Analysis
-
max time kernel
161s -
max time network
178s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 21:29
Static task
static1
Behavioral task
behavioral1
Sample
cispro_installer.exe
Resource
win7-20231215-en
Errors
General
-
Target
cispro_installer.exe
-
Size
130.9MB
-
MD5
7a16f1c82fe0a4aebb407312c308d9cd
-
SHA1
2ba4a025b28f944a1ff1275d5c05d5b0f611ea9b
-
SHA256
956b78ee9a10a0135ea4109e9005eb6be548278b8f5eb954f919a13405c381c2
-
SHA512
259f0effd5fc870fd308674f999514d01b1c818fefb1afd872011b84223d2be7f670443ba966e7ba7f5d6f67b40f84460a5518877b563f1420eef42791ec6b13
-
SSDEEP
3145728:i9nIItCG97RhbEdj7IRKLdsD37aAHF9Pon2104JonKC:iSICG97R5wjxZymAHFRI21C
Malware Config
Signatures
-
Drops file in Drivers directory 14 IoCs
description ioc Process File opened for modification C:\Windows\system32\DRIVERS\cmdguard.sys MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\SETFF08.tmp MsiExec.exe File created C:\Windows\system32\Drivers\cmdhlp.sys msiexec.exe File created C:\Windows\system32\DRIVERS\SETFF07.tmp MsiExec.exe File created C:\Windows\system32\DRIVERS\SETFF08.tmp MsiExec.exe File created C:\Windows\system32\DRIVERS\SET7580.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\inspect.sys MsiExec.exe File created C:\Windows\system32\Drivers\cmderd.sys msiexec.exe File created C:\Windows\system32\Drivers\inspect.sys msiexec.exe File opened for modification C:\Windows\system32\DRIVERS\SET7580.tmp MsiExec.exe File created C:\Windows\system32\Drivers\cmdGuard.sys msiexec.exe File opened for modification C:\Windows\system32\DRIVERS\cmderd.sys MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\SETFF07.tmp MsiExec.exe File created C:\Windows\system32\drivers\isedrv.sys isestart.exe -
Manipulates Digital Signatures 1 TTPs 10 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E35E6F46A1A9A4D18A4DAA298BDA4D1E8879236E\Blob = 0f0000000100000014000000e3b244cda88b1ab5a7dc09039d0c3142ae6361e7030000000100000014000000e35e6f46a1a9a4d18a4daa298bda4d1e8879236e20000000010000005f0500003082055b30820443a003020102021100d9218e2757ec45d84ec08b3e6700c85e300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3138313231313030303030305a170d3139303730373233353935395a3081a8310b3009060355040613025553310e300c06035504110c053037303133310b300906035504080c024e4a3110300e06035504070c07436c6966746f6e3116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100b73a668ff7984c8d990d7c6e51df5176c7842cc1bf351c27286c6139f4831fc718a35b0fa9145f0887de8bce335e8e3e12fce763cab5deeae08e0bf325cd79a4fbb328d7c7f7d53de51bd3c05c5966b634a9b1fc4362afd0267f927dd90a52b6a5f5f0e29c8e94dfe4199b2cf31142bb480e95ecb92b6ca20ecd71ff210df9655e9e9ac856ad7aab929b843052d4a21c27ea4054a9f4e8c4cd88943b1a4d3a58b3e06eb654c6c09cef472d6fb0d05a841ce229b53a5d36bd08cbfdc552f7c758efaa7824c1d27e30a83d7a9cecaab4bd91b2cbd60d1335fc4ac0f0294dd2eeb3f65139467761f091840246ff644edbfacb9ffd7ef2823fd9eea312dd299a39af0203010001a38201aa308201a6301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604147c4f2b645af103043ca7675e8c129c16dee7164c300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d301f0603551d1104183016811473636f742e7765697240636f6d6f646f2e636f6d300d06092a864886f70d01010505000382010100b33c0fee4668b9e86cd777fa94eb47dcaee7fb5b9b897b9458b12e511a194b6ad495ea4b6b820d1c7cd26badf92cfc13aaa9e66157a55545c7ea71460a4fa4e30e46b9ac16a36e94a1fcbc62b2abe402d2a58773344c4b23a0d907a9760029595421e478da67167f80876012443cd22573dc3806cdedbc6c8c4ed255bd926cecc7796ec36fb225d084f31afb5e5a2e86d26149212dda8aed2058ef0d7e7e677b463a7722431a0b5c0b9dc385b7d2e73bd781ee111c8f7e36d76e1db1f6ac98784227ed97cde3762d079741984d146a8ff96e411c1b1e4e711cd00a6150532ffaa13702a81f4514eae48ca0b98d8642a6cfe7711dc67d1b857bfecb4e863bc1f9 cmdagent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\6CD253D636A7B4D0E0981431BC064061A9853ED9\Blob = 0300000001000000140000006cd253d636a7b4d0e0981431bc064061a9853ed920000000010000001b06000030820617308204ffa003020102021032327facb1bd6f1fa93473ccc515fd82300d06092a864886f70d01010b0500308191310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564313730350603550403132e434f4d4f444f2052534120457874656e6465642056616c69646174696f6e20436f6465205369676e696e67204341301e170d3138303132343030303030305a170d3231303132333233353935395a308201153110300e060355040513073339313038303531133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e311a301806035504090c11313235352042726f61642053747265657431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100b7713778a66667b8cd67f828f378f80a5507c4e8aa143cfd5b9b953ab16d04a965dcd386a35efe8378c1e0e5ceaf124f188102958962014e493cd80f11fc2ba339953a8bb71a9f030ebbe8742b4252ab465a2d41a829508a9eef5d34d171fcf0b5be026fe15e1a70288b2ecd4af1332924d53c0eefe5c7033482769cae8b5c5e8d59033fac40e94d714c5cd05e8db6f0edb71bb26565d52a025f35323203e9a7846d00a235f973d1e43f29a81dcd1bfef625d373f94a51cc8d2be8ee69702a73a694da69d9b0fbae7d1dee353683a2037a2019b9260a1b53f6c89d945b384c275670bdfac333301504af00749373356a1e7a422eb9363bdab713f9ad6b5bb1970203010001a38201e2308201de301f0603551d23041830168014df8ff3200ce9caa604d85b58372a3dab46dc8349301d0603551d0e04160414e18081b3e9396b7109e8b2add6c3d20ebf4b4814300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010601302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f43505330550603551d1f044e304c304aa048a0468644687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e63726c30818606082b06010505070101047a3078305006082b060105050730028644687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33393130383035300d06092a864886f70d01010b050003820101004bc17929ea82f3c4787f7b29b69edb09e169797a9f4cd233f035412d2b9c586e352d2c0d1cd530a946a91ccd8858453573f0b45a0cdc743d662af4761420489adadbd9a84915b697f96ed1e49786c53000eb12555d3b2957eec18279326020737e2e3e4d621856026169ad6f6cf18ee7b59d5b6a7e6d8c252fa1a15363ec89a6efe5efdf4b260ad35c6a0e1db0250d1eb66ea7b91f15e0f57ecc0541e1ad74a2069f717dec0b1f03101b6812c13f64264f8c40a3614ffb8ccabedb974cda14eb50c061d5cd23dc7735cd0bcfdcef3fd178c1f95594a591031d05c8554cb5fe6fd23cb95931bf847f5b525a269aeac0336313e8f6e81ccb1692d86993724f709e cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\16232A798863E5950F9F44977A033CF91793D8F1\Blob = 03000000010000001400000016232a798863e5950f9f44977a033cf91793d8f1200000000100000016070000308207123082057aa00302010202101f734d111b4b5c879bbd5a8c49ab2a90300d06092a864886f70d01010b05003057310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312e302c060355040313255365637469676f205075626c696320436f6465205369676e696e6720434120455620523336301e170d3231313230373030303030305a170d3234313230363233353935395a3081da311330110603550405130a3034303037353135383831133011060b2b0601040182373c02010313025553311b3019060b2b0601040182373c020102130a4e6577204a6572736579311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b30090603550406130255533113301106035504080c0a4e6577204a657273657931273025060355040a0c1e436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e633127302506035504030c1e436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e6330820222300d06092a864886f70d01010105000382020f003082020a0282020100bf278efbb1f070dd512156b387a02946060750ffadb5b00c8a316c6254ccf52787727318f46a676cc12035adfb89cef7c4c4bbefa84627362f58e1b96b6b281fc01535419a7715dd92995ecf8deb4c8291427657bdcbee99fc260f482b91478a76bcf1c50b114be347a43c8a35091d8371e562b1c16f68370f851e037373ff9c00177845d2d5b6da2aaaf808cf9ff1a3a6eda561286e25fa2c0d7e9ae0c7f0c04e1df0baf6f5b6ac0f01940f2a14e467f77505d14c84f45121d45d5c4552ac5eb24fef6bc520ace00bac3aeab817f8fa995b3111a202397031bf4b25dd89e2ba5cf8b9b6b5a521deee25a4e6529c869873414796bbc28f6d3ed733d339b26dd10a3a0e2d43eb9815e1b33fb6a48f0ad3fe196ecb20207862249a5456601c09f1e344453cad88350bb392a74a899f716e018c40cac5fd3f9b691261e3528f51ae70a28b00271c5a540ec387e778f75a4ceabfd34f9b17d6a76481240727ba17973f3746e175ab4cae3f9b28dfad2a842a220491f66956ae90f8b44c343ccbb8cd6ae46eb19aa6f6ae55687129eb473a3111d1db67d708955afacc070e048b5aab7587a732bc77c9a66c72c604a4ae96ee00d38d492af000d6099cce5bd9b7c42554e74ad2091f79baea8cd4b92d092f89a294ebf5ddb785a39b21c1befd7faecc58a6e99022139f7120753a4cdb4b98e700a08dd850224d67c8aa811cd61d63950203010001a38201d4308201d0301f0603551d23041830168014813292412b28cd46c8c4a2c62a3912ec48a93f14301d0603551d0e041604145d9262d74ec55663e2d856b3702cca554d2809fd300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030490603551d20044230403035060c2b06010401b23101020106013025302306082b06010505070201161768747470733a2f2f7365637469676f2e636f6d2f4350533007060567810c0103304b0603551d1f044430423040a03ea03c863a687474703a2f2f63726c2e7365637469676f2e636f6d2f5365637469676f5075626c6963436f64655369676e696e67434145565233362e63726c307b06082b06010505070101046f306d304606082b06010505073002863a687474703a2f2f6372742e7365637469676f2e636f6d2f5365637469676f5075626c6963436f64655369676e696e67434145565233362e637274302306082b060105050730018617687474703a2f2f6f6373702e7365637469676f2e636f6d30330603551d11042c302aa02806082b06010505070803a01c301a0c1855532d4e4557204a45525345592d30343030373531353838300d06092a864886f70d01010b0500038201810000b6abcb859749fe5bea2213f31cfe6db00bb221447b7f781d40982487806bdb7b711b08b210fec553172e5492ed62cd4eb3c63f4352c33d87e3aaf9265287438c0cfa8183b68cdf6a52df3094b4fb4fc01a82e39292fc5c2525f30f5da0077e8b37879c9c33a46b34cda70fdd89e87cec6f9b320aa3ec145b2843af9ff9cdf5d7030b3b34b5e1436b06ed64f2358de7e894dc929e7d218a2c362c4b2a78f0852e9bc55fcb805c86b407879bd4d1cc8d24b3a647ad85cdbd19fd29f030e1976a5369e550b780dc853824d4f031f69afd1a4967ec5f3871443f8b55d40c6ce0049d5af7c2d6f3f1df0471e0d47daa19a010cc08489dd330c8aa036c63ec148a37b855e6e2cbe7993d3bc17459ba47251c568c80468c8c8eeef2b561903a64c54472284333302f8e957906f9fa7af48afd60d63886595389b305e9b2cae6547efc2e85a5a382e7abef4d5efcfc3e8a0320a1c7e6bd5b8b68f5a4931b5bdb6e0200e502becdd39258d1df1b7f0ead70b94c06e329ea1d9e52f32104c7c0b3a26d5b cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E35E6F46A1A9A4D18A4DAA298BDA4D1E8879236E\Blob = 030000000100000014000000e35e6f46a1a9a4d18a4daa298bda4d1e8879236e20000000010000005f0500003082055b30820443a003020102021100d9218e2757ec45d84ec08b3e6700c85e300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3138313231313030303030305a170d3139303730373233353935395a3081a8310b3009060355040613025553310e300c06035504110c053037303133310b300906035504080c024e4a3110300e06035504070c07436c6966746f6e3116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100b73a668ff7984c8d990d7c6e51df5176c7842cc1bf351c27286c6139f4831fc718a35b0fa9145f0887de8bce335e8e3e12fce763cab5deeae08e0bf325cd79a4fbb328d7c7f7d53de51bd3c05c5966b634a9b1fc4362afd0267f927dd90a52b6a5f5f0e29c8e94dfe4199b2cf31142bb480e95ecb92b6ca20ecd71ff210df9655e9e9ac856ad7aab929b843052d4a21c27ea4054a9f4e8c4cd88943b1a4d3a58b3e06eb654c6c09cef472d6fb0d05a841ce229b53a5d36bd08cbfdc552f7c758efaa7824c1d27e30a83d7a9cecaab4bd91b2cbd60d1335fc4ac0f0294dd2eeb3f65139467761f091840246ff644edbfacb9ffd7ef2823fd9eea312dd299a39af0203010001a38201aa308201a6301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604147c4f2b645af103043ca7675e8c129c16dee7164c300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d301f0603551d1104183016811473636f742e7765697240636f6d6f646f2e636f6d300d06092a864886f70d01010505000382010100b33c0fee4668b9e86cd777fa94eb47dcaee7fb5b9b897b9458b12e511a194b6ad495ea4b6b820d1c7cd26badf92cfc13aaa9e66157a55545c7ea71460a4fa4e30e46b9ac16a36e94a1fcbc62b2abe402d2a58773344c4b23a0d907a9760029595421e478da67167f80876012443cd22573dc3806cdedbc6c8c4ed255bd926cecc7796ec36fb225d084f31afb5e5a2e86d26149212dda8aed2058ef0d7e7e677b463a7722431a0b5c0b9dc385b7d2e73bd781ee111c8f7e36d76e1db1f6ac98784227ed97cde3762d079741984d146a8ff96e411c1b1e4e711cd00a6150532ffaa13702a81f4514eae48ca0b98d8642a6cfe7711dc67d1b857bfecb4e863bc1f9 cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\6CD253D636A7B4D0E0981431BC064061A9853ED9\Blob = 0f00000001000000200000006f962c708f9b1bde348d5d34a63756527055479d67e82040573e57c7f633154d0300000001000000140000006cd253d636a7b4d0e0981431bc064061a9853ed920000000010000001b06000030820617308204ffa003020102021032327facb1bd6f1fa93473ccc515fd82300d06092a864886f70d01010b0500308191310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564313730350603550403132e434f4d4f444f2052534120457874656e6465642056616c69646174696f6e20436f6465205369676e696e67204341301e170d3138303132343030303030305a170d3231303132333233353935395a308201153110300e060355040513073339313038303531133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e311a301806035504090c11313235352042726f61642053747265657431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100b7713778a66667b8cd67f828f378f80a5507c4e8aa143cfd5b9b953ab16d04a965dcd386a35efe8378c1e0e5ceaf124f188102958962014e493cd80f11fc2ba339953a8bb71a9f030ebbe8742b4252ab465a2d41a829508a9eef5d34d171fcf0b5be026fe15e1a70288b2ecd4af1332924d53c0eefe5c7033482769cae8b5c5e8d59033fac40e94d714c5cd05e8db6f0edb71bb26565d52a025f35323203e9a7846d00a235f973d1e43f29a81dcd1bfef625d373f94a51cc8d2be8ee69702a73a694da69d9b0fbae7d1dee353683a2037a2019b9260a1b53f6c89d945b384c275670bdfac333301504af00749373356a1e7a422eb9363bdab713f9ad6b5bb1970203010001a38201e2308201de301f0603551d23041830168014df8ff3200ce9caa604d85b58372a3dab46dc8349301d0603551d0e04160414e18081b3e9396b7109e8b2add6c3d20ebf4b4814300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010601302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f43505330550603551d1f044e304c304aa048a0468644687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e63726c30818606082b06010505070101047a3078305006082b060105050730028644687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33393130383035300d06092a864886f70d01010b050003820101004bc17929ea82f3c4787f7b29b69edb09e169797a9f4cd233f035412d2b9c586e352d2c0d1cd530a946a91ccd8858453573f0b45a0cdc743d662af4761420489adadbd9a84915b697f96ed1e49786c53000eb12555d3b2957eec18279326020737e2e3e4d621856026169ad6f6cf18ee7b59d5b6a7e6d8c252fa1a15363ec89a6efe5efdf4b260ad35c6a0e1db0250d1eb66ea7b91f15e0f57ecc0541e1ad74a2069f717dec0b1f03101b6812c13f64264f8c40a3614ffb8ccabedb974cda14eb50c061d5cd23dc7735cd0bcfdcef3fd178c1f95594a591031d05c8554cb5fe6fd23cb95931bf847f5b525a269aeac0336313e8f6e81ccb1692d86993724f709e cmdagent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\31D019FC7AB697D57D9C4AFB340ED7C4D10400DF\Blob = 0f0000000100000020000000c6dcba6192a502eb4e7caebea466be00c8abbf2269740faa6156a5341ba0a2be03000000010000001400000031d019fc7ab697d57d9c4afb340ed7c4d10400df2000000001000000250600003082062130820509a00302010202101b427b060e2866bfb586cc267e1c3eaa300d06092a864886f70d01010b0500308191310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564313730350603550403132e434f4d4f444f2052534120457874656e6465642056616c69646174696f6e20436f6465205369676e696e67204341301e170d3138313230343030303030305a170d3231313230333233353935395a308201093110300e060355040513073339313038303531133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b3009060355040613025553310e300c06035504110c053037303133310b300906035504080c024e4a3110300e06035504070c07436c6966746f6e3116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100ad390c8bc919005d5894a91a9585ef887fbd7c2341ff5ebb3efc6f645a66c55e6da11febce740e53ed9416284dfc7d142e4dc21f99753b5f60ae9aadc764b59efd9ffd33b20ae1c54eba629408a1b095a59cf4af0ad9db9bc494250154dcd0edefcec62e4b248d9a793b703aa15255baf3553fa59d4dc558ba4303af630bb626cd6627e0c4a45764ec3b286c38ab2499f9dc13eefdffa7841297ff533b47061b9aa3ff09ee3f04a7b10ba70894e53f3352b1f60eddfc021a66546e3392795bb6ae49a92f189ec2a7cdd9a935fab33a5ce7fc16c4b7e8ca13b4551d38a6a7c0658298a5adf5f6796675f58e1bb4ce410ff704bc5e845bc1ef83c18a0d50e137370203010001a38201f8308201f4301f0603551d23041830168014df8ff3200ce9caa604d85b58372a3dab46dc8349301d0603551d0e041604142d99b81962209042dc650eb36ec07ad996e48c4d300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010601302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f43505330550603551d1f044e304c304aa048a0468644687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e63726c30818606082b06010505070101047a3078305006082b060105050730028644687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30440603551d11043d303ba02306082b06010505070803a01730150c1355532d44454c41574152452d33393130383035811473636f742e7765697240636f6d6f646f2e636f6d300d06092a864886f70d01010b050003820101007f4d3e6594a3e380fac36b00e97ccacce4786be2ecc13cf37e737aaca0328bb8bfdcd513daff94aba1c7ee00cc8a3bd073157a812f6e31f772781d0bb922a8b86932b296c2312cdf3b239c42bb443b4b1b89b36de34a7fae65ac63eb6ead8812f8d373fa6f1a4e8d9e62eb004caae3639e41e08ed48d640b04725b09b4411dc083587e7fe24b33d90677677960efa6299cc85c4b2bfae4cdfe36581d25e029f6af1a7e77f502882d87597f3cc5bb450a71f9fd57f43b321baa4cbe5213a48a2c5b785a9de4103d5029e4db79403e98784e51379d45a86996b183469e98470731d1a603eaa443a05527aca62f51631722dc0dfe5d74c8298d2aed885d34c9be61 cmdagent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\16232A798863E5950F9F44977A033CF91793D8F1\Blob = 