb3d546caa64aeb07dd6e3e69889ee4e
-
Filesize
2.2MB
MD5493664f7387714f6edc32b3f0cf51357
SHA1f033c54d581c996e7efa44bbfd775ee0689b61ea
SHA2560865eaf55253dc9d5b0b94e57147bb6a2577f14959627be13acf4ac1cdbb7139
SHA512b7a055d3cec1b57d7ba3ddf035ef88fcae2682501c925295391919f2d79c264b47986aff9d28f8354379716906d9270deb3d546caa64aeb07dd6e3e69889ee4e
-
Filesize
2.2MB
MD5493664f7387714f6edc32b3f0cf51357
SHA1f033c54d581c996e7efa44bbfd775ee0689b61ea
SHA2560865eaf55253dc9d5b0b94e57147bb6a2577f14959627be13acf4ac1cdbb7139
SHA512b7a055d3cec1b57d7ba3ddf035ef88fcae2682501c925295391919f2d79c264b47986aff9d28f8354379716906d9270deb3d546caa64aeb07dd6e3e69889ee4e
-
Filesize
2.2MB
MD5493664f7387714f6edc32b3f0cf51357
SHA1f033c54d581c996e7efa44bbfd775ee0689b61ea
SHA2560865eaf55253dc9d5b0b94e57147bb6a2577f14959627be13acf4ac1cdbb7139
SHA512b7a055d3cec1b57d7ba3ddf035ef88fcae2682501c925295391919f2d79c264b47986aff9d28f8354379716906d9270deb3d546caa64aeb07dd6e3e69889ee4e
-
Filesize
2.2MB
MD5493664f7387714f6edc32b3f0cf51357
SHA1f033c54d581c996e7efa44bbfd775ee0689b61ea
SHA2560865eaf55253dc9d5b0b94e57147bb6a2577f14959627be13acf4ac1cdbb7139
SHA512b7a055d3cec1b57d7ba3ddf035ef88fcae2682501c925295391919f2d79c264b47986aff9d28f8354379716906d9270deb3d546caa64aeb07dd6e3e69889ee4e
-
Filesize
2.2MB
MD5493664f7387714f6edc32b3f0cf51357
SHA1f033c54d581c996e7efa44bbfd775ee0689b61ea
SHA2560865eaf55253dc9d5b0b94e57147bb6a2577f14959627be13acf4ac1cdbb7139
SHA512b7a055d3cec1b57d7ba3ddf035ef88fcae2682501c925295391919f2d79c264b47986aff9d28f8354379716906d9270deb3d546caa64aeb07dd6e3e69889ee4e
-
Filesize
2.2MB
MD5493664f7387714f6edc32b3f0cf51357
SHA1f033c54d581c996e7efa44bbfd775ee0689b61ea
SHA2560865eaf55253dc9d5b0b94e57147bb6a2577f14959627be13acf4ac1cdbb7139
SHA512b7a055d3cec1b57d7ba3ddf035ef88fcae2682501c925295391919f2d79c264b47986aff9d28f8354379716906d9270deb3d546caa64aeb07dd6e3e69889ee4e
-
Filesize
2.2MB
MD5493664f7387714f6edc32b3f0cf51357
SHA1f033c54d581c996e7efa44bbfd775ee0689b61ea
SHA2560865eaf55253dc9d5b0b94e57147bb6a2577f14959627be13acf4ac1cdbb7139
SHA512b7a055d3cec1b57d7ba3ddf035ef88fcae2682501c925295391919f2d79c264b47986aff9d28f8354379716906d9270deb3d546caa64aeb07dd6e3e69889ee4e
-
Filesize
2.2MB
MD5493664f7387714f6edc32b3f0cf51357
SHA1f033c54d581c996e7efa44bbfd775ee0689b61ea
SHA2560865eaf55253dc9d5b0b94e57147bb6a2577f14959627be13acf4ac1cdbb7139
SHA512b7a055d3cec1b57d7ba3ddf035ef88fcae2682501c925295391919f2d79c264b47986aff9d28f8354379716906d9270deb3d546caa64aeb07dd6e3e69889ee4e
-
Filesize
2.2MB
MD5493664f7387714f6edc32b3f0cf51357
SHA1f033c54d581c996e7efa44bbfd775ee0689b61ea
SHA2560865eaf55253dc9d5b0b94e57147bb6a2577f14959627be13acf4ac1cdbb7139
SHA512b7a055d3cec1b57d7ba3ddf035ef88fcae2682501c925295391919f2d79c264b47986aff9d28f8354379716906d9270deb3d546caa64aeb07dd6e3e69889ee4e
-
Filesize
2.0MB
MD5993f653773ff7e5ba536e65f03fa45e7
SHA1ef2f3bed5504af5fb6373b63c7f8491e190578b6
SHA256af90ef33c9afca6a72c211c08679f0d2f0932f84dffdd8f1d0eef561944cfec2
SHA512b9ae9b2e43e0b228ea7d8b60ccb7d8e7036313f1b7909ee033c44a854a92f3afc5810a5bee535606c95e03c2940ea6745f1008b2271822e4fa31a87f887409d9
-
Filesize
2.0MB
MD5993f653773ff7e5ba536e65f03fa45e7
SHA1ef2f3bed5504af5fb6373b63c7f8491e190578b6
SHA256af90ef33c9afca6a72c211c08679f0d2f0932f84dffdd8f1d0eef561944cfec2
SHA512b9ae9b2e43e0b228ea7d8b60ccb7d8e7036313f1b7909ee033c44a854a92f3afc5810a5bee535606c95e03c2940ea6745f1008b2271822e4fa31a87f887409d9