0f0000000100000020000000a5af38f4b93abb455f8bbf1ef06af2b653c973f452b7051e08e3d62ee210ead403000000010000001400000016232a798863e5950f9f44977a033cf91793d8f1200000000100000016070000308207123082057aa00302010202101f734d111b4b5c879bbd5a8c49ab2a90300d06092a864886f70d01010b05003057310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312e302c060355040313255365637469676f205075626c696320436f6465205369676e696e6720434120455620523336301e170d3231313230373030303030305a170d3234313230363233353935395a3081da311330110603550405130a3034303037353135383831133011060b2b0601040182373c02010313025553311b3019060b2b0601040182373c020102130a4e6577204a6572736579311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b30090603550406130255533113301106035504080c0a4e6577204a657273657931273025060355040a0c1e436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e633127302506035504030c1e436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e6330820222300d06092a864886f70d01010105000382020f003082020a0282020100bf278efbb1f070dd512156b387a02946060750ffadb5b00c8a316c6254ccf52787727318f46a676cc12035adfb89cef7c4c4bbefa84627362f58e1b96b6b281fc01535419a7715dd92995ecf8deb4c8291427657bdcbee99fc260f482b91478a76bcf1c50b114be347a43c8a35091d8371e562b1c16f68370f851e037373ff9c00177845d2d5b6da2aaaf808cf9ff1a3a6eda561286e25fa2c0d7e9ae0c7f0c04e1df0baf6f5b6ac0f01940f2a14e467f77505d14c84f45121d45d5c4552ac5eb24fef6bc520ace00bac3aeab817f8fa995b3111a202397031bf4b25dd89e2ba5cf8b9b6b5a521deee25a4e6529c869873414796bbc28f6d3ed733d339b26dd10a3a0e2d43eb9815e1b33fb6a48f0ad3fe196ecb20207862249a5456601c09f1e344453cad88350bb392a74a899f716e018c40cac5fd3f9b691261e3528f51ae70a28b00271c5a540ec387e778f75a4ceabfd34f9b17d6a76481240727ba17973f3746e175ab4cae3f9b28dfad2a842a220491f66956ae90f8b44c343ccbb8cd6ae46eb19aa6f6ae55687129eb473a3111d1db67d708955afacc070e048b5aab7587a732bc77c9a66c72c604a4ae96ee00d38d492af000d6099cce5bd9b7c42554e74ad2091f79baea8cd4b92d092f89a294ebf5ddb785a39b21c1befd7faecc58a6e99022139f7120753a4cdb4b98e700a08dd850224d67c8aa811cd61d63950203010001a38201d4308201d0301f0603551d23041830168014813292412b28cd46c8c4a2c62a3912ec48a93f14301d0603551d0e041604145d9262d74ec55663e2d856b3702cca554d2809fd300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030490603551d20044230403035060c2b06010401b23101020106013025302306082b06010505070201161768747470733a2f2f7365637469676f2e636f6d2f4350533007060567810c0103304b0603551d1f044430423040a03ea03c863a687474703a2f2f63726c2e7365637469676f2e636f6d2f5365637469676f5075626c6963436f64655369676e696e67434145565233362e63726c307b06082b06010505070101046f306d304606082b06010505073002863a687474703a2f2f6372742e7365637469676f2e636f6d2f5365637469676f5075626c6963436f64655369676e696e67434145565233362e637274302306082b060105050730018617687474703a2f2f6f6373702e7365637469676f2e636f6d30330603551d11042c302aa02806082b06010505070803a01c301a0c1855532d4e4557204a45525345592d30343030373531353838300d06092a864886f70d01010b0500038201810000b6abcb859749fe5bea2213f31cfe6db00bb221447b7f781d40982487806bdb7b711b08b210fec553172e5492ed62cd4eb3c63f4352c33d87e3aaf9265287438c0cfa8183b68cdf6a52df3094b4fb4fc01a82e39292fc5c2525f30f5da0077e8b37879c9c33a46b34cda70fdd89e87cec6f9b320aa3ec145b2843af9ff9cdf5d7030b3b34b5e1436b06ed64f2358de7e894dc929e7d218a2c362c4b2a78f0852e9bc55fcb805c86b407879bd4d1cc8d24b3a647ad85cdbd19fd29f030e1976a5369e550b780dc853824d4f031f69afd1a4967ec5f3871443f8b55d40c6ce0049d5af7c2d6f3f1df0471e0d47daa19a010cc08489dd330c8aa036c63ec148a37b855e6e2cbe7993d3bc17459ba47251c568c80468c8c8eeef2b561903a64c54472284333302f8e957906f9fa7af48afd60d63886595389b305e9b2cae6547efc2e85a5a382e7abef4d5efcfc3e8a0320a1c7e6bd5b8b68f5a4931b5bdb6e0200e502becdd39258d1df1b7f0ead70b94c06e329ea1d9e52f32104c7c0b3a26d5b cmdagent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\D70D7D00CA12E1B3E20F3BF7534DEB2C2E7C2404\Blob = 030000000100000014000000d70d7d00ca12e1b3e20f3bf7534deb2c2e7c24042000000001000000530500003082054f30820437a00302010202102f9f0a1d6764b5a6378747247087ba73300d06092a864886f70d01010b0500307d310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312330210603550403131a434f4d4f444f2052534120436f6465205369676e696e67204341301e170d3138313231313030303030305a170d3139313231313233353935395a3081b8310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303116301406035504090c0d313235352042726f616420537431223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100c1b2eafc6255d7a7780082967ba911a65b8160e697a9c81ae0816002356644b714895808a67b22551d87b879e80d0c1bff7bd847e1486bad3c3caa8c6f3258a7311f8b03c68c9ec5947950e57a1f99f4b47b8faaf46e282f68155ae6e8f13c9c125b5eb83ae4e63ee6081d0e8aae4f090175a538422b38e0600bd94b21b313567934ee959ddd6ab7ef62bce25dada05d7de6a75cefeffdcba6a1fc8e1ef7aa6d3e5ab328732c3d31759a20d7e69cef60ac9d152041dbd85167a78329f3a80fee19ea9edb102448aa9f5774794ecb560de2faa348f278b846a2a5d8238d5e4e4cd2a82f0e37415af2dc63f34f3e179aa1cae7290b411aaf5aa6acf5404ebe98130203010001a382018d30820189301f0603551d23041830168014299160ff8a4dfaebf9a66ab8cff9e64bbd49ce12301d0603551d0e041604146c5f99825f4ba8d4c19bae5169bab32fae7816ca300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e63726c307406082b0601050507010104683066303e06082b060105050730028632687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010b050003820101000f718c2aa40e9c44a95e1eca3844097ddb7fba896b5f5c73a6b9aede1d29f0e432f41c8a45ce38b1f52df73f45e67907a03ac58d407b3077b1cae246a54544ee365bcee4bf0f4cecc47b01e98d0478d8f4c93e2c582aa472577de9c67a0a8c2e37635e626258675e0e6669babee331594abed516679e8f1b14d7a65dc1b76ab33412689b135cf855335748e2d1998759e5b95f68d418d5486d385d0db7a8fa30e58e84f57bb7ec3f45efa549fab71775c822ec846545b6fc0ef1d3c2dad34940657088fc5f773a1cbe24f9228f9dd7e9611d5d682998c6041ba580a789f5571da01d6723784bbcec4fded61d0ba31e37fbc10c3dfe06169df4670c8d454019f7 cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\31D019FC7AB697D57D9C4AFB340ED7C4D10400DF\Blob = 03000000010000001400000031d019fc7ab697d57d9c4afb340ed7c4d10400df2000000001000000250600003082062130820509a00302010202101b427b060e2866bfb586cc267e1c3eaa300d06092a864886f70d01010b0500308191310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564313730350603550403132e434f4d4f444f2052534120457874656e6465642056616c69646174696f6e20436f6465205369676e696e67204341301e170d3138313230343030303030305a170d3231313230333233353935395a308201093110300e060355040513073339313038303531133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b3009060355040613025553310e300c06035504110c053037303133310b300906035504080c024e4a3110300e06035504070c07436c6966746f6e3116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100ad390c8bc919005d5894a91a9585ef887fbd7c2341ff5ebb3efc6f645a66c55e6da11febce740e53ed9416284dfc7d142e4dc21f99753b5f60ae9aadc764b59efd9ffd33b20ae1c54eba629408a1b095a59cf4af0ad9db9bc494250154dcd0edefcec62e4b248d9a793b703aa15255baf3553fa59d4dc558ba4303af630bb626cd6627e0c4a45764ec3b286c38ab2499f9dc13eefdffa7841297ff533b47061b9aa3ff09ee3f04a7b10ba70894e53f3352b1f60eddfc021a66546e3392795bb6ae49a92f189ec2a7cdd9a935fab33a5ce7fc16c4b7e8ca13b4551d38a6a7c0658298a5adf5f6796675f58e1bb4ce410ff704bc5e845bc1ef83c18a0d50e137370203010001a38201f8308201f4301f0603551d23041830168014df8ff3200ce9caa604d85b58372a3dab46dc8349301d0603551d0e041604142d99b81962209042dc650eb36ec07ad996e48c4d300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010601302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f43505330550603551d1f044e304c304aa048a0468644687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e63726c30818606082b06010505070101047a3078305006082b060105050730028644687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30440603551d11043d303ba02306082b06010505070803a01730150c1355532d44454c41574152452d33393130383035811473636f742e7765697240636f6d6f646f2e636f6d300d06092a864886f70d01010b050003820101007f4d3e6594a3e380fac36b00e97ccacce4786be2ecc13cf37e737aaca0328bb8bfdcd513daff94aba1c7ee00cc8a3bd073157a812f6e31f772781d0bb922a8b86932b296c2312cdf3b239c42bb443b4b1b89b36de34a7fae65ac63eb6ead8812f8d373fa6f1a4e8d9e62eb004caae3639e41e08ed48d640b04725b09b4411dc083587e7fe24b33d90677677960efa6299cc85c4b2bfae4cdfe36581d25e029f6af1a7e77f502882d87597f3cc5bb450a71f9fd57f43b321baa4cbe5213a48a2c5b785a9de4103d5029e4db79403e98784e51379d45a86996b183469e98470731d1a603eaa443a05527aca62f51631722dc0dfe5d74c8298d2aed885d34c9be61 cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\D70D7D00CA12E1B3E20F3BF7534DEB2C2E7C2404\Blob = 0f00000001000000200000008f4390d93853f6a1a1b71fdc231e030586f8213a5846c95d90b527f5c6dbd80f030000000100000014000000d70d7d00ca12e1b3e20f3bf7534deb2c2e7c24042000000001000000530500003082054f30820437a00302010202102f9f0a1d6764b5a6378747247087ba73300d06092a864886f70d01010b0500307d310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312330210603550403131a434f4d4f444f2052534120436f6465205369676e696e67204341301e170d3138313231313030303030305a170d3139313231313233353935395a3081b8310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303116301406035504090c0d313235352042726f616420537431223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100c1b2eafc6255d7a7780082967ba911a65b8160e697a9c81ae0816002356644b714895808a67b22551d87b879e80d0c1bff7bd847e1486bad3c3caa8c6f3258a7311f8b03c68c9ec5947950e57a1f99f4b47b8faaf46e282f68155ae6e8f13c9c125b5eb83ae4e63ee6081d0e8aae4f090175a538422b38e0600bd94b21b313567934ee959ddd6ab7ef62bce25dada05d7de6a75cefeffdcba6a1fc8e1ef7aa6d3e5ab328732c3d31759a20d7e69cef60ac9d152041dbd85167a78329f3a80fee19ea9edb102448aa9f5774794ecb560de2faa348f278b846a2a5d8238d5e4e4cd2a82f0e37415af2dc63f34f3e179aa1cae7290b411aaf5aa6acf5404ebe98130203010001a382018d30820189301f0603551d23041830168014299160ff8a4dfaebf9a66ab8cff9e64bbd49ce12301d0603551d0e041604146c5f99825f4ba8d4c19bae5169bab32fae7816ca300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e63726c307406082b0601050507010104683066303e06082b060105050730028632687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010b050003820101000f718c2aa40e9c44a95e1eca3844097ddb7fba896b5f5c73a6b9aede1d29f0e432f41c8a45ce38b1f52df73f45e67907a03ac58d407b3077b1cae246a54544ee365bcee4bf0f4cecc47b01e98d0478d8f4c93e2c582aa472577de9c67a0a8c2e37635e626258675e0e6669babee331594abed516679e8f1b14d7a65dc1b76ab33412689b135cf855335748e2d1998759e5b95f68d418d5486d385d0db7a8fa30e58e84f57bb7ec3f45efa549fab71775c822ec846545b6fc0ef1d3c2dad34940657088fc5f773a1cbe24f9228f9dd7e9611d5d682998c6041ba580a789f5571da01d6723784bbcec4fded61d0ba31e37fbc10c3dfe06169df4670c8d454019f7 cmdagent.exe -
Sets service image path in registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\CmdAgent\ImagePath = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\cmdHlp\ImagePath = "System32\\DRIVERS\\cmdhlp.sys" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\cmderd\ImagePath = "System32\\DRIVERS\\cmderd.sys" MsiExec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 156.154.70.22 Destination IP 156.154.70.22 Destination IP 156.154.70.22 -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COMODO Internet Security = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cis.exe\" --cistrayUI" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" MsiExec.exe -
Checks for any installed AV software in registry 1 TTPs 64 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UrlsUpdateHost msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\CmcHost = "cmc.comodo.com" msiexec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\SwitchOn.{A3AC428C-3D81-40B6-BA5E-ABDE5505A0B3} cmdagent.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\COMODO\CIS\Data cmdinstall.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CfpConfg\_Trace_Category_Exclude cfpconfg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\Windows Security Backup\FwDomain cfpconfg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CavWp\_Trace_Category_Exclude cavwp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\SwitchOn.{3899AA55-4039-4996-AA3B-75F035BE8900} cmdagent.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\Langs.cmdres cfpconfg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CfpConfg\_Trace_Level cfpconfg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\OS driver inspect = "7" MsiExec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\PostUpdateAction cmdagent.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CavWp\_Trace_Enabled_To_File cavwp.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data cmdinstall.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\cfpconfg cfpconfg.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\cfpconfg cfpconfg.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\MsiExec MsiExec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\Proxy MsiExec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CavWp\_Trace_Category_Override cavwp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\SwitchOn.{564EAD3C-3DFD-4302-A9A3-7FEC6DDFC4F3} cmdagent.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\ViruscopePendingActivityLimit cmdagent.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{ABB45338-2428-46D5-BCA1-F907810012C7} = "1706218591" cfpconfg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Scan.{DBB22600-F6F5-41E4-866D-B11CBC208853} cmdagent.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\OS driver cmdguard = "7" cmdinstall.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CfpConfg\_Trace_Category_Exclude cfpconfg.exe Key queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS cmdinstall.exe Key security queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam msiexec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\cfpconfg cfpconfg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam\ModeEx = "2" cfpconfg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{DF77CAAC-D06C-4649-96B0-A6733E364723} = "1706218587" cfpconfg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CfpConfg\_Trace_Enabled_To_WinLog cfpconfg.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam msiexec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer\Proxy msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{ABB45338-2428-46D5-BCA1-F907810012C7} = "1706218588" cfpconfg.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer MsiExec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UpdateURLS = 680074007400700073003a002f002f0064006f0077006e006c006f00610064002e0063006f006d006f0064006f002e0063006f006d002f000000680074007400700073003a002f002f0064006f0077006e006c006f00610064002e0063006f006d006f0064006f002e0063006f006d002f0000000000 cmdinstall.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{67CE8C55-02C1-4517-99F0-282BE2734181} = "1706218591" cfpconfg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam\LicenseKey cmdagent.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam\ProductID cmdagent.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\SecureDNS\Backup\{D3824132-9CF8-4F1E-997D-F4368E8A05F6}\Type = "3" cfpconfg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CmdAgent\_Trace_Enabled = "1" MsiExec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CfpConfg\_Trace_Category_Override cfpconfg.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\SecureDNS cfpconfg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CmdAgent\_Trace_Enabled_To_WinLog cmdagent.exe Key queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\SecureDNS\Backup cfpconfg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\DisableCopyDefRecognizer = "1" cmdagent.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options msiexec.exe Key queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS MsiExec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CmdAgent\_Trace_Category_Override cmdagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS cmdagent.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\IsLmdbCorrupted.cmdurl cmdagent.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\CmcHost cmdagent.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam\SubscriptionID cmdagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\ThemeName = "lycia.set" msiexec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Testing purposes MsiExec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CfpConfg\_Trace_Level cfpconfg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\LmdbSyncMode cmdagent.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Offer accepted = "0" cmdinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS cfpconfg.exe Key queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam cmdinstall.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\CmcHost msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CavWp MsiExec.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: cmdinstall.exe File opened (read-only) \??\X: cmdinstall.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: MsiExec.exe File opened (read-only) \??\Y: MsiExec.exe File opened (read-only) \??\R: cfpconfg.exe File opened (read-only) \??\J: cfpconfg.exe File opened (read-only) \??\G: cfpconfg.exe File opened (read-only) \??\U: cmdagent.exe File opened (read-only) \??\A: cfpconfg.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: MsiExec.exe File opened (read-only) \??\P: cfpconfg.exe File opened (read-only) \??\X: cfpconfg.exe File opened (read-only) \??\P: cfpconfg.exe File opened (read-only) \??\Z: cfpconfg.exe File opened (read-only) \??\L: cmdagent.exe File opened (read-only) \??\V: cmdagent.exe File opened (read-only) \??\R: cmdinstall.exe File opened (read-only) \??\V: cmdinstall.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\E: MsiExec.exe File opened (read-only) \??\Q: cfpconfg.exe File opened (read-only) \??\Y: cfpconfg.exe File opened (read-only) \??\O: cmdinstall.exe File opened (read-only) \??\W: cmdinstall.exe File opened (read-only) \??\U: cfpconfg.exe File opened (read-only) \??\B: cfpconfg.exe File opened (read-only) \??\B: cmdagent.exe File opened (read-only) \??\A: cavwp.exe File opened (read-only) \??\X: MsiExec.exe File opened (read-only) \??\B: cfpconfg.exe File opened (read-only) \??\S: cmdagent.exe File opened (read-only) \??\U: cavwp.exe File opened (read-only) \??\B: cfpconfg.exe File opened (read-only) \??\I: cfpconfg.exe File opened (read-only) \??\U: cfpconfg.exe File opened (read-only) \??\V: cavwp.exe File opened (read-only) \??\H: cfpconfg.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: cfpconfg.exe File opened (read-only) \??\I: cmdinstall.exe File opened (read-only) \??\K: MsiExec.exe File opened (read-only) \??\Y: cfpconfg.exe File opened (read-only) \??\S: regsvr32.exe File opened (read-only) \??\S: MsiExec.exe File opened (read-only) \??\X: MsiExec.exe File opened (read-only) \??\O: cavwp.exe File opened (read-only) \??\Z: cavwp.exe File opened (read-only) \??\W: cfpconfg.exe File opened (read-only) \??\A: MsiExec.exe File opened (read-only) \??\V: MsiExec.exe File opened (read-only) \??\N: cfpconfg.exe File opened (read-only) \??\E: cfpconfg.exe File opened (read-only) \??\I: cmdagent.exe File opened (read-only) \??\S: cavwp.exe File opened (read-only) \??\R: cavwp.exe File opened (read-only) \??\L: MsiExec.exe File opened (read-only) \??\Z: cfpconfg.exe File opened (read-only) \??\V: cfpconfg.exe File opened (read-only) \??\I: cavwp.exe File opened (read-only) \??\P: cfpconfg.exe File opened (read-only) \??\V: cfpconfg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Control Panel\International\Geo\Nation cmdinstall.exe -
Drops file in System32 directory 44 IoCs
description ioc Process File created C:\Windows\syswow64\iseguard32.dll isestart.exe File opened for modification C:\Windows\System32\DriverStore\infstrng.dat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\inspect.inf_amd64_neutral_c289b07852275eb8\inspect.PNF DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784 cmdagent.exe File created C:\Windows\system32\guard64.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{51067f33-4eb9-651a-3044-4100da2cd00f}\SETE44.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{51067f33-4eb9-651a-3044-4100da2cd00f}\inspect.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{51067f33-4eb9-651a-3044-4100da2cd00f}\SETE45.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{51067f33-4eb9-651a-3044-4100da2cd00f} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstrng.dat MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B8CC409ACDBF2A2FE04C56F2875B1FD6 cmdagent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357 cmdagent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0968A1E3A40D2582E7FD463BAEB59CD cmdagent.exe File created C:\Windows\System32\DriverStore\Temp\{51067f33-4eb9-651a-3044-4100da2cd00f}\SETE43.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{51067f33-4eb9-651a-3044-4100da2cd00f}\SETE44.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{51067f33-4eb9-651a-3044-4100da2cd00f}\SETE45.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstor.dat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\inspect.inf_amd64_neutral_c289b07852275eb8\inspect.PNF DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D11549FC90445E1CE90F96A21958A17_941A5BE5FAF3230B9FC294754AF2A1C3 cmdagent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784 cmdagent.exe File created C:\Windows\system32\iseguard64.dll isestart.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{51067f33-4eb9-651a-3044-4100da2cd00f}\inspect.sys DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B8CC409ACDBF2A2FE04C56F2875B1FD6 cmdagent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357 cmdagent.exe File created C:\Windows\System32\DriverStore\INFCACHE.0 DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 cmdagent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\74FBF93595CFC8459196065CE54AD928 cmdagent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0968A1E3A40D2582E7FD463BAEB59CD cmdagent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5F26A2159BA21EA573A1C5E3DE2CF211_7541962669C96CEAB06421EC12621007 cmdagent.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{51067f33-4eb9-651a-3044-4100da2cd00f}\SETE43.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infpub.dat DrvInst.exe File created C:\Windows\SysWOW64\guard32.dll msiexec.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\infpub.dat MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F90F18257CBB4D84216AC1E1F3BB2C76 cmdagent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F90F18257CBB4D84216AC1E1F3BB2C76 cmdagent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 cmdagent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\74FBF93595CFC8459196065CE54AD928 cmdagent.exe File created C:\Windows\system32\cmdcsr.dll msiexec.exe File created C:\Windows\SysWOW64\cmdvrt32.dll msiexec.exe File created C:\Windows\system32\cmdvrt64.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{51067f33-4eb9-651a-3044-4100da2cd00f}\inspect.cat DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D11549FC90445E1CE90F96A21958A17_941A5BE5FAF3230B9FC294754AF2A1C3 cmdagent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5F26A2159BA21EA573A1C5E3DE2CF211_7541962669C96CEAB06421EC12621007 cmdagent.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\images\remove.png msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\drivers\win10\cmdboot.cat msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.italian.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\cisbf.exe msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\COMODO - Proactive Security.cfgx cfpconfg.exe File created C:\Program Files\COMODO\COMODO Internet Security\scanners\unarch.cav msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\bin\Add_App.xml msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\1066.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\cmdcomps.dll msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\themes\default.set msiexec.exe File created C:\Program Files (x86)\COMODO\Internet Security Essentials\Translations\vkise.vietnamese.xml isestart.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\virtkiosk.czech.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\cmdres.dll msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\bin\Internet (Chromodo).xml msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.french.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\libeay32.dll msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\drivers\win8\cmderd.sys msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.japanese.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\virtkiosk.turkish.lang msiexec.exe File created C:\Program Files (x86)\COMODO\Internet Security Essentials\iseguard64.dll isestart.exe File created C:\Program Files\COMODO\COMODO Internet Security\drivers\win8\cmdhlp.inf msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\themes\arcadia.set msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\1025.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\virtkiosk.polish.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\virtkiosk.swedish.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\scanners\fileid.cav msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\images\page_dot.png msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\drivers\win10\cmdhlp.cat msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\1065.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\scanners\pe.cav msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\images\btnShadow.png msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\bin\lfbgimoladefibpklnfmkpknadbklade.xml msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\drivers\win7\cmdhlp.cat msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\scanners\white.cav msiexec.exe File created C:\Program Files (x86)\COMODO\Internet Security Essentials\Translations\vkise.romanian.xml isestart.exe File created C:\Program Files\COMODO\COMODO Internet Security\drivers\win8\inspect.sys msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.czech.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.swedish.lang msiexec.exe File created C:\Program Files (x86)\COMODO\Internet Security Essentials\isedrv_xp.sys isestart.exe File created C:\Program Files\COMODO\COMODO Internet Security\scanners\smart.cav msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\bin\onlgmecjpnejhfeofkgbfgnmdlipdejb.xml msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\bin\pfpeapihoiogbcmdmnibeplnikfnhoge.png msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\drivers\win10\cmdguard.inf msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\drivers\win8\inspect.inf msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\bin\blpcfgokakmgnkcojhhkbfbldkacnbeo.xml msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\1050.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\Config.xml msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\1026.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.chinesetraditional.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\virtkiosk.croatian.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\scanners\pkann.dll msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\ComodoInstaller.english.lang.template msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\themes\ilycia.set msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\bin\hbdpomandigafcibbmofojjchbcdagbl.png msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.greek.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\virtkiosk.serbian.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\scanners\script.cav msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\bin\pfpeapihoiogbcmdmnibeplnikfnhoge.xml msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\drivers\win10\inspect.sys msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.russian.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\iseupdate.exe msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\bin\onlgmecjpnejhfeofkgbfgnmdlipdejb.png msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\drivers\win8\cmdguard.inf msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\drivers\win7\cmdhlp.sys msiexec.exe -
Drops file in Windows directory 42 IoCs
description ioc Process File opened for modification C:\Windows\Installer\{6D506E2A-AB2C-4D1E-A226-AB27BC469B62}\cis.ico msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log MsiExec.exe File opened for modification C:\Windows\INF\oem2.inf DrvInst.exe File created C:\Windows\INF\oem2.PNF MsiExec.exe File opened for modification C:\Windows\Installer\MSI64E6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDD44.tmp msiexec.exe File created C:\Windows\Installer\f7756e9.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIC6E5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID91E.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI8106.tmp msiexec.exe File created C:\Windows\Installer\f7756e6.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI5F15.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8349.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8AAA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI62C0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6438.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\Installer\f7756e9.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI5EE5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5F54.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f7756eb.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI64C6.tmp msiexec.exe File opened for modification C:\Windows\security\logs\scecomp.log MsiExec.exe File opened for modification C:\Windows\Installer\MSI7754.tmp msiexec.exe File created C:\Windows\Installer\{6D506E2A-AB2C-4D1E-A226-AB27BC469B62}\cis.ico msiexec.exe File opened for modification C:\Windows\Installer\MSI6197.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.app.log MsiExec.exe File opened for modification C:\Windows\Installer\MSIC5AC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDE00.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDE9D.tmp msiexec.exe File created C:\Windows\INF\oem2.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSI822F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI89DF.tmp msiexec.exe File opened for modification C:\Windows\Installer\f7756e6.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI5D7D.tmp msiexec.exe -
Executes dropped EXE 15 IoCs
pid Process 2760 cmdinstall.exe 2172 ise_installer.exe 2496 isestart.exe 2784 MSI64E6.tmp 1296 MSI64E6.tmp 2880 cfpconfg.exe 2024 cisbf.exe 996 cfpconfg.exe 540 cfpconfg.exe 2772 cfpconfg.exe 2144 cfpconfg.exe 2520 cmdagent.exe 2496 cavwp.exe 2692 cavwp.exe 2788 cfpconfg.exe -
Loads dropped DLL 64 IoCs
pid Process 2512 cispro_installer.exe 2760 cmdinstall.exe 2760 cmdinstall.exe 2760 cmdinstall.exe 2172 ise_installer.exe 2496 isestart.exe 2760 cmdinstall.exe 3028 MsiExec.exe 3028 MsiExec.exe 3028 MsiExec.exe 3028 MsiExec.exe 3028 MsiExec.exe 1796 MsiExec.exe 1796 MsiExec.exe 2832 msiexec.exe 1796 MsiExec.exe 1796 MsiExec.exe 2832 msiexec.exe 2880 cfpconfg.exe 2044 regsvr32.exe 2784 regsvr32.exe 2832 msiexec.exe 996 cfpconfg.exe 1796 MsiExec.exe 1796 MsiExec.exe 1796 MsiExec.exe 1796 MsiExec.exe 1796 MsiExec.exe 1796 MsiExec.exe 1796 MsiExec.exe 1796 MsiExec.exe 540 cfpconfg.exe 2772 cfpconfg.exe 2144 cfpconfg.exe 1796 MsiExec.exe 1796 MsiExec.exe 1796 MsiExec.exe 1796 MsiExec.exe 464 Process not Found 2520 cmdagent.exe 1796 MsiExec.exe 1796 MsiExec.exe 3068 regsvr32.exe 3068 regsvr32.exe 604 Process not Found 1796 MsiExec.exe 1796 MsiExec.exe 2496 cavwp.exe 1796 MsiExec.exe 1796 MsiExec.exe 832 MsiExec.exe 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 2072 MsiExec.exe 1572 MsiExec.exe 1796 MsiExec.exe 1796 MsiExec.exe 1796 MsiExec.exe 1796 MsiExec.exe 2692 cavwp.exe 2692 cavwp.exe 2520 cmdagent.exe -
Modifies system executable filetype association 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Comodo Antivirus regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Comodo Antivirus\ = "{4255A182-CAD9-4214-A19B-7BA7FB633BBD}" regsvr32.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}\InProcServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}\InProcServer32\ = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdcomps.dll" MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{A1850D95-9C38-4D86-AC40-E559BC0E73C9}\LocalServer32 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF101135-6584-46E7-8AA1-8FCD1FCA5042}\LOCALSERVER32 cmdagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B1E2B7F-DDF5-4722-A450-085CC9EAC96C}\LocalServer32 cmdagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8718E3A-1985-473C-9196-9A39AFB0028E}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvMerger" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BBB01528-20FE-4bc2-9D26-C70E3ABB9CD1}\LocalServer32 cmdagent.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{E0E9D49D-65D1-4AB1-8235-DF90B6ED8483}\LocalServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7D729A7-3570-4902-944A-470C9919FCCB}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" cmdagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B691E6DB-B216-4532-A2F3-1656BAC416FC}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvBoostHelper" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B1E2B7F-DDF5-4722-A450-085CC9EAC96C}\LocalServer32\ThreadingModel = "Free" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67683718-82B8-4557-86A8-E04D169EF883}\InProcServer32\ = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cisbfps.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4255A182-CAD9-4214-A19B-7BA7FB633BBD}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10F58851-4358-4E4B-8494-DF34393F41A5}\LOCALSERVER32 cmdagent.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4255A182-CAD9-4214-A19B-7BA7FB633BBD}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF101135-6584-46E7-8AA1-8FCD1FCA5042}\LocalServer32\ThreadingModel = "Free" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10F58851-4358-4E4B-8494-DF34393F41A5}\LocalServer32\ThreadingModel = "Both" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED181758-F11B-4C85-AEA2-199B3DC9F7DE}\InprocServer32\ = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cisresc.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C288AC5A-D846-4696-8028-2DF6F508D0D9}\LocalServer32 cmdagent.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B1E2B7F-DDF5-4722-A450-085CC9EAC96C}\LOCALSERVER32 cmdagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10F58851-4358-4E4B-8494-DF34393F41A5}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" cmdagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED181758-F11B-4C85-AEA2-199B3DC9F7DE}\InprocServer32\ThreadingModel = "Free" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7D729A7-3570-4902-944A-470C9919FCCB}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4D33F09-D11A-485D-AB08-8BFF862E7120}\LocalServer32\ServerExecutable = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cisbf.exe" cisbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{868A55F7-D79E-4C2E-8091-DEA9042B987F}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvSigChecker" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C288AC5A-D846-4696-8028-2DF6F508D0D9}\LOCALSERVER32 cmdagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE4DEE24-6CFC-48DF-89C4-29BD4954B895}\InProcServer32\ = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwpps.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{1B1E2B7F-DDF5-4722-A450-085CC9EAC96C}\LocalServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{05E5F178-256F-42EE-9BF4-A7E080F7B354}\LocalServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4D33F09-D11A-485D-AB08-8BFF862E7120}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cisbf.exe\"" cisbf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE4DEE24-6CFC-48DF-89C4-29BD4954B895}\InProcServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4D33F09-D11A-485D-AB08-8BFF862E7120}\LocalServer32 cisbf.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\LOCALSERVER32 cmdagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\LocalServer32 cmdagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B1E2B7F-DDF5-4722-A450-085CC9EAC96C}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" cmdagent.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{C288AC5A-D846-4696-8028-2DF6F508D0D9}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05E5F178-256F-42EE-9BF4-A7E080F7B354}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvScanner" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{868A55F7-D79E-4C2E-8091-DEA9042B987F}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE4DEE24-6CFC-48DF-89C4-29BD4954B895}\InProcServer32\ThreadingModel = "Both" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C288AC5A-D846-4696-8028-2DF6F508D0D9}\LocalServer32\ThreadingModel = "Free" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7D729A7-3570-4902-944A-470C9919FCCB}\InProcServer32\ = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cisresc.