-
Filesize
2.0MB
MD5993f653773ff7e5ba536e65f03fa45e7
SHA1ef2f3bed5504af5fb6373b63c7f8491e190578b6
SHA256af90ef33c9afca6a72c211c08679f0d2f0932f84dffdd8f1d0eef561944cfec2
SHA512b9ae9b2e43e0b228ea7d8b60ccb7d8e7036313f1b7909ee033c44a854a92f3afc5810a5bee535606c95e03c2940ea6745f1008b2271822e4fa31a87f887409d9
-
Filesize
11KB
MD50ff2d70cfdc8095ea99ca2dabbec3cd7
SHA110c51496d37cecd0e8a503a5a9bb2329d9b38116
SHA256982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
SHA512cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
-
Filesize
7KB
MD578b913fcd04259634a5e901c616e6074
SHA1ad5e1c651851a1125bcad79b01ccdcfa45df4799
SHA256e3ce60666bb88c2412615ef9f432ec24e219532dee5cc1c7aebc65ed9ec94d59
SHA512cbe07179dd93011f3d9a8f83541961ff34fb83d96658ac82a433ef0aa3399b183eaec3e6a49ec1c1e478d1eada2d3ebc78ffb1ae0574984ae66a7a9cab5d59e5
-
Filesize
22KB
MD5fbe588b15eb1bd86defade69f796b56f
SHA12f63cf44039addddb22c2c0497673b49e6b3ad7a
SHA25631144e8b156fe87317073c48a09abcb033fda8dbdd96986c4abea8c00c00355f
SHA512e1a9e29e4c62e77a2ec2c539344f0b5a8cd67ca3fd8dfefb0b0666a992eb2fabadb0034d439c4adbbdffd9c9439f23ee5757fac0ed669d3c9db48f50c677143d
-
Filesize
22KB
MD5fbe588b15eb1bd86defade69f796b56f
SHA12f63cf44039addddb22c2c0497673b49e6b3ad7a
SHA25631144e8b156fe87317073c48a09abcb033fda8dbdd96986c4abea8c00c00355f
SHA512e1a9e29e4c62e77a2ec2c539344f0b5a8cd67ca3fd8dfefb0b0666a992eb2fabadb0034d439c4adbbdffd9c9439f23ee5757fac0ed669d3c9db48f50c677143d
-
Filesize
22KB
MD5fbe588b15eb1bd86defade69f796b56f
SHA12f63cf44039addddb22c2c0497673b49e6b3ad7a
SHA25631144e8b156fe87317073c48a09abcb033fda8dbdd96986c4abea8c00c00355f
SHA512e1a9e29e4c62e77a2ec2c539344f0b5a8cd67ca3fd8dfefb0b0666a992eb2fabadb0034d439c4adbbdffd9c9439f23ee5757fac0ed669d3c9db48f50c677143d
-
Filesize
22KB
MD5fbe588b15eb1bd86defade69f796b56f
SHA12f63cf44039addddb22c2c0497673b49e6b3ad7a
SHA25631144e8b156fe87317073c48a09abcb033fda8dbdd96986c4abea8c00c00355f
SHA512e1a9e29e4c62e77a2ec2c539344f0b5a8cd67ca3fd8dfefb0b0666a992eb2fabadb0034d439c4adbbdffd9c9439f23ee5757fac0ed669d3c9db48f50c677143d
-
Filesize
22KB
MD5fbe588b15eb1bd86defade69f796b56f
SHA12f63cf44039addddb22c2c0497673b49e6b3ad7a
SHA25631144e8b156fe87317073c48a09abcb033fda8dbdd96986c4abea8c00c00355f
SHA512e1a9e29e4c62e77a2ec2c539344f0b5a8cd67ca3fd8dfefb0b0666a992eb2fabadb0034d439c4adbbdffd9c9439f23ee5757fac0ed669d3c9db48f50c677143d
-
Filesize
22KB
MD5fbe588b15eb1bd86defade69f796b56f
SHA12f63cf44039addddb22c2c0497673b49e6b3ad7a
SHA25631144e8b156fe87317073c48a09abcb033fda8dbdd96986c4abea8c00c00355f
SHA512e1a9e29e4c62e77a2ec2c539344f0b5a8cd67ca3fd8dfefb0b0666a992eb2fabadb0034d439c4adbbdffd9c9439f23ee5757fac0ed669d3c9db48f50c677143d
-
Filesize
22KB
MD5fbe588b15eb1bd86defade69f796b56f
SHA12f63cf44039addddb22c2c0497673b49e6b3ad7a
SHA25631144e8b156fe87317073c48a09abcb033fda8dbdd96986c4abea8c00c00355f
SHA512e1a9e29e4c62e77a2ec2c539344f0b5a8cd67ca3fd8dfefb0b0666a992eb2fabadb0034d439c4adbbdffd9c9439f23ee5757fac0ed669d3c9db48f50c677143d
-
Filesize
22KB
MD5fbe588b15eb1bd86defade69f796b56f
SHA12f63cf44039addddb22c2c0497673b49e6b3ad7a
SHA25631144e8b156fe87317073c48a09abcb033fda8dbdd96986c4abea8c00c00355f
SHA512e1a9e29e4c62e77a2ec2c539344f0b5a8cd67ca3fd8dfefb0b0666a992eb2fabadb0034d439c4adbbdffd9c9439f23ee5757fac0ed669d3c9db48f50c677143d