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}\InProcServer32\ThreadingModel = "Both" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED181758-F11B-4C85-AEA2-199B3DC9F7DE}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67683718-82B8-4557-86A8-E04D169EF883}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1850D95-9C38-4D86-AC40-E559BC0E73C9}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvDllHost" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67683718-82B8-4557-86A8-E04D169EF883}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF101135-6584-46e7-8AA1-8FCD1FCA5042}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" cmdagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C288AC5A-D846-4696-8028-2DF6F508D0D9}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" cmdagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4255A182-CAD9-4214-A19B-7BA7FB633BBD}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{FF101135-6584-46E7-8AA1-8FCD1FCA5042}\LocalServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{E8718E3A-1985-473C-9196-9A39AFB0028E}\LocalServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{B691E6DB-B216-4532-A2F3-1656BAC416FC}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4255A182-CAD9-4214-A19B-7BA7FB633BBD}\InprocServer32\ = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cavshell.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10F58851-4358-4E4B-8494-DF34393F41A5}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10F58851-4358-4E4B-8494-DF34393F41A5}\LocalServer32 cmdagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF101135-6584-46E7-8AA1-8FCD1FCA5042}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\LocalServer32\ThreadingModel = "Free" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C288AC5A-D846-4696-8028-2DF6F508D0D9}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BBB01528-20FE-4bc2-9D26-C70E3ABB9CD1}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" cmdagent.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{10F58851-4358-4E4B-8494-DF34393F41A5}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B1E2B7F-DDF5-4722-A450-085CC9EAC96C}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ runonce.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates cmdagent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot cmdagent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher cmdagent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs cmdagent.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" runonce.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs cmdagent.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" cmdagent.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\lltdres.dll,-3 = "Allows this PC to be discovered and located on the network." MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing cmdagent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000050726e95d64fda01 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" runonce.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates cmdagent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B cmdagent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs cmdagent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\sstpsvc.dll,-203 = "Allows you to securely connect to a private network using the Internet." MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@netcfgx.dll,-50003 = "Allows other computers to access resources on your computer using a Microsoft network." MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached rundll32.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\ProgID cmdagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3F06AD9D-77FE-4D63-B284-C7071889DE35}\NumMethods MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2714805B-8C18-46C0-A7BB-6BFC3D899EC8}\NumMethods\ = "11" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F77629CE-1CA1-4F50-98E8-816F9C4BAB71}\ProxyStubClsid32\ = "{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{98201BD6-E76C-47FA-A0C7-844DC519A4CC}\ProxyStubClsid32 MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_Classes\Local Settings cmdinstall.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{E37FA5BA-9E34-49AE-8C97-2C9E537A5D24}\7.0\0\win64 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B57EF65-A775-4AD9-A377-F5655064BC3B}\NumMethods\ = "5" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{239C7737-8812-46F9-A031-A0A1DBFC2ADA}\ProxyStubClsid32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DB2F28EA-4356-4CB2-A066-77B9B2749B49}\ProxyStubClsid32\ = "{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B386E3C8-605F-4CE6-9CFF-A7E628B22752}\NumMethods MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED181758-F11B-4C85-AEA2-199B3DC9F7DE}\InprocServer32\ = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cisresc.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6611B9CE-5211-44EA-B74E-9FEBFE6352A7}\NumMethods MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7FC0F91-20A6-485A-BD25-78A6C429F31D}\NumMethods MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78CA3294-03C0-40AF-87F8-F0383A47B48D}\NumMethods MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A354768-9032-4BE3-888B-BC5E8D07F118}\NumMethods\ = "11" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{78CA3294-03C0-40AF-87F8-F0383A47B48D} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C6EBC129-535C-497C-AA55-59A712EF0C34}\ProxyStubClsid32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{98201BD6-E76C-47FA-A0C7-844DC519A4CC}\ProxyStubClsid32\ = "{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7477CE65-D30B-4016-9C15-5237B8BF42AF}\ProxyStubClsid32 MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A2E605D6C2BAE1D42A62BA72CB64B926\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{15533C57-941F-44DD-A64D-869868F43471}\ = "IAvDatabase" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{342A9490-7F70-4AE6-B553-9BA04288F8F6} cmdagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B1E2B7F-DDF5-4722-A450-085CC9EAC96C}\VersionIndependentProgID\ = "CIS.CisLpsIntegration" cmdagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{96D27592-5FAA-4B65-AE65-C41AA290ABCD}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AE0BD328-5CE6-4B54-857B-890CC3780831}\NumMethods MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1F1DF8B9-3971-4299-8737-F5D4E99DA57E}\NumMethods\ = "8" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E3EB5021-FEB9-4195-B3FF-96B2FCA85FA3}\NumMethods\ = "4" MsiExec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B1E2B7F-DDF5-4722-A450-085CC9EAC96C} cmdagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\Comodo Antivirus regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BE82AC8D-7DFB-43E2-BF84-C8E3E52CFB28} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BE82AC8D-7DFB-43E2-BF84-C8E3E52CFB28}\NumMethods\ = "17" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBE300CA-7532-4515-AEBD-392BBBEAE404}\NumMethods\ = "15" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{98201BD6-E76C-47FA-A0C7-844DC519A4CC}\ProxyStubClsid32\ = "{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BDBCAEEC-F387-41C3-8D7A-91112D084622}\ = "ICisMsg" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C35D7AB-2BA6-423C-A9E7-E6A710159DC1}\NumMethods MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{12473B3F-F0FB-4577-8EB4-0F5BBDB3DD4D}\ = "ICisWmiProvider" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF738DD5-62A4-4A19-A149-006F41F053BB}\NumMethods\ = "106" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3EB5021-FEB9-4195-B3FF-96B2FCA85FA3}\ProxyStubClsid32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{12473B3F-F0FB-4577-8EB4-0F5BBDB3DD4D}\ProxyStubClsid32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2714805B-8C18-46C0-A7BB-6BFC3D899EC8}\ProxyStubClsid32\ = "{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C288AC5A-D846-4696-8028-2DF6F508D0D9}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{186EBA6E-1BC8-43EF-8E83-BFA0DF9ECF13}\ = "ICisDebugInjector" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E666B62B-01D8-41C9-98A2-E451645C7119}\NumMethods MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B386E3C8-605F-4CE6-9CFF-A7E628B22752}\ProxyStubClsid32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}\ProxyStubClsid32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3F06AD9D-77FE-4D63-B284-C7071889DE35}\ = "ICisJobPurgeFileList" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7DC86B41-769A-4DF6-9FDD-29D537E0441B}\NumMethods MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DA91D99-CA00-4FEF-8382-D03729716F44}\NumMethods MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4EC91C91-2028-42CA-96DD-3FF2BDFBB00C}\ProxyStubClsid32\ = "{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C4AD4BB9-9DE8-4F78-B720-A3A96415BAD8}\ = "ISvcDeviceControl" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{37EFB434-D269-4B6B-AE61-60E4E8F2CCCA}\NumMethods\ = "9" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7FC0F91-20A6-485A-BD25-78A6C429F31D}\NumMethods\ = "24" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F8C8C537-0997-4D12-BD50-9B6C31A4883E}\1.0\0\win64 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDBCAEEC-F387-41C3-8D7A-91112D084622}\ProxyStubClsid32\ = "{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E666B62B-01D8-41C9-98A2-E451645C7119}\NumMethods MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10F58851-4358-4E4B-8494-DF34393F41A5}\ProgID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{05E5F178-256F-42EE-9BF4-A7E080F7B354}\ProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\safe\URL Protocol msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10F58851-4358-4E4B-8494-DF34393F41A5}\ = "CisWmiProvider Class" cmdagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{09C29BDE-CE66-40FE-8EA8-3C9DD4788068}\ProxyStubClsid32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63A82605-4789-40DC-9FDC-8041CC8540F5}\ = "IEnumViruscopeActivities" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{223F5705-6A2B-422A-99BF-60981B4C4F53}\NumMethods MsiExec.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\16232A798863E5950F9F44977A033CF91793D8F1\Blob = 03000000010000001400000016232a798863e5950f9f44977a033cf91793d8f1200000000100000016070000308207123082057aa00302010202101f734d111b4b5c879bbd5a8c49ab2a90300d06092a864886f70d01010b05003057310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312e302c060355040313255365637469676f205075626c696320436f6465205369676e696e6720434120455620523336301e170d3231313230373030303030305a170d3234313230363233353935395a3081da311330110603550405130a3034303037353135383831133011060b2b0601040182373c02010313025553311b3019060b2b0601040182373c020102130a4e6577204a6572736579311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b30090603550406130255533113301106035504080c0a4e6577204a657273657931273025060355040a0c1e436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e633127302506035504030c1e436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e6330820222300d06092a864886f70d01010105000382020f003082020a0282020100bf278efbb1f070dd512156b387a02946060750ffadb5b00c8a316c6254ccf52787727318f46a676cc12035adfb89cef7c4c4bbefa84627362f58e1b96b6b281fc01535419a7715dd92995ecf8deb4c8291427657bdcbee99fc260f482b91478a76bcf1c50b114be347a43c8a35091d8371e562b1c16f68370f851e037373ff9c00177845d2d5b6da2aaaf808cf9ff1a3a6eda561286e25fa2c0d7e9ae0c7f0c04e1df0baf6f5b6ac0f01940f2a14e467f77505d14c84f45121d45d5c4552ac5eb24fef6bc520ace00bac3aeab817f8fa995b3111a202397031bf4b25dd89e2ba5cf8b9b6b5a521deee25a4e6529c869873414796bbc28f6d3ed733d339b26dd10a3a0e2d43eb9815e1b33fb6a48f0ad3fe196ecb20207862249a5456601c09f1e344453cad88350bb392a74a899f716e018c40cac5fd3f9b691261e3528f51ae70a28b00271c5a540ec387e778f75a4ceabfd34f9b17d6a76481240727ba17973f3746e175ab4cae3f9b28dfad2a842a220491f66956ae90f8b44c343ccbb8cd6ae46eb19aa6f6ae55687129eb473a3111d1db67d708955afacc070e048b5aab7587a732bc77c9a66c72c604a4ae96ee00d38d492af000d6099cce5bd9b7c42554e74ad2091f79baea8cd4b92d092f89a294ebf5ddb785a39b21c1befd7faecc58a6e99022139f7120753a4cdb4b98e700a08dd850224d67c8aa811cd61d63950203010001a38201d4308201d0301f0603551d23041830168014813292412b28cd46c8c4a2c62a3912ec48a93f14301d0603551d0e041604145d9262d74ec55663e2d856b3702cca554d2809fd300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030490603551d20044230403035060c2b06010401b23101020106013025302306082b06010505070201161768747470733a2f2f7365637469676f2e636f6d2f4350533007060567810c0103304b0603551d1f044430423040a03ea03c863a687474703a2f2f63726c2e7365637469676f2e636f6d2f5365637469676f5075626c6963436f64655369676e696e67434145565233362e63726c307b06082b06010505070101046f306d304606082b06010505073002863a687474703a2f2f6372742e7365637469676f2e636f6d2f5365637469676f5075626c6963436f64655369676e696e67434145565233362e637274302306082b060105050730018617687474703a2f2f6f6373702e7365637469676f2e636f6d30330603551d11042c302aa02806082b06010505070803a01c301a0c1855532d4e4557204a45525345592d30343030373531353838300d06092a864886f70d01010b0500038201810000b6abcb859749fe5bea2213f31cfe6db00bb221447b7f781d40982487806bdb7b711b08b210fec553172e5492ed62cd4eb3c63f4352c33d87e3aaf9265287438c0cfa8183b68cdf6a52df3094b4fb4fc01a82e39292fc5c2525f30f5da0077e8b37879c9c33a46b34cda70fdd89e87cec6f9b320aa3ec145b2843af9ff9cdf5d7030b3b34b5e1436b06ed64f2358de7e894dc929e7d218a2c362c4b2a78f0852e9bc55fcb805c86b407879bd4d1cc8d24b3a647ad85cdbd19fd29f030e1976a5369e550b780dc853824d4f031f69afd1a4967ec5f3871443f8b55d40c6ce0049d5af7c2d6f3f1df0471e0d47daa19a010cc08489dd330c8aa036c63ec148a37b855e6e2cbe7993d3bc17459ba47251c568c80468c8c8eeef2b561903a64c54472284333302f8e957906f9fa7af48afd60d63886595389b305e9b2cae6547efc2e85a5a382e7abef4d5efcfc3e8a0320a1c7e6bd5b8b68f5a4931b5bdb6e0200e502becdd39258d1df1b7f0ead70b94c06e329ea1d9e52f32104c7c0b3a26d5b cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F8DB7E1C16F1FFD4AAAD4AAD8DFF0F2445184AEB\Blob = 190000000100000010000000fdf830131f605511d717ae8f24143eea0f0000000100000020000000ed55f82e1444f79ca9dce826846fdc4e0ea3859e3d26efef412d2fff0c7c8e6c030000000100000014000000f8db7e1c16f1ffd4aaad4aad8dff0f2445184aeb1400000001000000140000008570009f77591e8cac3c9f77262819cc9ac18f3220000000010000000906000030820605308203eda0030201020210078f0a9d03df119e434e4fec1bf0235a300d06092a864886f70d01010b0500308194310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313e303c060355040313354d6963726f736f667420446576656c6f706d656e7420526f6f7420436572746966696361746520417574686f726974792032303134301e170d3134303532383136343334365a170d3339303532383136353134385a308194310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313e303c060355040313354d6963726f736f667420446576656c6f706d656e7420526f6f7420436572746966696361746520417574686f72697479203230313430820222300d06092a864886f70d01010105000382020f003082020a0282020100c20f7f6d49bb39f04d943fe8fb4dc5eb3be1285ab9892a467ea5c333271d82893feb33a1876aeae882b9dac39d77d135c0cb833672a6571912bc15e2c83c7b83623414d5abb6de368ba15a71a65196a70633b3221d146253c2a5af9a40cabe2c485499e72a9368a769190b99693bc1b2acae94dc5fab7e02cade3ca774a68c10a0e5aeb69c35ef838b10e5972aba916b9a6a4595d9d054718e653fc48a53ca1e38470ae9d04184a5da1e66016504e6505b7735f5b42e29320cc6bf5f61ee3220b77c39f911faff605efec669f46f1e1ded1d06e7651e9a112e6344065f31431733e9a32682d44b83124fd2a126032548e13abd84f58ad5b46e1ae871200e45530167ade31e6be8b2e4abfdf53b8eba67af5984cc5c75d09daa5c72c42636a2ac324c6ab1f8331744d2a77d70eeeb70949abceaba1c104b635b38ddd2254504b2f0b35a7c0b0a8e21406437114d96694533e493839ef9b3b51c2b0571ea6dcce748b6b6de805010ca4938b35905704ebd9e880222586489eb40dab12d2d6a40885d23c33ed0f5d5b7908a28543962a2c5c6b1bf74cd8695f9456bccf207eaac5cd336f7a27ab5b472532a063ec337945858b14a71bb5ccd9cb2af109ad943363e528519e7422891118c8ce7bbdfe6c855087375f3960d86b7d2e506b2c08a54a86177207d6cd1feba68f3454aaf1184eb867d2f04f354ea20ffd5db3d250270870203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604148570009f77591e8cac3c9f77262819cc9ac18f32301006092b06010401823715010403020100300d06092a864886f70d01010b050003820201004f2574bd1f624f5f0ff74222d7d1d65304232ec5d5d7072b6b793b5f6d90ed1355d382f1f5028f3ef996267e0d421876fc6055825a86bd113339690fcee0b02bf15d19dfd8d2fa86a4cccdacf0d0ae9a8b2b248f03c1350d20b3dfc742ea77292e0a12fc0b1a458dd931840d8d02c0acfad212bf1e6a343eea8300a348754e72662da1a5129f37a85d4a7759cfd63afc30c5a609a5bfb108e3fb2c9f76c4fb4e611d6d23f3766985eb49bb0df73dd0aa05bcdd3d6e80445ed99a68ecc989c7e61a18f860a0e78cf6e6516f0ee025b863f9f9c20b8c3c9cb2f042cdbec3f5fe4929559c5e8696fba1ed6d2686e8b8208b5cc6e72d31c5aaca7d4b7da059a41efb5071e9afcfd6aa0d99de8e95269731a5f47f6df46815b8e3f7add8efd13875025ffd6d4efcb6fc2f451ba9cad11e7aff75181536c120e45f483a95eb7be4f5f6f4fec94b21a2a9ea8a9925cbe8444090d539b46b239b52bcc0c17e17666e650bf5741596a866ed856854b224e87588644589853c7a656b96e0f259ea4725660f6a1b0c3fd44ae64b26174709fed4d7b8e0cee72f94ad808b6770ccb77bcf1b2bb9d15bbdb8035cb1f01b412ce6535516e74a0e41089937e2a9d76d0e6a45e5ece388a9fdb69bc32820ceabc2936b516553bfa05e7b9d26349a514c8ca638d5865b3c55ee50ec000bcaacdcca10abdf189bd2ac0c8d084515af8535355ae526bc cmdinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E35E6F46A1A9A4D18A4DAA298BDA4D1E8879236E cmdagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\6CD253D636A7B4D0E0981431BC064061A9853ED9 cfpconfg.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\31D019FC7AB697D57D9C4AFB340ED7C4D10400DF\Blob = 03000000010000001400000031d019fc7ab697d57d9c4afb340ed7c4d10400df2000000001000000250600003082062130820509a00302010202101b427b060e2866bfb586cc267e1c3eaa300d06092a864886f70d01010b0500308191310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564313730350603550403132e434f4d4f444f2052534120457874656e6465642056616c69646174696f6e20436f6465205369676e696e67204341301e170d3138313230343030303030305a170d3231313230333233353935395a308201093110300e060355040513073339313038303531133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b3009060355040613025553310e300c06035504110c053037303133310b300906035504080c024e4a3110300e06035504070c07436c6966746f6e3116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100ad390c8bc919005d5894a91a9585ef887fbd7c2341ff5ebb3efc6f645a66c55e6da11febce740e53ed9416284dfc7d142e4dc21f99753b5f60ae9aadc764b59efd9ffd33b20ae1c54eba629408a1b095a59cf4af0ad9db9bc494250154dcd0edefcec62e4b248d9a793b703aa15255baf3553fa59d4dc558ba4303af630bb626cd6627e0c4a45764ec3b286c38ab2499f9dc13eefdffa7841297ff533b47061b9aa3ff09ee3f04a7b10ba70894e53f3352b1f60eddfc021a66546e3392795bb6ae49a92f189ec2a7cdd9a935fab33a5ce7fc16c4b7e8ca13b4551d38a6a7c0658298a5adf5f6796675f58e1bb4ce410ff704bc5e845bc1ef83c18a0d50e137370203010001a38201f8308201f4301f0603551d23041830168014df8ff3200ce9caa604d85b58372a3dab46dc8349301d0603551d0e041604142d99b81962209042dc650eb36ec07ad996e48c4d300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010601302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f43505330550603551d1f044e304c304aa048a0468644687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e63726c30818606082b06010505070101047a3078305006082b060105050730028644687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30440603551d11043d303ba02306082b06010505070803a01730150c1355532d44454c41574152452d33393130383035811473636f742e7765697240636f6d6f646f2e636f6d300d06092a864886f70d01010b050003820101007f4d3e6594a3e380fac36b00e97ccacce4786be2ecc13cf37e737aaca0328bb8bfdcd513daff94aba1c7ee00cc8a3bd073157a812f6e31f772781d0bb922a8b86932b296c2312cdf3b239c42bb443b4b1b89b36de34a7fae65ac63eb6ead8812f8d373fa6f1a4e8d9e62eb004caae3639e41e08ed48d640b04725b09b4411dc083587e7fe24b33d90677677960efa6299cc85c4b2bfae4cdfe36581d25e029f6af1a7e77f502882d87597f3cc5bb450a71f9fd57f43b321baa4cbe5213a48a2c5b785a9de4103d5029e4db79403e98784e51379d45a86996b183469e98470731d1a603eaa443a05527aca62f51631722dc0dfe5d74c8298d2aed885d34c9be61 cfpconfg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E35E6F46A1A9A4D18A4DAA298BDA4D1E8879236E cfpconfg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\6CD253D636A7B4D0E0981431BC064061A9853ED9 cmdagent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\6CD253D636A7B4D0E0981431BC064061A9853ED9\Blob = 0f00000001000000200000006f962c708f9b1bde348d5d34a63756527055479d67e82040573e57c7f633154d0300000001000000140000006cd253d636a7b4d0e0981431bc064061a9853ed920000000010000001b06000030820617308204ffa003020102021032327facb1bd6f1fa93473ccc515fd82300d06092a864886f70d01010b0500308191310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564313730350603550403132e434f4d4f444f2052534120457874656e6465642056616c69646174696f6e20436f6465205369676e696e67204341301e170d3138303132343030303030305a170d3231303132333233353935395a308201153110300e060355040513073339313038303531133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e311a301806035504090c11313235352042726f61642053747265657431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100b7713778a66667b8cd67f828f378f80a5507c4e8aa143cfd5b9b953ab16d04a965dcd386a35efe8378c1e0e5ceaf124f188102958962014e493cd80f11fc2ba339953a8bb71a9f030ebbe8742b4252ab465a2d41a829508a9eef5d34d171fcf0b5be026fe15e1a70288b2ecd4af1332924d53c0eefe5c7033482769cae8b5c5e8d59033fac40e94d714c5cd05e8db6f0edb71bb26565d52a025f35323203e9a7846d00a235f973d1e43f29a81dcd1bfef625d373f94a51cc8d2be8ee69702a73a694da69d9b0fbae7d1dee353683a2037a2019b9260a1b53f6c89d945b384c275670bdfac333301504af00749373356a1e7a422eb9363bdab713f9ad6b5bb1970203010001a38201e2308201de301f0603551d23041830168014df8ff3200ce9caa604d85b58372a3dab46dc8349301d0603551d0e04160414e18081b3e9396b7109e8b2add6c3d20ebf4b4814300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010601302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f43505330550603551d1f044e304c304aa048a0468644687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e63726c30818606082b06010505070101047a3078305006082b060105050730028644687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33393130383035300d06092a864886f70d01010b050003820101004bc17929ea82f3c4787f7b29b69edb09e169797a9f4cd233f035412d2b9c586e352d2c0d1cd530a946a91ccd8858453573f0b45a0cdc743d662af4761420489adadbd9a84915b697f96ed1e49786c53000eb12555d3b2957eec18279326020737e2e3e4d621856026169ad6f6cf18ee7b59d5b6a7e6d8c252fa1a15363ec89a6efe5efdf4b260ad35c6a0e1db0250d1eb66ea7b91f15e0f57ecc0541e1ad74a2069f717dec0b1f03101b6812c13f64264f8c40a3614ffb8ccabedb974cda14eb50c061d5cd23dc7735cd0bcfdcef3fd178c1f95594a591031d05c8554cb5fe6fd23cb95931bf847f5b525a269aeac0336313e8f6e81ccb1692d86993724f709e cmdagent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 0f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d80b000000010000001400000055005300450052005400720075007300740000001d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4620000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 cmdinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46 cmdinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\D70D7D00CA12E1B3E20F3BF7534DEB2C2E7C2404 cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\D70D7D00CA12E1B3E20F3BF7534DEB2C2E7C2404\Blob = 030000000100000014000000d70d7d00ca12e1b3e20f3bf7534deb2c2e7c24042000000001000000530500003082054f30820437a00302010202102f9f0a1d6764b5a6378747247087ba73300d06092a864886f70d01010b0500307d310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312330210603550403131a434f4d4f444f2052534120436f6465205369676e696e67204341301e170d3138313231313030303030305a170d3139313231313233353935395a3081b8310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303116301406035504090c0d313235352042726f616420537431223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100c1b2eafc6255d7a7780082967ba911a65b8160e697a9c81ae0816002356644b714895808a67b22551d87b879e80d0c1bff7bd847e1486bad3c3caa8c6f3258a7311f8b03c68c9ec5947950e57a1f99f4b47b8faaf46e282f68155ae6e8f13c9c125b5eb83ae4e63ee6081d0e8aae4f090175a538422b38e0600bd94b21b313567934ee959ddd6ab7ef62bce25dada05d7de6a75cefeffdcba6a1fc8e1ef7aa6d3e5ab328732c3d31759a20d7e69cef60ac9d152041dbd85167a78329f3a80fee19ea9edb102448aa9f5774794ecb560de2faa348f278b846a2a5d8238d5e4e4cd2a82f0e37415af2dc63f34f3e179aa1cae7290b411aaf5aa6acf5404ebe98130203010001a382018d30820189301f0603551d23041830168014299160ff8a4dfaebf9a66ab8cff9e64bbd49ce12301d0603551d0e041604146c5f99825f4ba8d4c19bae5169bab32fae7816ca300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e63726c307406082b0601050507010104683066303e06082b060105050730028632687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010b050003820101000f718c2aa40e9c44a95e1eca3844097ddb7fba896b5f5c73a6b9aede1d29f0e432f41c8a45ce38b1f52df73f45e67907a03ac58d407b3077b1cae246a54544ee365bcee4bf0f4cecc47b01e98d0478d8f4c93e2c582aa472577de9c67a0a8c2e37635e626258675e0e6669babee331594abed516679e8f1b14d7a65dc1b76ab33412689b135cf855335748e2d1998759e5b95f68d418d5486d385d0db7a8fa30e58e84f57bb7ec3f45efa549fab71775c822ec846545b6fc0ef1d3c2dad34940657088fc5f773a1cbe24f9228f9dd7e9611d5d682998c6041ba580a789f5571da01d6723784bbcec4fded61d0ba31e37fbc10c3dfe06169df4670c8d454019f7 cfpconfg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F8DB7E1C16F1FFD4AAAD4AAD8DFF0F2445184AEB cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\16232A798863E5950F9F44977A033CF91793D8F1\Blob = 0f0000000100000020000000a5af38f4b93abb455f8bbf1ef06af2b653c973f452b7051e08e3d62ee210ead403000000010000001400000016232a798863e5950f9f44977a033cf91793d8f1200000000100000016070000308207123082057aa00302010202101f734d111b4b5c879bbd5a8c49ab2a90300d06092a864886f70d01010b05003057310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312e302c060355040313255365637469676f205075626c696320436f6465205369676e696e6720434120455620523336301e170d3231313230373030303030305a170d3234313230363233353935395a3081da311330110603550405130a3034303037353135383831133011060b2b0601040182373c02010313025553311b3019060b2b0601040182373c020102130a4e6577204a6572736579311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b30090603550406130255533113301106035504080c0a4e6577204a657273657931273025060355040a0c1e436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e633127302506035504030c1e436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e6330820222300d06092a864886f70d01010105000382020f003082020a0282020100bf278efbb1f070dd512156b387a02946060750ffadb5b00c8a316c6254ccf52787727318f46a676cc12035adfb89cef7c4c4bbefa84627362f58e1b96b6b281fc01535419a7715dd92995ecf8deb4c8291427657bdcbee99fc260f482b91478a76bcf1c50b114be347a43c8a35091d8371e562b1c16f68370f851e037373ff9c00177845d2d5b6da2aaaf808cf9ff1a3a6eda561286e25fa2c0d7e9ae0c7f0c04e1df0baf6f5b6ac0f01940f2a14e467f77505d14c84f45121d45d5c4552ac5eb24fef6bc520ace00bac3aeab817f8fa995b3111a202397031bf4b25dd89e2ba5cf8b9b6b5a521deee25a4e6529c869873414796bbc28f6d3ed733d339b26dd10a3a0e2d43eb9815e1b33fb6a48f0ad3fe196ecb20207862249a5456601c09f1e344453cad88350bb392a74a899f716e018c40cac5fd3f9b691261e3528f51ae70a28b00271c5a540ec387e778f75a4ceabfd34f9b17d6a76481240727ba17973f3746e175ab4cae3f9b28dfad2a842a220491f66956ae90f8b44c343ccbb8cd6ae46eb19aa6f6ae55687129eb473a3111d1db67d708955afacc070e048b5aab7587a732bc77c9a66c72c604a4ae96ee00d38d492af000d6099cce5bd9b7c42554e74ad2091f79baea8cd4b92d092f89a294ebf5ddb785a39b21c1befd7faecc58a6e99022139f7120753a4cdb4b98e700a08dd850224d67c8aa811cd61d63950203010001a38201d4308201d0301f0603551d23041830168014813292412b28cd46c8c4a2c62a3912ec48a93f14301d0603551d0e041604145d9262d74ec55663e2d856b3702cca554d2809fd300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030490603551d20044230403035060c2b06010401b23101020106013025302306082b06010505070201161768747470733a2f2f7365637469676f2e636f6d2f4350533007060567810c0103304b0603551d1f044430423040a03ea03c863a687474703a2f2f63726c2e7365637469676f2e636f6d2f5365637469676f5075626c6963436f64655369676e696e67434145565233362e63726c307b06082b06010505070101046f306d304606082b06010505073002863a687474703a2f2f6372742e7365637469676f2e636f6d2f5365637469676f5075626c6963436f64655369676e696e67434145565233362e637274302306082b060105050730018617687474703a2f2f6f6373702e7365637469676f2e636f6d30330603551d11042c302aa02806082b06010505070803a01c301a0c1855532d4e4557204a45525345592d30343030373531353838300d06092a864886f70d01010b0500038201810000b6abcb859749fe5bea2213f31cfe6db00bb221447b7f781d40982487806bdb7b711b08b210fec553172e5492ed62cd4eb3c63f4352c33d87e3aaf9265287438c0cfa8183b68cdf6a52df3094b4fb4fc01a82e39292fc5c2525f30f5da0077e8b37879c9c33a46b34cda70fdd89e87cec6f9b320aa3ec145b2843af9ff9cdf5d7030b3b34b5e1436b06ed64f2358de7e894dc929e7d218a2c362c4b2a78f0852e9bc55fcb805c86b407879bd4d1cc8d24b3a647ad85cdbd19fd29f030e1976a5369e550b780dc853824d4f031f69afd1a4967ec5f3871443f8b55d40c6ce0049d5af7c2d6f3f1df0471e0d47daa19a010cc08489dd330c8aa036c63ec148a37b855e6e2cbe7993d3bc17459ba47251c568c80468c8c8eeef2b561903a64c54472284333302f8e957906f9fa7af48afd60d63886595389b305e9b2cae6547efc2e85a5a382e7abef4d5efcfc3e8a0320a1c7e6bd5b8b68f5a4931b5bdb6e0200e502becdd39258d1df1b7f0ead70b94c06e329ea1d9e52f32104c7c0b3a26d5b cmdagent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F8DB7E1C16F1FFD4AAAD4AAD8DFF0F2445184AEB\Blob = 0f0000000100000020000000ed55f82e1444f79ca9dce826846fdc4e0ea3859e3d26efef412d2fff0c7c8e6c030000000100000014000000f8db7e1c16f1ffd4aaad4aad8dff0f2445184aeb20000000010000000906000030820605308203eda0030201020210078f0a9d03df119e434e4fec1bf0235a300d06092a864886f70d01010b0500308194310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313e303c060355040313354d6963726f736f667420446576656c6f706d656e7420526f6f7420436572746966696361746520417574686f726974792032303134301e170d3134303532383136343334365a170d3339303532383136353134385a308194310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313e303c060355040313354d6963726f736f667420446576656c6f706d656e7420526f6f7420436572746966696361746520417574686f72697479203230313430820222300d06092a864886f70d01010105000382020f003082020a0282020100c20f7f6d49bb39f04d943fe8fb4dc5eb3be1285ab9892a467ea5c333271d82893feb33a1876aeae882b9dac39d77d135c0cb833672a6571912bc15e2c83c7b83623414d5abb6de368ba15a71a65196a70633b3221d146253c2a5af9a40cabe2c485499e72a9368a769190b99693bc1b2acae94dc5fab7e02cade3ca774a68c10a0e5aeb69c35ef838b10e5972aba916b9a6a4595d9d054718e653fc48a53ca1e38470ae9d04184a5da1e66016504e6505b7735f5b42e29320cc6bf5f61ee3220b77c39f911faff605efec669f46f1e1ded1d06e7651e9a112e6344065f31431733e9a32682d44b83124fd2a126032548e13abd84f58ad5b46e1ae871200e45530167ade31e6be8b2e4abfdf53b8eba67af5984cc5c75d09daa5c72c42636a2ac324c6ab1f8331744d2a77d70eeeb70949abceaba1c104b635b38ddd2254504b2f0b35a7c0b0a8e21406437114d96694533e493839ef9b3b51c2b0571ea6dcce748b6b6de805010ca4938b35905704ebd9e880222586489eb40dab12d2d6a40885d23c33ed0f5d5b7908a28543962a2c5c6b1bf74cd8695f9456bccf207eaac5cd336f7a27ab5b472532a063ec337945858b14a71bb5ccd9cb2af109ad943363e528519e7422891118c8ce7bbdfe6c855087375f3960d86b7d2e506b2c08a54a86177207d6cd1feba68f3454aaf1184eb867d2f04f354ea20ffd5db3d250270870203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604148570009f77591e8cac3c9f77262819cc9ac18f32301006092b06010401823715010403020100300d06092a864886f70d01010b050003820201004f2574bd1f624f5f0ff74222d7d1d65304232ec5d5d7072b6b793b5f6d90ed1355d382f1f5028f3ef996267e0d421876fc6055825a86bd113339690fcee0b02bf15d19dfd8d2fa86a4cccdacf0d0ae9a8b2b248f03c1350d20b3dfc742ea77292e0a12fc0b1a458dd931840d8d02c0acfad212bf1e6a343eea8300a348754e72662da1a5129f37a85d4a7759cfd63afc30c5a609a5bfb108e3fb2c9f76c4fb4e611d6d23f3766985eb49bb0df73dd0aa05bcdd3d6e80445ed99a68ecc989c7e61a18f860a0e78cf6e6516f0ee025b863f9f9c20b8c3c9cb2f042cdbec3f5fe4929559c5e8696fba1ed6d2686e8b8208b5cc6e72d31c5aaca7d4b7da059a41efb5071e9afcfd6aa0d99de8e95269731a5f47f6df46815b8e3f7add8efd13875025ffd6d4efcb6fc2f451ba9cad11e7aff75181536c120e45f483a95eb7be4f5f6f4fec94b21a2a9ea8a9925cbe8444090d539b46b239b52bcc0c17e17666e650bf5741596a866ed856854b224e87588644589853c7a656b96e0f259ea4725660f6a1b0c3fd44ae64b26174709fed4d7b8e0cee72f94ad808b6770ccb77bcf1b2bb9d15bbdb8035cb1f01b412ce6535516e74a0e41089937e2a9d76d0e6a45e5ece388a9fdb69bc32820ceabc2936b516553bfa05e7b9d26349a514c8ca638d5865b3c55ee50ec000bcaacdcca10abdf189bd2ac0c8d084515af8535355ae526bc cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\31D019FC7AB697D57D9C4AFB340ED7C4D10400DF\Blob = 0f0000000100000020000000c6dcba6192a502eb4e7caebea466be00c8abbf2269740faa6156a5341ba0a2be03000000010000001400000031d019fc7ab697d57d9c4afb340ed7c4d10400df2000000001000000250600003082062130820509a00302010202101b427b060e2866bfb586cc267e1c3eaa300d06092a864886f70d01010b0500308191310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564313730350603550403132e434f4d4f444f2052534120457874656e6465642056616c69646174696f6e20436f6465205369676e696e67204341301e170d3138313230343030303030305a170d3231313230333233353935395a308201093110300e060355040513073339313038303531133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b3009060355040613025553310e300c06035504110c053037303133310b300906035504080c024e4a3110300e06035504070c07436c6966746f6e3116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100ad390c8bc919005d5894a91a9585ef887fbd7c2341ff5ebb3efc6f645a66c55e6da11febce740e53ed9416284dfc7d142e4dc21f99753b5f60ae9aadc764b59efd9ffd33b20ae1c54eba629408a1b095a59cf4af0ad9db9bc494250154dcd0edefcec62e4b248d9a793b703aa15255baf3553fa59d4dc558ba4303af630bb626cd6627e0c4a45764ec3b286c38ab2499f9dc13eefdffa7841297ff533b47061b9aa3ff09ee3f04a7b10ba70894e53f3352b1f60eddfc021a66546e3392795bb6ae49a92f189ec2a7cdd9a935fab33a5ce7fc16c4b7e8ca13b4551d38a6a7c0658298a5adf5f6796675f58e1bb4ce410ff704bc5e845bc1ef83c18a0d50e137370203010001a38201f8308201f4301f0603551d23041830168014df8ff3200ce9caa604d85b58372a3dab46dc8349301d0603551d0e041604142d99b81962209042dc650eb36ec07ad996e48c4d300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010601302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f43505330550603551d1f044e304c304aa048a0468644687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e63726c30818606082b06010505070101047a3078305006082b060105050730028644687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30440603551d11043d303ba02306082b06010505070803a01730150c1355532d44454c41574152452d33393130383035811473636f742e7765697240636f6d6f646f2e636f6d300d06092a864886f70d01010b050003820101007f4d3e6594a3e380fac36b00e97ccacce4786be2ecc13cf37e737aaca0328bb8bfdcd513daff94aba1c7ee00cc8a3bd073157a812f6e31f772781d0bb922a8b86932b296c2312cdf3b239c42bb443b4b1b89b36de34a7fae65ac63eb6ead8812f8d373fa6f1a4e8d9e62eb004caae3639e41e08ed48d640b04725b09b4411dc083587e7fe24b33d90677677960efa6299cc85c4b2bfae4cdfe36581d25e029f6af1a7e77f502882d87597f3cc5bb450a71f9fd57f43b321baa4cbe5213a48a2c5b785a9de4103d5029e4db79403e98784e51379d45a86996b183469e98470731d1a603eaa443a05527aca62f51631722dc0dfe5d74c8298d2aed885d34c9be61 cmdagent.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E35E6F46A1A9A4D18A4DAA298BDA4D1E8879236E\Blob = 030000000100000014000000e35e6f46a1a9a4d18a4daa298bda4d1e8879236e20000000010000005f0500003082055b30820443a003020102021100d9218e2757ec45d84ec08b3e6700c85e300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3138313231313030303030305a170d3139303730373233353935395a3081a8310b3009060355040613025553310e300c06035504110c053037303133310b300906035504080c024e4a3110300e06035504070c07436c6966746f6e3116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100b73a668ff7984c8d990d7c6e51df5176c7842cc1bf351c27286c6139f4831fc718a35b0fa9145f0887de8bce335e8e3e12fce763cab5deeae08e0bf325cd79a4fbb328d7c7f7d53de51bd3c05c5966b634a9b1fc4362afd0267f927dd90a52b6a5f5f0e29c8e94dfe4199b2cf31142bb480e95ecb92b6ca20ecd71ff210df9655e9e9ac856ad7aab929b843052d4a21c27ea4054a9f4e8c4cd88943b1a4d3a58b3e06eb654c6c09cef472d6fb0d05a841ce229b53a5d36bd08cbfdc552f7c758efaa7824c1d27e30a83d7a9cecaab4bd91b2cbd60d1335fc4ac0f0294dd2eeb3f65139467761f091840246ff644edbfacb9ffd7ef2823fd9eea312dd299a39af0203010001a38201aa308201a6301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604147c4f2b645af103043ca7675e8c129c16dee7164c300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d301f0603551d1104183016811473636f742e7765697240636f6d6f646f2e636f6d300d06092a864886f70d01010505000382010100b33c0fee4668b9e86cd777fa94eb47dcaee7fb5b9b897b9458b12e511a194b6ad495ea4b6b820d1c7cd26badf92cfc13aaa9e66157a55545c7ea71460a4fa4e30e46b9ac16a36e94a1fcbc62b2abe402d2a58773344c4b23a0d907a9760029595421e478da67167f80876012443cd22573dc3806cdedbc6c8c4ed255bd926cecc7796ec36fb225d084f31afb5e5a2e86d26149212dda8aed2058ef0d7e7e677b463a7722431a0b5c0b9dc385b7d2e73bd781ee111c8f7e36d76e1db1f6ac98784227ed97cde3762d079741984d146a8ff96e411c1b1e4e711cd00a6150532ffaa13702a81f4514eae48ca0b98d8642a6cfe7711dc67d1b857bfecb4e863bc1f9 cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E35E6F46A1A9A4D18A4DAA298BDA4D1E8879236E\Blob = 0f0000000100000014000000e3b244cda88b1ab5a7dc09039d0c3142ae6361e7030000000100000014000000e35e6f46a1a9a4d18a4daa298bda4d1e8879236e20000000010000005f0500003082055b30820443a003020102021100d9218e2757ec45d84ec08b3e6700c85e300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3138313231313030303030305a170d3139303730373233353935395a3081a8310b3009060355040613025553310e300c06035504110c053037303133310b300906035504080c024e4a3110300e06035504070c07436c6966746f6e3116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100b73a668ff7984c8d990d7c6e51df5176c7842cc1bf351c27286c6139f4831fc718a35b0fa9145f0887de8bce335e8e3e12fce763cab5deeae08e0bf325cd79a4fbb328d7c7f7d53de51bd3c05c5966b634a9b1fc4362afd0267f927dd90a52b6a5f5f0e29c8e94dfe4199b2cf31142bb480e95ecb92b6ca20ecd71ff210df9655e9e9ac856ad7aab929b843052d4a21c27ea4054a9f4e8c4cd88943b1a4d3a58b3e06eb654c6c09cef472d6fb0d05a841ce229b53a5d36bd08cbfdc552f7c758efaa7824c1d27e30a83d7a9cecaab4bd91b2cbd60d1335fc4ac0f0294dd2eeb3f65139467761f091840246ff644edbfacb9ffd7ef2823fd9eea312dd299a39af0203010001a38201aa308201a6301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604147c4f2b645af103043ca7675e8c129c16dee7164c300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d301f0603551d1104183016811473636f742e7765697240636f6d6f646f2e636f6d300d06092a864886f70d01010505000382010100b33c0fee4668b9e86cd777fa94eb47dcaee7fb5b9b897b9458b12e511a194b6ad495ea4b6b820d1c7cd26badf92cfc13aaa9e66157a55545c7ea71460a4fa4e30e46b9ac16a36e94a1fcbc62b2abe402d2a58773344c4b23a0d907a9760029595421e478da67167f80876012443cd22573dc3806cdedbc6c8c4ed255bd926cecc7796ec36fb225d084f31afb5e5a2e86d26149212dda8aed2058ef0d7e7e677b463a7722431a0b5c0b9dc385b7d2e73bd781ee111c8f7e36d76e1db1f6ac98784227ed97cde3762d079741984d146a8ff96e411c1b1e4e711cd00a6150532ffaa13702a81f4514eae48ca0b98d8642a6cfe7711dc67d1b857bfecb4e863bc1f9 cmdagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\16232A798863E5950F9F44977A033CF91793D8F1 cfpconfg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\16232A798863E5950F9F44977A033CF91793D8F1 cmdagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\D70D7D00CA12E1B3E20F3BF7534DEB2C2E7C2404 cmdagent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\6CD253D636A7B4D0E0981431BC064061A9853ED9\Blob = 0300000001000000140000006cd253d636a7b4d0e0981431bc064061a9853ed920000000010000001b06000030820617308204ffa003020102021032327facb1bd6f1fa93473ccc515fd82300d06092a864886f70d01010b0500308191310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564313730350603550403132e434f4d4f444f2052534120457874656e6465642056616c69646174696f6e20436f6465205369676e696e67204341301e170d3138303132343030303030305a170d3231303132333233353935395a308201153110300e060355040513073339313038303531133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e311a301806035504090c11313235352042726f61642053747265657431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100b7713778a66667b8cd67f828f378f80a5507c4e8aa143cfd5b9b953ab16d04a965dcd386a35efe8378c1e0e5ceaf124f188102958962014e493cd80f11fc2ba339953a8bb71a9f030ebbe8742b4252ab465a2d41a829508a9eef5d34d171fcf0b5be026fe15e1a70288b2ecd4af1332924d53c0eefe5c7033482769cae8b5c5e8d59033fac40e94d714c5cd05e8db6f0edb71bb26565d52a025f35323203e9a7846d00a235f973d1e43f29a81dcd1bfef625d373f94a51cc8d2be8ee69702a73a694da69d9b0fbae7d1dee353683a2037a2019b9260a1b53f6c89d945b384c275670bdfac333301504af00749373356a1e7a422eb9363bdab713f9ad6b5bb1970203010001a38201e2308201de301f0603551d23041830168014df8ff3200ce9caa604d85b58372a3dab46dc8349301d0603551d0e04160414e18081b3e9396b7109e8b2add6c3d20ebf4b4814300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010601302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f43505330550603551d1f044e304c304aa048a0468644687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e63726c30818606082b06010505070101047a3078305006082b060105050730028644687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33393130383035300d06092a864886f70d01010b050003820101004bc17929ea82f3c4787f7b29b69edb09e169797a9f4cd233f035412d2b9c586e352d2c0d1cd530a946a91ccd8858453573f0b45a0cdc743d662af4761420489adadbd9a84915b697f96ed1e49786c53000eb12555d3b2957eec18279326020737e2e3e4d621856026169ad6f6cf18ee7b59d5b6a7e6d8c252fa1a15363ec89a6efe5efdf4b260ad35c6a0e1db0250d1eb66ea7b91f15e0f57ecc0541e1ad74a2069f717dec0b1f03101b6812c13f64264f8c40a3614ffb8ccabedb974cda14eb50c061d5cd23dc7735cd0bcfdcef3fd178c1f95594a591031d05c8554cb5fe6fd23cb95931bf847f5b525a269aeac0336313e8f6e81ccb1692d86993724f709e cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\D70D7D00CA12E1B3E20F3BF7534DEB2C2E7C2404\Blob = 0f00000001000000200000008f4390d93853f6a1a1b71fdc231e030586f8213a5846c95d90b527f5c6dbd80f030000000100000014000000d70d7d00ca12e1b3e20f3bf7534deb2c2e7c24042000000001000000530500003082054f30820437a00302010202102f9f0a1d6764b5a6378747247087ba73300d06092a864886f70d01010b0500307d310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312330210603550403131a434f4d4f444f2052534120436f6465205369676e696e67204341301e170d3138313231313030303030305a170d3139313231313233353935395a3081b8310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303116301406035504090c0d313235352042726f616420537431223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100c1b2eafc6255d7a7780082967ba911a65b8160e697a9c81ae0816002356644b714895808a67b22551d87b879e80d0c1bff7bd847e1486bad3c3caa8c6f3258a7311f8b03c68c9ec5947950e57a1f99f4b47b8faaf46e282f68155ae6e8f13c9c125b5eb83ae4e63ee6081d0e8aae4f090175a538422b38e0600bd94b21b313567934ee959ddd6ab7ef62bce25dada05d7de6a75cefeffdcba6a1fc8e1ef7aa6d3e5ab328732c3d31759a20d7e69cef60ac9d152041dbd85167a78329f3a80fee19ea9edb102448aa9f5774794ecb560de2faa348f278b846a2a5d8238d5e4e4cd2a82f0e37415af2dc63f34f3e179aa1cae7290b411aaf5aa6acf5404ebe98130203010001a382018d30820189301f0603551d23041830168014299160ff8a4dfaebf9a66ab8cff9e64bbd49ce12301d0603551d0e041604146c5f99825f4ba8d4c19bae5169bab32fae7816ca300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e63726c307406082b0601050507010104683066303e06082b060105050730028632687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010b050003820101000f718c2aa40e9c44a95e1eca3844097ddb7fba896b5f5c73a6b9aede1d29f0e432f41c8a45ce38b1f52df73f45e67907a03ac58d407b3077b1cae246a54544ee365bcee4bf0f4cecc47b01e98d0478d8f4c93e2c582aa472577de9c67a0a8c2e37635e626258675e0e6669babee331594abed516679e8f1b14d7a65dc1b76ab33412689b135cf855335748e2d1998759e5b95f68d418d5486d385d0db7a8fa30e58e84f57bb7ec3f45efa549fab71775c822ec846545b6fc0ef1d3c2dad34940657088fc5f773a1cbe24f9228f9dd7e9611d5d682998c6041ba580a789f5571da01d6723784bbcec4fded61d0ba31e37fbc10c3dfe06169df4670c8d454019f7 cmdagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 040000000100000010000000a7f2e41606411150306b9ce3b49cb0c90f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d80b000000010000001400000055005300450052005400720075007300740000001d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d46190000000100000010000000e843ac3b52ec8c297fa948c9b1fb281920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 cmdinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\31D019FC7AB697D57D9C4AFB340ED7C4D10400DF cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F8DB7E1C16F1FFD4AAAD4AAD8DFF0F2445184AEB\Blob = 030000000100000014000000f8db7e1c16f1ffd4aaad4aad8dff0f2445184aeb20000000010000000906000030820605308203eda0030201020210078f0a9d03df119e434e4fec1bf0235a300d06092a864886f70d01010b0500308194310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313e303c060355040313354d6963726f736f667420446576656c6f706d656e7420526f6f7420436572746966696361746520417574686f726974792032303134301e170d3134303532383136343334365a170d3339303532383136353134385a308194310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313e303c060355040313354d6963726f736f667420446576656c6f706d656e7420526f6f7420436572746966696361746520417574686f72697479203230313430820222300d06092a864886f70d01010105000382020f003082020a0282020100c20f7f6d49bb39f04d943fe8fb4dc5eb3be1285ab9892a467ea5c333271d82893feb33a1876aeae882b9dac39d77d135c0cb833672a6571912bc15e2c83c7b83623414d5abb6de368ba15a71a65196a70633b3221d146253c2a5af9a40cabe2c485499e72a9368a769190b99693bc1b2acae94dc5fab7e02cade3ca774a68c10a0e5aeb69c35ef838b10e5972aba916b9a6a4595d9d054718e653fc48a53ca1e38470ae9d04184a5da1e66016504e6505b7735f5b42e29320cc6bf5f61ee3220b77c39f911faff605efec669f46f1e1ded1d06e7651e9a112e6344065f31431733e9a32682d44b83124fd2a126032548e13abd84f58ad5b46e1ae871200e45530167ade31e6be8b2e4abfdf53b8eba67af5984cc5c75d09daa5c72c42636a2ac324c6ab1f8331744d2a77d70eeeb70949abceaba1c104b635b38ddd2254504b2f0b35a7c0b0a8e21406437114d96694533e493839ef9b3b51c2b0571ea6dcce748b6b6de805010ca4938b35905704ebd9e880222586489eb40dab12d2d6a40885d23c33ed0f5d5b7908a28543962a2c5c6b1bf74cd8695f9456bccf207eaac5cd336f7a27ab5b472532a063ec337945858b14a71bb5ccd9cb2af109ad943363e528519e7422891118c8ce7bbdfe6c855087375f3960d86b7d2e506b2c08a54a86177207d6cd1feba68f3454aaf1184eb867d2f04f354ea20ffd5db3d250270870203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604148570009f77591e8cac3c9f77262819cc9ac18f32301006092b06010401823715010403020100300d06092a864886f70d01010b050003820201004f2574bd1f624f5f0ff74222d7d1d65304232ec5d5d7072b6b793b5f6d90ed1355d382f1f5028f3ef996267e0d421876fc6055825a86bd113339690fcee0b02bf15d19dfd8d2fa86a4cccdacf0d0ae9a8b2b248f03c1350d20b3dfc742ea77292e0a12fc0b1a458dd931840d8d02c0acfad212bf1e6a343eea8300a348754e72662da1a5129f37a85d4a7759cfd63afc30c5a609a5bfb108e3fb2c9f76c4fb4e611d6d23f3766985eb49bb0df73dd0aa05bcdd3d6e80445ed99a68ecc989c7e61a18f860a0e78cf6e6516f0ee025b863f9f9c20b8c3c9cb2f042cdbec3f5fe4929559c5e8696fba1ed6d2686e8b8208b5cc6e72d31c5aaca7d4b7da059a41efb5071e9afcfd6aa0d99de8e95269731a5f47f6df46815b8e3f7add8efd13875025ffd6d4efcb6fc2f451ba9cad11e7aff75181536c120e45f483a95eb7be4f5f6f4fec94b21a2a9ea8a9925cbe8444090d539b46b239b52bcc0c17e17666e650bf5741596a866ed856854b224e87588644589853c7a656b96e0f259ea4725660f6a1b0c3fd44ae64b26174709fed4d7b8e0cee72f94ad808b6770ccb77bcf1b2bb9d15bbdb8035cb1f01b412ce6535516e74a0e41089937e2a9d76d0e6a45e5ece388a9fdb69bc32820ceabc2936b516553bfa05e7b9d26349a514c8ca638d5865b3c55ee50ec000bcaacdcca10abdf189bd2ac0c8d084515af8535355ae526bc cfpconfg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F8DB7E1C16F1FFD4AAAD4AAD8DFF0F2445184AEB cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F8DB7E1C16F1FFD4AAAD4AAD8DFF0F2445184AEB\Blob = 1400000001000000140000008570009f77591e8cac3c9f77262819cc9ac18f32030000000100000014000000f8db7e1c16f1ffd4aaad4aad8dff0f2445184aeb0f0000000100000020000000ed55f82e1444f79ca9dce826846fdc4e0ea3859e3d26efef412d2fff0c7c8e6c20000000010000000906000030820605308203eda0030201020210078f0a9d03df119e434e4fec1bf0235a300d06092a864886f70d01010b0500308194310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313e303c060355040313354d6963726f736f667420446576656c6f706d656e7420526f6f7420436572746966696361746520417574686f726974792032303134301e170d3134303532383136343334365a170d3339303532383136353134385a308194310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313e303c060355040313354d6963726f736f667420446576656c6f706d656e7420526f6f7420436572746966696361746520417574686f72697479203230313430820222300d06092a864886f70d01010105000382020f003082020a0282020100c20f7f6d49bb39f04d943fe8fb4dc5eb3be1285ab9892a467ea5c333271d82893feb33a1876aeae882b9dac39d77d135c0cb833672a6571912bc15e2c83c7b83623414d5abb6de368ba15a71a65196a70633b3221d146253c2a5af9a40cabe2c485499e72a9368a769190b99693bc1b2acae94dc5fab7e02cade3ca774a68c10a0e5aeb69c35ef838b10e5972aba916b9a6a4595d9d054718e653fc48a53ca1e38470ae9d04184a5da1e66016504e6505b7735f5b42e29320cc6bf5f61ee3220b77c39f911faff605efec669f46f1e1ded1d06e7651e9a112e6344065f31431733e9a32682d44b83124fd2a126032548e13abd84f58ad5b46e1ae871200e45530167ade31e6be8b2e4abfdf53b8eba67af5984cc5c75d09daa5c72c42636a2ac324c6ab1f8331744d2a77d70eeeb70949abceaba1c104b635b38ddd2254504b2f0b35a7c0b0a8e21406437114d96694533e493839ef9b3b51c2b0571ea6dcce748b6b6de805010ca4938b35905704ebd9e880222586489eb40dab12d2d6a40885d23c33ed0f5d5b7908a28543962a2c5c6b1bf74cd8695f9456bccf207eaac5cd336f7a27ab5b472532a063ec337945858b14a71bb5ccd9cb2af109ad943363e528519e7422891118c8ce7bbdfe6c855087375f3960d86b7d2e506b2c08a54a86177207d6cd1feba68f3454aaf1184eb867d2f04f354ea20ffd5db3d250270870203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604148570009f77591e8cac3c9f77262819cc9ac18f32301006092b06010401823715010403020100300d06092a864886f70d01010b050003820201004f2574bd1f624f5f0ff74222d7d1d65304232ec5d5d7072b6b793b5f6d90ed1355d382f1f5028f3ef996267e0d421876fc6055825a86bd113339690fcee0b02bf15d19dfd8d2fa86a4cccdacf0d0ae9a8b2b248f03c1350d20b3dfc742ea77292e0a12fc0b1a458dd931840d8d02c0acfad212bf1e6a343eea8300a348754e72662da1a5129f37a85d4a7759cfd63afc30c5a609a5bfb108e3fb2c9f76c4fb4e611d6d23f3766985eb49bb0df73dd0aa05bcdd3d6e80445ed99a68ecc989c7e61a18f860a0e78cf6e6516f0ee025b863f9f9c20b8c3c9cb2f042cdbec3f5fe4929559c5e8696fba1ed6d2686e8b8208b5cc6e72d31c5aaca7d4b7da059a41efb5071e9afcfd6aa0d99de8e95269731a5f47f6df46815b8e3f7add8efd13875025ffd6d4efcb6fc2f451ba9cad11e7aff75181536c120e45f483a95eb7be4f5f6f4fec94b21a2a9ea8a9925cbe8444090d539b46b239b52bcc0c17e17666e650bf5741596a866ed856854b224e87588644589853c7a656b96e0f259ea4725660f6a1b0c3fd44ae64b26174709fed4d7b8e0cee72f94ad808b6770ccb77bcf1b2bb9d15bbdb8035cb1f01b412ce6535516e74a0e41089937e2a9d76d0e6a45e5ece388a9fdb69bc32820ceabc2936b516553bfa05e7b9d26349a514c8ca638d5865b3c55ee50ec000bcaacdcca10abdf189bd2ac0c8d084515af8535355ae526bc cmdinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\31D019FC7AB697D57D9C4AFB340ED7C4D10400DF cmdagent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 190000000100000010000000e843ac3b52ec8c297fa948c9b1fb2819030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d461d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67080b00000001000000140000005500530045005200540072007500730074000000140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d8090000000100000016000000301406082b0601050507030306082b060105050703080f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb20000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 cmdinstall.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 2496 isestart.exe 2496 isestart.exe 2496 isestart.exe 2496 isestart.exe 2496 isestart.exe 2496 isestart.exe 2496 isestart.exe 2496 isestart.exe 2832 msiexec.exe 2832 msiexec.exe 2520 cmdagent.exe -
Suspicious behavior: LoadsDriver 4 IoCs
pid Process 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTcbPrivilege 2760 cmdinstall.exe Token: SeDebugPrivilege 2496 isestart.exe Token: SeDebugPrivilege 2496 isestart.exe Token: SeDebugPrivilege 2496 isestart.exe Token: SeDebugPrivilege 2496 isestart.exe Token: SeShutdownPrivilege 2760 cmdinstall.exe Token: SeIncreaseQuotaPrivilege 2760 cmdinstall.exe Token: SeRestorePrivilege 2832 msiexec.exe Token: SeTakeOwnershipPrivilege 2832 msiexec.exe Token: SeSecurityPrivilege 2832 msiexec.exe Token: SeCreateTokenPrivilege 2760 cmdinstall.exe Token: SeAssignPrimaryTokenPrivilege 2760 cmdinstall.exe Token: SeLockMemoryPrivilege 2760 cmdinstall.exe Token: SeIncreaseQuotaPrivilege 2760 cmdinstall.exe Token: SeMachineAccountPrivilege 2760 cmdinstall.exe Token: SeTcbPrivilege 2760 cmdinstall.exe Token: SeSecurityPrivilege 2760 cmdinstall.exe Token: SeTakeOwnershipPrivilege 2760 cmdinstall.exe Token: SeLoadDriverPrivilege 2760 cmdinstall.exe Token: SeSystemProfilePrivilege 2760 cmdinstall.exe Token: SeSystemtimePrivilege 2760 cmdinstall.exe Token: SeProfSingleProcessPrivilege 2760 cmdinstall.exe Token: SeIncBasePriorityPrivilege 2760 cmdinstall.exe Token: SeCreatePagefilePrivilege 2760 cmdinstall.exe Token: SeCreatePermanentPrivilege 2760 cmdinstall.exe Token: SeBackupPrivilege 2760 cmdinstall.exe Token: SeRestorePrivilege 2760 cmdinstall.exe Token: SeShutdownPrivilege 2760 cmdinstall.exe Token: SeDebugPrivilege 2760 cmdinstall.exe Token: SeAuditPrivilege 2760 cmdinstall.exe Token: SeSystemEnvironmentPrivilege 2760 cmdinstall.exe Token: SeChangeNotifyPrivilege 2760 cmdinstall.exe Token: SeRemoteShutdownPrivilege 2760 cmdinstall.exe Token: SeUndockPrivilege 2760 cmdinstall.exe Token: SeSyncAgentPrivilege 2760 cmdinstall.exe Token: SeEnableDelegationPrivilege 2760 cmdinstall.exe Token: SeManageVolumePrivilege 2760 cmdinstall.exe Token: SeImpersonatePrivilege 2760 cmdinstall.exe Token: SeCreateGlobalPrivilege 2760 cmdinstall.exe Token: SeRestorePrivilege 2832 msiexec.exe Token: SeTakeOwnershipPrivilege 2832 msiexec.exe Token: SeRestorePrivilege 2832 msiexec.exe Token: SeTakeOwnershipPrivilege 2832 msiexec.exe Token: SeTcbPrivilege 3028 MsiExec.exe Token: SeRestorePrivilege 2832 msiexec.exe Token: SeTakeOwnershipPrivilege 2832 msiexec.exe Token: SeTcbPrivilege 3028 MsiExec.exe Token: SeRestorePrivilege 2832 msiexec.exe Token: SeTakeOwnershipPrivilege 2832 msiexec.exe Token: SeTcbPrivilege 3028 MsiExec.exe Token: SeRestorePrivilege 2832 msiexec.exe Token: SeTakeOwnershipPrivilege 2832 msiexec.exe Token: SeTcbPrivilege 3028 MsiExec.exe Token: SeRestorePrivilege 2832 msiexec.exe Token: SeTakeOwnershipPrivilege 2832 msiexec.exe Token: SeRestorePrivilege 2832 msiexec.exe Token: SeTakeOwnershipPrivilege 2832 msiexec.exe Token: SeTcbPrivilege 3028 MsiExec.exe Token: SeRestorePrivilege 2832 msiexec.exe Token: SeTakeOwnershipPrivilege 2832 msiexec.exe Token: SeRestorePrivilege 2832 msiexec.exe Token: SeTakeOwnershipPrivilege 2832 msiexec.exe Token: SeTcbPrivilege 1796 MsiExec.exe Token: SeRestorePrivilege 2832 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2512 cispro_installer.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2760 cmdinstall.exe 2760 cmdinstall.exe 2760 cmdinstall.exe 2760 cmdinstall.exe 2760 cmdinstall.exe 2760 cmdinstall.exe 2760 cmdinstall.exe 2760 cmdinstall.exe 2496 isestart.exe 2496 isestart.exe 2760 cmdinstall.exe 2760 cmdinstall.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2760 2512 cispro_installer.exe 28 PID 2512 wrote to memory of 2760 2512 cispro_installer.exe 28 PID 2512 wrote to memory of 2760 2512 cispro_installer.exe 28 PID 2512 wrote to memory of 2760 2512 cispro_installer.exe 28 PID 2512 wrote to memory of 2760 2512 cispro_installer.exe 28 PID 2512 wrote to memory of 2760 2512 cispro_installer.exe 28 PID 2512 wrote to memory of 2760 2512 cispro_installer.exe 28 PID 2760 wrote to memory of 2172 2760 cmdinstall.exe 32 PID 2760 wrote to memory of 2172 2760 cmdinstall.exe 32 PID 2760 wrote to memory of 2172 2760 cmdinstall.exe 32 PID 2760 wrote to memory of 2172 2760 cmdinstall.exe 32 PID 2760 wrote to memory of 2172 2760 cmdinstall.exe 32 PID 2760 wrote to memory of 2172 2760 cmdinstall.exe 32 PID 2760 wrote to memory of 2172 2760 cmdinstall.exe 32 PID 2172 wrote to memory of 2496 2172 ise_installer.exe 33 PID 2172 wrote to memory of 2496 2172 ise_installer.exe 33 PID 2172 wrote to memory of 2496 2172 ise_installer.exe 33 PID 2172 wrote to memory of 2496 2172 ise_installer.exe 33 PID 2832 wrote to memory of 3028 2832 msiexec.exe 35 PID 2832 wrote to memory of 3028 2832 msiexec.exe 35 PID 2832 wrote to memory of 3028 2832 msiexec.exe 35 PID 2832 wrote to memory of 3028 2832 msiexec.exe 35 PID 2832 wrote to memory of 3028 2832 msiexec.exe 35 PID 2832 wrote to memory of 1796 2832 msiexec.exe 36 PID 2832 wrote to memory of 1796 2832 msiexec.exe 36 PID 2832 wrote to memory of 1796 2832 msiexec.exe 36 PID 2832 wrote to memory of 1796 2832 msiexec.exe 36 PID 2832 wrote to memory of 1796 2832 msiexec.exe 36 PID 2832 wrote to memory of 2784 2832 msiexec.exe 37 PID 2832 wrote to memory of 2784 2832 msiexec.exe 37 PID 2832 wrote to memory of 2784 2832 msiexec.exe 37 PID 2784 wrote to memory of 1296 2784 MSI64E6.tmp 38 PID 2784 wrote to memory of 1296 2784 MSI64E6.tmp 38 PID 2784 wrote to memory of 1296 2784 MSI64E6.tmp 38 PID 2832 wrote to memory of 2880 2832 msiexec.exe 42 PID 2832 wrote to memory of 2880 2832 msiexec.exe 42 PID 2832 wrote to memory of 2880 2832 msiexec.exe 42 PID 2832 wrote to memory of 2044 2832 msiexec.exe 43 PID 2832 wrote to memory of 2044 2832 msiexec.exe 43 PID 2832 wrote to memory of 2044 2832 msiexec.exe 43 PID 2832 wrote to memory of 2044 2832 msiexec.exe 43 PID 2832 wrote to memory of 2044 2832 msiexec.exe 43 PID 2832 wrote to memory of 2784 2832 msiexec.exe 44 PID 2832 wrote to memory of 2784 2832 msiexec.exe 44 PID 2832 wrote to memory of 2784 2832 msiexec.exe 44 PID 2832 wrote to memory of 2784 2832 msiexec.exe 44 PID 2832 wrote to memory of 2784 2832 msiexec.exe 44 PID 2832 wrote to memory of 2024 2832 msiexec.exe 45 PID 2832 wrote to memory of 2024 2832 msiexec.exe 45 PID 2832 wrote to memory of 2024 2832 msiexec.exe 45 PID 2832 wrote to memory of 996 2832 msiexec.exe 46 PID 2832 wrote to memory of 996 2832 msiexec.exe 46 PID 2832 wrote to memory of 996 2832 msiexec.exe 46 PID 1796 wrote to memory of 540 1796 MsiExec.exe 47 PID 1796 wrote to memory of 540 1796 MsiExec.exe 47 PID 1796 wrote to memory of 540 1796 MsiExec.exe 47 PID 1796 wrote to memory of 2772 1796 MsiExec.exe 48 PID 1796 wrote to memory of 2772 1796 MsiExec.exe 48 PID 1796 wrote to memory of 2772 1796 MsiExec.exe 48 PID 1796 wrote to memory of 2144 1796 MsiExec.exe 49 PID 1796 wrote to memory of 2144 1796 MsiExec.exe 49 PID 1796 wrote to memory of 2144 1796 MsiExec.exe 49 PID 1796 wrote to memory of 1472 1796 MsiExec.exe 50 PID 1796 wrote to memory of 1472 1796 MsiExec.exe 50 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cispro_installer.exe"C:\Users\Admin\AppData\Local\Temp\cispro_installer.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe" -log -setupname "cispro_installer.exe" -sfx "C:\Users\Admin\AppData\Local\Temp" -theme lycia -type alone -mode cispro -partner 181372⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\ProgramData\Comodo\Installer\ise_installer.exe"C:\ProgramData\\Comodo\Installer\ise_installer.exe" /quiet /chid=18137 /aff=181373⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\bin\ise_installer\isestart.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\bin\ise_installer\isestart.exe" /quiet /chid=18137 /aff=181374⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2496
-
-
-
C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --langID 1033 --secureDNS install3⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
- Executes dropped EXE
PID:2788
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Loads dropped DLL
- Registers COM server for autorun
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 7DD0BA5FF46E512463F586527105115E2⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3028
-
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding AD8115AAD429A8DE85474B42ADE5FCC1 M Global\MSI00002⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Adds Run key to start application
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --langID 1033 --createConfig "active=avfw;dplus=opt;esm=0;av=1;fw=1;cesfw=1;cesav=1;cessandbox=1;free=0;noalerts=1;cloud=1;sendstats=1;configfile=;fwstate=0;dfstate=0;avstate=0;bbstate=0;avservers=0;standalone=1;useblob=1;trustnewnets=0;"3⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
PID:540
-
-
C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --upgradeBackuped=""3⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
PID:2772
-
-
C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --windowsDefence fw-df-3⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
PID:2144
-
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r3⤵
- Checks processor information in registry
PID:1472 -
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o4⤵PID:2052
-
-
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r3⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:1896 -
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o4⤵PID:892
-
-
-
-
C:\Windows\Installer\MSI64E6.tmp"C:\Windows\Installer\MSI64E6.tmp" -rptype 0 -descr "Installing COMODO Internet Security Pro" -logfile "C:\Users\Admin\AppData\Local\Temp\COMODO Internet Security dbgout.log"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\Installer\MSI64E6.tmp"C:\Windows\Installer\MSI64E6.tmp" -rptype 0 -descr "Installing COMODO Internet Security Pro" -logfile "C:\Users\Admin\AppData\Local\Temp\COMODO Internet Security dbgout.log" -working3⤵
- Executes dropped EXE
PID:1296
-
-
-
C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --installCertificates2⤵
- Manipulates Digital Signatures
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:2880
-
-
C:\Windows\system32\regsvr32.exe"regsvr32.exe" /s "C:\Program Files\COMODO\COMODO Internet Security\cisresc.dll"2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:2044
-
-
C:\Windows\system32\regsvr32.exe"regsvr32.exe" /s "C:\Program Files\COMODO\COMODO Internet Security\cisbfps.dll"2⤵
- Loads dropped DLL
- Registers COM server for autorun
PID:2784
-
-
C:\Program Files\COMODO\COMODO Internet Security\cisbf.exe"C:\Program Files\COMODO\COMODO Internet Security\cisbf.exe" /RegServer2⤵
- Executes dropped EXE
- Registers COM server for autorun
PID:2024
-
-
C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --updateHtml2⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
PID:996
-
-
C:\Windows\system32\regsvr32.exe"regsvr32.exe" /s "C:\Program Files\COMODO\COMODO Internet Security\cavshell.dll"2⤵
- Enumerates connected drives
- Loads dropped DLL
- Modifies system executable filetype association
- Registers COM server for autorun
- Modifies registry class
PID:3068
-
-
C:\Windows\syswow64\MsiExec.exe"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\COMODO\COMODO Internet Security\cmdcom32.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:832
-
-
C:\Windows\system32\MsiExec.exe"C:\Windows\system32\MsiExec.exe" /Y "C:\Program Files\COMODO\COMODO Internet Security\cmdcomps.dll"2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:2072
-
-
C:\Windows\system32\MsiExec.exe"C:\Windows\system32\MsiExec.exe" /Y "C:\Program Files\COMODO\COMODO Internet Security\cavwpps.dll"2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:1572
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2792
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003AC" "00000000000003E0"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2840
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{669e360b-999b-01b1-d88a-a44a307bc03b}\inspect.inf" "9" "66519e52b" "00000000000004D8" "WinSta0\Default" "00000000000003E0" "208" "C:\Program Files\COMODO\COMODO Internet Security\drivers\win7"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2824 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{7e8178a8-c837-6fad-d70f-dc317de5a63f} Global\{430a32f4-d86d-635c-a09e-687ee2cd9c74} C:\Windows\System32\DriverStore\Temp\{51067f33-4eb9-651a-3044-4100da2cd00f}\inspect.inf C:\Windows\System32\DriverStore\Temp\{51067f33-4eb9-651a-3044-4100da2cd00f}\inspect.cat2⤵
- Modifies data under HKEY_USERS
PID:1652
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot20" "" "" "65dbac317" "0000000000000000" "000000000000057C" "00000000000005D4"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:484
-
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe"C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe"1⤵
- Manipulates Digital Signatures
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2520 -
C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --windowsDefence fw- df-2⤵PID:2564
-
-
C:\Program Files\COMODO\COMODO Internet Security\cmdinstall.exe"C:\Program Files\COMODO\COMODO Internet Security\cmdinstall.exe" -type local -log -camevent autotrial-expired2⤵PID:1480
-
-
C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe"C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe" /ModeAvMonitor -Embedding1⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
PID:2496
-
C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe"C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe" /ModeAvMonitor -Embedding1⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
PID:2692
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2316
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1f01⤵PID:1512
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:1488
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Event Triggered Execution
1Change Default File Association
1Defense Evasion
Modify Registry
4Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD5ad429a8f62000dd0dd70e7de5313ffa7
SHA155f9eba5862aa9829c3ba02fa5e51b3331f5d39f
SHA256c7af35f0dcca3cbefc2d8aa58636038b0f44453120ea4068182cb7578c619380
SHA512c3e5e59e93e3b2e6185fa1c35e6284f59e4508a0e2c68e2a96a2d0eef1964d388075638ebf015e6375da1b6666f278faf347f03cf4d083f5911ef8f700574c80
-
Filesize
5.5MB
MD564e54f0e5d49ac782f1eb173a188e9e3
SHA119d692f28554c834cee060b90d5b389f2bda1b9e
SHA256c2f34e60d79130f1d7a795ede2cc636fe671ef0e0bc75ca0ef89148570ed8d12
SHA512656d2c9644bf9d3ae96485dcd948beffc5aa333f03b370afb501ce82347255da5c94769af5f141813163f859a09cacdd10fb5e48f7b41ab0c161854b9243863e
-
Filesize
131.5MB
MD5cfb98132af1875048a4443c24d6b8973
SHA16d858e7d59dad73f751b590ae4fd479e810ac84d
SHA25690b30e0db3d7203abcf1149b575bdcb641f47f89c718dd8ade59d934e1071a85
SHA5127b5ef82f00164c13c1e6c8c8c3fd4ed4498330fff9450edbcd395a7452af5da1fe946c347258871039f847a391f53c2577beedf4fab793040d4385886445bb26
-
Filesize
4.3MB
MD5bc5be4070c49a53b67f38e6620c47b99
SHA13979c599941b75ac693b4fe8ebe8bedde2a809e9
SHA256ec3e0dbb7d9c14bad85c80367d1ffe777ceaa19dd8ef9e75d6c12c4c3902ec83
SHA51292573222ec9502036c55f672cacd4a133b896cc38d9b3d6dfab03233241cc5ead5b25880ba5cbd196eefd31a597df2ea2595df323f000a7ac858ee718225b9f9
-
Filesize
4.3MB
MD5624e96199b48e767a5e8a92d4889a8e0
SHA1c1639cb06070caa831e59d2ba13d14b4a436ce21
SHA256c73cac409c235b17b7a4070a6428ba6f04253d3aec17ca4ba0b0fe4f592eff20
SHA5128de58ff3fafba01d51b5393ec6b5eb200447de6e23000b8cdaf5e6bb3f22dc3571955afa88f61e2436371822c4acdca9c6a9cfa51f1ee52427f18729bab41cb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57dfc5c8d58b79529e5a60bf02b1d820c
SHA1bc3ee55903f438c07d99b7181a4f50e579e3cf08
SHA256a3807c37c428a7218eae97460af981b1e3595cb62c55106950ce1edf52068aac
SHA5121d05bb49d1e6cf45305f1acc326bdde7ad26b9f93202f5f3cd696c2ed09cabfd637297a7d4c4c562c03771a3d95f4056e73465ab4b3cfc4794af1d9d6d2dd2c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590f763312095b8c3c69a5bc41814b846
SHA122049fdfd8543784156fb9a2567d1c3b36c588ed
SHA256d9713a4c1c9a576e4398766b7590dd92f83d994534c858abeedb2e834d806ee0
SHA512fe947e152bdf9fdaddbde2ea69de4778157f2c74d261f8239b2f2107e30247ff34219d291c632c8b2f25763537ce8607a47908099b18e4073610d0d1d7e3ae8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Filesize482B
MD593fe3df6165f571a25baa53042446738
SHA14de05cf14ccc24d4598bd02401e14ce0041876dc
SHA256e3585e6df7bc4140cc334f024726ff3517480a83a120a53637f44a613c74246b
SHA5120b645f178023bbb107efc76711242d270ea91f61406bc3ed765820955f0f747c81fa2a523576f29bf0b0235ee79991e638230e6c6ff8eabefccaced1ab42697c
-
Filesize
330KB
MD52ff3721744f00cd6fa0ce7031ea86769
SHA1005e59d04eaa680e0a77aa194b9b48f826380d12
SHA2560a947e4dd0702e1126fff6a23ba4131da96344ab593bf2c9e1f880fdd73211cc
SHA512f7df2481609b10235be22a0ca1f2af9cbd41b6377eacd25edf26bf728d7a4fbedf96c79bba6a22f4f6fcf280ea158fa9ae6b870f29db23ba2528119bd0578524
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cis\download\installs\installer_data\eula\eula_cavplus.html
Filesize171KB
MD5b655d81127550b07fbe2ac849e6e1e42
SHA161fa51e4c9f01d5c7302a8a9ac6c43bbc665c45d
SHA25632ac5b1265a7cae273baab2be295ee71a9033ff4233bf92630872523770cc241
SHA5124a8d05f7488e6bc91aa545618e1d6dedb7508bcf7d635777e2f67c82fcc40e29116924598ed563c7778c32e6a837a5f6467d8d4c01ae282a84b89783fbde9571
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cis\download\installs\installer_data\installer_init.xml
Filesize20KB
MD547489ef3b4ded9d16c3397a9dd59bcec
SHA1d4e75dd52c44f1719367ec71dd95687b584f2de6
SHA256daed5a1bb75b78ba1affb43371a2e63fa73a2b7fd3f5f0332db452c2764e864c
SHA5128259dd938a3e4748088dca878a77d1f9cddb51654949f73851a84f8263b28296c6e40c89b413ff2ed30ddc041dcb5ed2195a182fa5ae1ca6a410bdc8d4d699bc
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cis\download\installs\xml_binaries\acronis_bc\abc_1028.html
Filesize158B
MD569f5bb74c296ae50fd1a0333bd067f1b
SHA18f3f9e0f8a5c6d9c6f6504602224f707f972c639
SHA256058fa934bda4323bd47df539aa007a78fd913aa4a0aa2f0ddb45f9c2aecfd2f9
SHA512613ef1c981cc84baac45422773d876a21d0e7487280a19070d90785d10442417ffc34e9d31e37fb9438990272d5621e0e8ed48ac8eaa51c2af236acf6fd8477c
-
Filesize
1KB
MD5b66a19a2271157e17c9e82bdf60e7e85
SHA1d414b0cb582e3fd97607579b81b3ec018d4d8658
SHA25650b73292085f99b4ffdfeb038e5239620e760b78d4ed22062349f5e6680f2d03
SHA512047e6c9187875078d8e9ffc3e3fed4a89c1b2ffb4b35a2bf3f2ea70b0532d97be19de3525a343b983e815ceb845968951ab47437781fb240ba401d7beabd3aa1
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cis\download\installs\xml_binaries\cis\cis_sb_1028.html
Filesize402B
MD5bb1b54488485c8fe327f50a965135177
SHA1ba4ea706c1a1c38e9cf07772de0ae18b5f5c78ff
SHA256fbd19cda945dbb992302e248420bb61f6c86547a85a01a8f6527f1c647065c63
SHA512a95f2c1a5c23b3d12ce8f4e13dcaf1fc9f97472b3ca9546235060fc3240270224f8ad6edf78b228c42ebfbe9cc79195e638bb876a18a79e86f6c4eb40f1bb66d
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cis\download\installs\xml_binaries\cis\cis_setup_x64.msi
Filesize474KB
MD5e56ae03bfdb17228b1108510137db849
SHA1f4a069caf01df76fbc0df5dd65c50d8bb0f16606
SHA25699edb243a4bbd5286e82a257340e59c8d53305fe566fd95401561d3fa3dfb4d9
SHA512ff99984848812cd3fd66d57a5284a12a2fa05bdff3e25f45f7d03fd0acc86a6019af7b09e1690570683299daf1c481120de46e4708f677d04d002b04a621104b
-
Filesize
891B
MD58de94911a17183a37dad85112e1a8b51
SHA1ac9bc89c248a557fc985bacc270040027976f2f4
SHA2569798fc6d02cb550b29b46b8c380c83eb6cfa8943930bac43e01d523581c8f646
SHA5123e88534157e95ebe2ff3b499adc524fbb88510357af6e971fde23463ee706b3cafe08f48b15cd563bea3937f19546b1402dd6b0d4226f2708055ce04a7e2df62
-
Filesize
748B
MD50a58f1da6063fc693912f34e343157de
SHA1a82f8626594b14c51f1331ddebf56dc6ae5a4092
SHA256bcd439be5efb0ff3dbd5bb067b1eb89f9e9987779723f074c750e2d81f3cd0fb
SHA5125a2bc78642dd084cadc1d78d56693e509e7ca33d02b3cdfdf7241c207bac0b782828ac37638bba9c96fe9179fabe3337249a070e66b437e0472b912164cbec01
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cis\download\installs\xml_binaries\geekbuddy\lps-gb-vt-x64.msi
Filesize576KB
MD53cfb44102893a4bed96fab7f672e5010
SHA195ec0105e10c011aa414187a0747413a1c8ae6b5
SHA256d3f6c7e98a9dd331cd6c0dc22f3b8d6327f1152e0ad9f7c9eb124bf2dc93f91f
SHA512cb6ba3c162ff90be3485367185be3b3a26abb1bea1fb04816db5271d87083b4e2ee1cebd3c08e67b993c023924d2087126e641bdd534ec8d0c0e1aa9c7937f1d
-
Filesize
2KB
MD581f0108da628f9c5928ed49ab7fde70b
SHA16975c88f4db809f0c08a1d4fd95d51f3cf4daba9
SHA25604f0116150d96e3a44d4b7d8cf437c7148c35c2f69729c7742b795b19566c457
SHA5121004caaf01ae66b9860a137648046aff2a5ad47c0ee5c792e5a6d9e3fc4698d216548b3e3ff37af6bb751f41eb1b70b2968c6411f33f7714214cc9a7424155a3
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cis\download\installs\xml_binaries\ise\ise_installer.exe
Filesize650KB
MD570e8c54893ddbeb3c7d76962862fcaff
SHA141eed7cea49a0eed110069008037d6015c0899f0
SHA256f3e0ecdef1f5a1fdd856d8408139baf1bd4a5f928dfca9c78d59d09f7d4061fc
SHA512e1654d6a82690b379ba2920c3268979cbfd41244e3f019258df6ac6c2d759630507754759058d7d23902ed564840ff11613698579c125cfa8d06ec460349aa7a
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cis\download\installs\xml_binaries\privdog\privdog_3098.html
Filesize6KB
MD5b3c803fb406a8e98f6415af7e02b1633
SHA18b9444d5c29cb5dc70cfc739138add302ca87d67
SHA25699ebaf55ca8e00f0dea0ec87999aba8b080dcf9da873eab8cfd48917ed07bbc4
SHA5127eca6215d4ef121847917f212ac69bf2450749f125346f7d7898f69cab36d1ed381b3e72f87db3770f4f5c2329f1cced3d9a2254eab664bd0d69d44efc7228b3
-
Filesize
1.4MB
MD5ba192bfef1d537568a47ae5e3ce9c187
SHA1aefccd4d2ac4861d7901d7eed7bdb25f9381b6eb
SHA2567f2320a7c66cf850ae3d4d6938070ddeb4832e1bd37e907bb4ae6acf594f12fb
SHA512006f1ffba89b8769b4903c2c8f8cfc259f5098dee6dab2b675fa643b208acbfabac6a7621a3a87eb5cd0c64b1ec23eba0e426f767afcf60e1c8d42961c4272d9
-
Filesize
1.1MB
MD5ac862fa0e70401c4da4ff18a4d8300f1
SHA158e294dae5500c2e530fcf56067fa583726ddc39
SHA25613fd6ae343372b6205f1c861018ea7e6172f0e5a89ef304e573c77cf757451a7
SHA512f0b253d92183d2d11322f57480dbd4faa8bd09417188da04b6bbcbc2ffd57aa715dc0d907493b6ab006af626959438db6e8f45057cd6f231570687915aab23b4
-
Filesize
1.4MB
MD50220c875c0becbcaf903e7e2895202bc
SHA173e7a9ee7d9586cd92ef957239af31d5bad6a0b5
SHA2565ddf2627ae22be9ff64e28ef87fae8e956aef8c5964e28b95c6d0e50aee100f8
SHA512ef0fe07fadfbabe5cbfb1bd631b0cba9786f28a43bae7bb976de7969927082225b77ad9c02309ba6a3e6bdc4c8491c62d14f8c6137424e95145bec08d36caa89
-
Filesize
1.6MB
MD5a731dc41b199fc82ba60aa0dbca4066f
SHA1023378c51e41e507f3d30595b6aa699652401e0d
SHA2563127b0a214c89fe14cc25cb7eba6e358bdc19d30bbf3d5201e8c070d0fc30910
SHA512f30b2e5ea094916c096de4b3b60dec2df035fb424f8a1139a6e7f9901f913e91553910515b32186505b95ee8e416b2cfffbb47bd4fe7e6e59e4b66f01800fc90
-
Filesize
5KB
MD5b80eda6258e28b537651f8e5ebd997ff
SHA1826741e138e8342f4bc3303838e347a44bb93546
SHA2566e960dfed451c2dfb99352d25d3df8dd46fe7d80c9af79805c0cfbd1a99a2709
SHA5129fce1cb5fe8b6a2bc4d13c1ca3ec31c926c6dd33717f145da6952ae33144eb11a6ee9e751e1d3e2d5d6ce7768e9f9602773a917d9f5f8473670e6d631b932b74
-
Filesize
131KB
MD5ce1f7f1ec218784c28fb288752e06cb6
SHA16379efd953b3e080d66fdcd3b85a9702c7b166b8
SHA256dccfc0f8e3af2bcb462da2d9273e024ac49cb71d348b9ac797827b24e7b143c6
SHA51282b72ebe4d35f22f7d9506e6c98d55a2728d41372244dd269aff6f2611ae2cc55c678d5852beff28328423d1754173bc032770ecccadc140cba546e44ce48146
-
Filesize
5.0MB
MD5f96e5446694c78b5cd1f92e68598daf2
SHA1e66ac7f9185e1cc8fc012ce71941814f33196d4f
SHA256ac07eb9e8acb9a846ed7e2237eb12fcfa3ef822e1fbb1194be7e1d1f489ef265
SHA512c12935ba64c33de7af5c343607dfd19f1e1a57ef543ae0ce681ef1cc8a51a2e7114d9ecc5f62ff16ad230abce92e97c9f712f496ed5d5d0965893847e1df464f
-
Filesize
33KB
MD51dca0baaec37e6e9619591cbb9fad205
SHA12707be01de2ba7ceb97e61f9f5cf25bfac17dfc5
SHA25612fc0283246e216b46fbb9875f5a104bc9f72cb67ae7a4064e4ccee6794533bc
SHA512e88c725766a39afc44086a8b07418ce39b44b40389eb283af3204c0efdbdaeff8da2d8289cc90cffc28ee893d76e17cc120d15a14bf7c9288ce9b46a7384aeff
-
Filesize
50KB
MD5826130ed15a9fd8b7ecb9db6b6077375
SHA174412f868b59ddfd67f2c692a9ebd19e6df7e882
SHA2560b2a94e4baa41542e7be95b0426161d6d4cb5dd230cef0a96862d946ef2337d4
SHA512b452afd9f7dece5fc5bfdedaedceba25d51ad616e28821ad9d623e6f267c12b8679d261e5b19ec4a846cbc34eb0b207cade1b3976187a2d6415f392134865e51
-
Filesize
61KB
MD50beb78ac69a1e8b77fe407cf5be9db1e
SHA1932eade3d7ee1b2bcc808b5456f7f82703fa023a
SHA256f755651b14b063cb26fd7f85562b7ed7799bd124a835cd9e6939ff8970fdb908
SHA5122b9c1cb72d3d94acfcd7020b62daa01ab2bd2093d2b423eb70712fc83e5d76363045188dec64554d73d51e73f602c564547e6860dfc2ea8ec259272ca676cbe4
-
Filesize
40KB
MD56a5846f3b65e3bfc1aab7aa5fee90b22
SHA100ac03cb89861ded93e81e9738403555782b2506
SHA256a6b9960d2e0a086e26e29848c6c484cfee03291830fa234d847a1ccf4840efb3
SHA512c94aa3a61b0a646450f468915aee7b62bea6410e08440f42d973eff8ac9865a21d1dcdb8fb131e9ea94c6c7271c3140450912bc5b481c2a1ef6c26b955f09373
-
Filesize
200KB
MD538d09762bb34b740f231eb8ef92a9c59
SHA113f4fc057a77ca9a39e15cd706dee793139c3f5a
SHA2565b85665cc8235f51e28ad01652a38a79825d4984508035fc7b783e62e47d66e9
SHA512d08503836bee3e9116b1e3d6f813b8eeb7e45b5f5b6d0a25f61524e3ed08569697e23d28d50b454f13649d2d32c904852cdc3eaca146001ee7fc8d518c4a4ac6
-
Filesize
248KB
MD5809642a2a3b54e3026aaba7a65bcea1e
SHA14a631c9316e89cda4ecedfc046d3d8d02ee0ce75
SHA256524581b6a48d8b40b13da7057623896dd8b4d099ab3553f395db4d91a3d282ae
SHA512bcaeb67260b44ef2d4fc04d43a8eefa2da5bf1868c54781da2221cddb2520afedde6b7695874ec0a2deb74b22ca441b79cdf8d933e7474327d35d5dea947d9db
-
Filesize
1019KB
MD540328f3c40b6b812589e38896a5e787c
SHA1a1b9c6d172b0357d60fb54e31333aafcd0036a74
SHA2562098cc55ba214e25c57760c206e60a0e19cf617c4a4f43668e3dcf9ead01ea23
SHA5123828dcecc47e101518608392a5ac26b40aa7880a6540f10587e9f36a933b44c9b66d7fc60a83a99fe6f9351d2eaace15fa4ef19a277a90752e99fa9cd7b66e6b
-
Filesize
2.3MB
MD5ae9a7049b38b22598e09b9b64b850d1a
SHA1049d9e0d1dc4c3223c2a2e7725d05aadc030ccf7
SHA25663bb102753c6208306d86e5f6eac009d0b9a60c9882b5265d0c7fd3b44614f0d
SHA51261a2d549cbd39d05d7d94b89c3d90054c3126fb91195921d0a87856faf121dfc46eb60f20510cf915bf58dc849c15837d3d4202f6df8ad75b0959188d0973a58
-
Filesize
17KB
MD5c66e82a065f08b1122945c5546dd7de5
SHA12f98c0dd5a00e48617693ac52904fbf005061a29
SHA2567056946efc8b06e608d211a592e9de303455d51a7b5f3daefef2f12eedf61a03
SHA51291178c655b35b6192289b1f998e845a006b3a65ff0111db226ba145415258cf99ad87e6a9909974ca412b6b9b0642df6e1b452a4493638e11fb20242290aab8b
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\bin\ise_installer\translations2\isestart.bulgarian.xml
Filesize20KB
MD5bb5c27f60e7cad11c261c2b9daf24bad
SHA1dcb3f51ec8b79bc348aa62d5555709e30f89bcb1
SHA2560cc3de2651c6df918b17c70652447fb9047cf86add2773a6a748d809d63ee143
SHA5126c6fb75c3339e45b88d8793ddbd2667a3a546bb0c93a3de8d11b0f2c9c09c7289d17295c36fbf960c2de5aa9930e8cc1a478a5437ab7e9a9c1d315452680790b
-
Filesize
13KB
MD529fba847ecd3deae2301d91387f8ec02
SHA11245f0a8f70fd21b46114cc33e126e520de001e4
SHA256b66b3ced2b8c33854ecb240998c4af2034bbf63da7411e88e4344181032c4666
SHA512eaed80616e36ceada19b1807fa64dc997675e8a3f7a0fe582697524f6649afb3b9614d7ca77a81dfa5f1d89f6a747976bd22deead7ce8b90c76b9da1d59f432a
-
Filesize
14KB
MD5c26f33790b6f16086348a781f346bfe9
SHA1a58c092b483905821b0272fd283c0074f133cb29
SHA256c70b9d0a88cdb7cedbf97b1efd00b33f1675f8c76661f20f5c0de79c5c607978
SHA5127181a16b60d9c45ef3cb9a72ed1ba5d9b56b3b98c48443f67fff884789177cdd4c1bbac8f05e1f1ba44e167cc5fca38d20b5a45e34672db869b2ebd80f1244e9
-
Filesize
14KB
MD50a59b4fc12bb1878b160759e3d3c6ac8
SHA18c6be79331faaeceb30200017cab4df0a16f01df
SHA256e207a348a5bf99a60efd46d4a4185c3b04ada732279b0990859d138c1108291b
SHA512d8b3491baffe342ffd3c8da7a39ea49ff30d3a465fc90041c8814b97aa1f44b7046c986ca91fd369164b6db5de052e0f48e05c30393e1e48926b49a62696a19d
-
Filesize
15KB
MD58b68540e82d174aaf5bd826fe8d0b173
SHA12da4383d66888872b066a8fb2ebdb09dd1322d1e
SHA2561d7ad12a24e4b0909ab3a02595a7995c883b97f3879c751506872a4736d60c16
SHA512e7fe3f5b2c54dc593332562366e515cdad318e6ccb8e95a7f99525065dd2df8b4c050de95d6e4eec02a414328acaf0f71c8219c6cf777c8246cedeabbc03fb89
-
Filesize
15KB
MD5f0de20af4870865fda4e91e47f0b0806
SHA1af94fa596c86ab80cf5614faeb159c6f147ef022
SHA2565e2bdeb6a27c61224ef942f448ad55a9fa0ebe664c70b24c397e9b9d86115d4e
SHA51237e40145f0de7ec6410fe13d95bc56eb75627522b3bad9a4ad6fa2a33b76cd5f241419d8add68f07641c36f1e216afd6aa56536d48db3d6feb8f7c42afcf62f8
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\bin\ise_installer\translations2\isestart.hungarian.xml
Filesize15KB
MD5d81e6ca0bcb49a920af6124095e0b331
SHA12e36b2a371c6bfd3fcbd4da649b79984cdfbd0bf
SHA256b30b351b164b08289670e6f91db31932b87465931d0953a89cdf1834e5f412db
SHA51237e5846439e3bd28075f16e8ad96815a2073839ad3be47e6b919142edb8c9f88c64688b62fb52bd4160c9fc5b10438c9fd1b352e8cd68351eb3134a65090d576
-
Filesize
18KB
MD559df44e6d5b365ed1be7d9bdf3f3db97
SHA1ce0698d99f001a830660b98f37796ce64cf97c01
SHA256d7d7fd32ae5e2975329e9c2465e26e1381d6b2cba9d718a923d1695e751902e8
SHA5128634ac43c19c70c59a028d673f85a3c54c259f0500b6afde343925008ee111d3abe8d08b79ad8310d7078794528d910973d57a749f806c1119299d1069e79b19
-
Filesize
15KB
MD521f5b45f4ce00475c14ca71742b401d7
SHA1175ae3d0d7d87ad00e3a775418bed34a3c2b56ee
SHA256d733d51447da0a9e26b731b4594778270302c2d5b8929e2f985491ecf3e89e1e
SHA512640bf3edd7aa3215582e750cbedb8acbdb13aedecee41493bff8f271a4aa3ebd79ec15d5065ce3df06867bbdf2c70b8d070d5fbd342d1d2f5442f79c76b6c9ba
-
Filesize
20KB
MD5a311f7c539bfa7513d502861036268e5
SHA19cf9e9381ec8282490dcd40e934e3d0beae68b17
SHA256821fbf65e0ef3dcfb1905f16ad5e5356a58c7deeb7c6b2b02b33a50390b3a078
SHA5127b1e7d91e38be6bc8ddfacbcd6a8026972bc10d3418f6dfd82bfe14eb8c469705706a096b6ad48996e2d9aa96b080a59f06f2a0497347c7032c69274c4424bcd
-
Filesize
14KB
MD5f93e9b447984fb1e7647d03f788e1ad3
SHA1471c7a2ad36f19cf0b590e5bafd6151bdefae962
SHA256b4ecd6b211dfa2c76dec0b2f5a9c59fe84f320a5f7c3e8977bee8bb97dcb3ac5
SHA512e0fe42ee5a3d585f172bff5b89632b649fa8bb8699e5a0e28c6787696dd705714154a327b7b04189350e8a3c06df599fcc94e14776aee9a29075f99282cfddce
-
Filesize
15KB
MD5c155f5ff29b0918c8cc1bc2dd99b4e59
SHA187631b3d1b7ca591efb927c249c6ab4b336754e7
SHA2563206ba4b3e268ff402cbba0c2d60608a72be67fd7319de6984b7e55e34d933a9
SHA512f9be8e8fac7fca54c3be4fde9c8f40f12e75d25b3823c6a25d53abcead32e462483cbe99e0769dd024bd3b65e41098cfac7d329eac65edb02b0299bbbdff9da8
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\bin\ise_installer\translations2\isestart.ukrainian.xml
Filesize19KB
MD52698e2336465fc98b796e49c31ffa1b4
SHA1320306b112917ad0729e71510e2d88ecea201739
SHA2564494ae2b40b3d233dd52bb7184dff779fb63f11d2196d8e05d27d94f023d0153
SHA512ab57191fa73b7d66357fda342777ad1f9684d2e452ea4f73eb84eb34f050b1a627f88f7dacf1d8dd881fa5bd90421891d39b5f51d3cf1695c4f93e7b176f86b0
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\bin\ise_installer\translations2\isestart.vietnamese.xml
Filesize16KB
MD53cfbf3520348ccae0035ef44e9a7e704
SHA14b6eaceea2206804bee612603abcd51f6e3d0dff
SHA2565c402e7d4d6d96dddb98e9c0a68440829828bb17fc134b9375b1d8acfec0025f
SHA512eb8b31bf4f71b966f4c72f5ef1bc459082afb1aa02a2992c12d451969571331eb983d2ce9c7a8098df0521de3e2d39bd9c2fa203fe9d2b688db56aa3c9f066d8
-
Filesize
13KB
MD5facd46953c26cd626fa3f6cb29d60742
SHA1a3672c62e1135d32315d35f5590802ee9258fe64
SHA25641f937e4ebbe896af36bef092ae4ca73ef00ea11000aeff7929ce97124bbc315
SHA512dde68640cd8623aaed04f4b62219f350dea271cf09bf3ebfa7ad10531a05fd2a9d0f14a3a4766916456f9db50c5c8e72ae42093bbff4c5f3683278a3624724f8
-
Filesize
16KB
MD50894672edc430d9d8834bcd33c5ab8e7
SHA16e6b93db3d2f7cd248dcb9ca27b19b762339de02
SHA2567d9fd95b3fda7a9b69becb293426568df783e2fc6ac8b8d84467980b11ac4763
SHA512c8211c18ae431c61e49ab8621175eab75270ed0c8af9cbcbd611ab8c89363bc8cded0ee07744f921b5deb661593c0b42e77379b7d0caf7f75a7dd54c76473fb2
-
Filesize
9KB
MD50e4c8c2570a02b28dd75298c02d3c580
SHA192f340d353318f3723ff3cdeff6821e3b9464fea
SHA25644bee669b086b0c933584c0b09f849e9250fd819bb5d63f467962fda37bfd65b
SHA5127684166ea42a63798b3f8e24a1a14a9c0364c60e49a004991b95963da38cb0032ea73473be22ff98c8f4410bf5523a455dca022b443a54274c4b48a90fbb7487
-
Filesize
11KB
MD50ead33065c4f043ef3d1d37823ab8838
SHA10d937760c7662543a3a80f9f6f9d293845fc7ff9
SHA256109345931feff40c783e54e5d59c3615274e42c6b3cadfa0197bfae3ea3471bf
SHA512d07af8b3c2e848a5c83c14553185aff224fc4bbe3155afa0db2e143be770a9d04282eb31ca7a8a5f91929edee518db4f26aaf763ba8b1cbb0c39f031b448a6aa
-
Filesize
10KB
MD5b1cac70cb032f9a02e1c67ee071c2661
SHA149ca56ae953e12854a8d06a3020fca3c6bec2abf
SHA2560e37da1951fdf219548bc23db3b7e6b4df5c032b062084e3245df90a261aea73
SHA512756dabf14719cb3b385bafd4a65f29122c51415542e72ead072e342190cefe0c8a6a4f0a86ab8e81263ddd78ae1962502cd4c05e3c06befdf11c83194a20e560
-
Filesize
4.0MB
MD52b2aa2108b38e9a552cb245bf6b11176
SHA1c9a92fe113574897c70f0b30ab95eb9e1490cf25
SHA256825a7a2c795bee0da941244ad1beecc5b2dc7a01dc787d36d8e39738e74cde29
SHA5126be781a45015f6babf00774637741e044f2bd8f5eeec5f50cce69047d009ac0960bd42f594ffd075bf9a7a773f7d7ab8ac49cb3ef3f1875bae3492d6f0151835
-
Filesize
12KB
MD5a2c74563ff6181a6c1092ee2f2fe1d21
SHA136935fefdf6a2c6c991890ee5be3b7f680b5a393
SHA25684171087e7055e3f1a801a6a81cc6e7671e13522a6f9d7d6463251081ce0fdd2
SHA512b1f89f2bb15f71b10992895168e059c2d8c4ba48903ff081d06e2490a8ac98a13d82c4b921f2b39d56b10cb640887df3f089f16ad1fa0a775e4956a221fa7758
-
Filesize
12KB
MD5e22f930a1fd304fd51bf9b6713bfd76c
SHA104424433fd046e3594aee159ee4d777c4de3ed06
SHA2565b125c0f1c6e1980e6befb5713f337715b72ccecf366edf6e9b7ba0d10b9b04f
SHA512b2fbda95c542de99dde2f9d03fe793ecf677ab76fd13ff9677cbb509c6086c817c05d5465069f24279ef8dd74ecdd2f439b6b2dde766b609b61f3cff316c192b
-
Filesize
11KB
MD5791994c34e987f6ed90de9233b899d19
SHA1aeb724f10ec1d157317512db5e05e23d8be63950
SHA256a93fe19d0fa9931efec4716c56be6d0958fdb5593c0fab7a4aba59ba0e01ab7d
SHA5125f2397dc62bd1550e76af8f8bf451036f0f337525b0926b5eb0fcd3f1fa3f9ca660daac556223d1655fdcb7a053a1b2b3840ab872b152c74b48bc820b37c9885
-
Filesize
13KB
MD5398911eee0c4e38497fcd62a582ec392
SHA15c89bcb4cdca6e169c07a78c3407a4c5f99d8721
SHA2564e25fb1f9e854eea3e0b4924eb9fb7b211f1ed0f99abfb73dc1147370a70904e
SHA512d0eec39769f95a4478e584234d7718041c3b74be79f8cdd1c0e74dad6e933e975986c35e4467b1e06359c2ccb761af23b4982363a65f82e9acff75a58c0d46d3
-
Filesize
11KB
MD5e55e481ea2bd5e34fcee496aa45ee004
SHA18a0dbadb2bd032cd4ba322e85ca7dae45ed86973
SHA2569cb79a35e93453fb8aa852def622ad132873705a0e52b5d9347e5e6ac6edb26a
SHA512d7e89295214b4368423ec1fab23528122b27f1a6cb31298464eeb934cfbbcf64bcf1d9abceaa05378c335065326e694c532b586070ead8af43a4d5cdebbe191d
-
Filesize
16KB
MD50a057a5ab279eab124c060aac78cae28
SHA18a691c058c097a0f507be8148b3364f941bdad91
SHA25665ef2010d9a453b2a698d52bb7d078ae3ddb469d5006d3199f23b75f2b5e8a7b
SHA5127157a2c10462b272336bad8ecf23770e04beffebe7842e105050c59771f13232c7a26d4ad879fbfa0a68fd1ccf0f2167ca0c786e8d9eefe4133119f951bae262
-
Filesize
11KB
MD5addf389664acba7b252dde919e3da80b
SHA15d5ae70a083df903f5daf19bf6d384553a9b58b7
SHA256010d0dc67d53002477b53597a2bd03ee136d1f41bd5b1fd84b78f0388f195c63
SHA5128f49c50fe3e42550b7960ab315a5abf760ccb7115fa4836ee88b389da80da2186c53272ea1e9f1a7e5a51b73527ddf83f35d0ada9e7754852c7175025dd8c981
-
Filesize
11KB
MD50324e960a6433ef5fca1e6326a5d1cc2
SHA121dc7b7bc2f7396ae613ae6cb2676ad8c7c4a3d1
SHA2566f9e9523a414425c39f0d4b87c632803e6feb7f0e6b3784fba0c8a5823bf8b7f
SHA512bfa224c194bc320aade189e1594449dddaab8f2477271b758f6d3cf6a8eb28c85fa463ee7ff98a08edc1606f224782237363ba74ee91ecdc92fc6631b92395f9
-
Filesize
15KB
MD58e6b03ec680ae4ae559b5dac0003d694
SHA1db4195a601cac1ad09ab82ae84e3023bbf5b2fce
SHA256d5e0962626bbaaef67b1349476e5a4575d71a61aad3c687eb8b7b1dcaa453cbd
SHA512c4775a09c5680d18821819d471404daa0f0df1093b1ad26d6652e882f762695fbbedb26526828364256283fb46ce2b8a8d48f2416c6dc248b04ed3e4ee604e59
-
Filesize
12KB
MD56170ce0de810d31d22546bca729681cf
SHA1eec4c4224ff5965f09858beefc5b3994ed2b8310
SHA25659892e59d6fdf97b01ce7c67c5071754c495af822005b5cb6c2256434c558d3f
SHA512f069a0ca94a4aec4bb8edaf2e12e3523130afc240eb3db67b29cce1285a4673d8c727dd30f52f3cef135d17df66f50d7ceedc209e1867c9261beb7779b59715a
-
Filesize
7KB
MD5899ac334bad6ab4562511d355648c7e6
SHA1c83ba90ba6ca9bb165078d34de2e8aeb54470106
SHA256d3bd1971acbf7f8f63e70a67cd406fb941f9a68496f92132c9dc047b4683109e
SHA5120219480bd3ac757e6c8d729b560de65079bf9178c4f8620d4728b229d4ddace744d497f6e7c1fa5403f16c7b65df0c9c2f8d3395a656399fa3a702a70116eab5
-
Filesize
1KB
MD51f158a8e9f47be1c8d2c1fe39e9c79ac
SHA1bdcbe1844cdd5bfd5ade30afd15f0286b8da2c7a
SHA256534e8aa2a0b7a41ea6a566e970eadf852c9b902955ac5060035f0a97c86bf416
SHA512a8cdbe52345c2773e5c164f3b3aab35fcac69ddc4fe79108e6511e08a6219bf2a6dd2b577de10d28c9198342528c792e4cedb86234aec1b8a6e1cb1f5a7258a3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
2KB
MD5df44c02cbfa857c9bf77a35594391d04
SHA1e018b8c2b3213d4e7ac05d90d0b958e88a8e5953
SHA2565357482e9f2f5dad518e4fc80b2a36c2de2e356cf3bed5ea453afa5a0e748da7
SHA512486a33465bedfd84d66c91ef2fa86810aeaba9e592b6cd759c28a0365d92ca2194494d198f954487744073bb069f03bf9bffbf31ad4c0f1dbded87070859f440
-
Filesize
118KB
MD588bb74b8950104126f6ad5a117393fae
SHA128acd00d46cdbe9ca8f864e61d4c358785ce26f4
SHA2563c2e668a95d426d8efedc0aa0ebe98feb4807fade2086980b6b12886eea88b5c
SHA51248ef75e702f1216fe3b17d1235041ec4d9c244a286c3175aee863799aef2f02d06d2465035c2b352c5f9cc9230902704106cddb9630542d808bd6b3873f85140
-
Filesize
1.6MB
MD51fc9d970f49eac6620265011ff82ee12
SHA169a986c594954723fff43efe4769c4acc883d05f
SHA2565e3554a0264bb3a29c566f6eec571951b2d7aaf1fa64a96faf7074dde4ae06e9
SHA512a7027431efcdf86db97d7c3486baac7105b0f8a9bfc790ec459b19c28746854521040ac9727aa5e8bb7369243b969d882225f1dc0c3a8fa58b6f483b28e619df
-
Filesize
163KB
MD5ba5a854393cc05e092a6462607c7c87d
SHA120a21dcf20e70d4f241412fecdaa9a6bbff44943
SHA256b5ee70abd29d341785292cf2fe9dcdc4d529a12a79a9e8fdb73fc8e2750b4616
SHA512d44f41f54fe8b7e6d3ba4fba1b0559459661d0972d3b02c6368e41e3b6dde32ef8670363a0037ea95e17b38fa211b1abf98f450c665c2e021a4b416d98597dff
-
Filesize
12KB
MD551d1ef171b0e1c3f877761b18365bfa9
SHA1ff088f10b040135e995baa147bd884f2a3a24c83
SHA2565ad19699f59804ce953efffcce490815d0d1d23fff0e7d79f314e3d083484007
SHA512947c5f2a5528e421066475c34a40e5fdc670424fd825d4dc3320ee29af20e593174c0b4e6fa73aa01a673ad075063bb6f4bd0c124f15dd250db82e2831db1e2d
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD52f463c9f1d958f953c7cc10601f852fa
SHA198429412990331d92159619d5e3804a54dab8eac
SHA256983013249ac6b2b39934314f2f35118bce0b86956b8283cd1ebe310a0b9d8b85
SHA51281126700fcdbc47e0bb17f95fd25be1bd3cc95dc848b2e4293b59d5f307214c561861a4fa74aa1a4b511a652ceb2ae2d3084a99502a6d606e2cba606740c18b1
-
Filesize
28KB
MD5bd355711c7c960c0bd1ac44e1f7052a6
SHA10f42054de62da794526fefb08d4bf73e12016681
SHA25600ed372159987455a77418ed8c315c42d523f850423587aefc666af79a53f2ae
SHA512165c1344b84bac56f4aa11b298134741ca78c90f71163a718880870cde98e06210f2a7b4e35ac0db9be006b89715536ad54167580292bbf36b68491a837881dc
-
Filesize
841KB
MD5235a8a617a3e4aaa121debeb2883d47e
SHA1998b02236a6a13a14f09b32a2e8387f0a6488d35
SHA2563f4f034d8dcad822ed462f1363f1a52c958fc3870cc15f506d2842d7f990960f
SHA512c87fe51403dccf47e3b6d00f823f8493aec321defef6ddd731f4d607dbc45e6249b44abf15785913be7d55a74f90b833157a7e4202fa62d4c7e06be76c6ceaea
-
Filesize
29KB
MD5d59a6b36c5a94916241a3ead50222b6f
SHA1e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA256a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
SHA51217012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489
-
Filesize
81KB
MD5b13f51572f55a2d31ed9f266d581e9ea
SHA17eef3111b878e159e520f34410ad87adecf0ca92
SHA256725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
SHA512f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c
-
Filesize
4.1MB
MD5cb878e6a6dbb534e6a941e558bca0ec8
SHA1eda8946e5d7e7f9545551df2d35a303c13b88bc5
SHA2564d2206f89f3f32f5de0771dfafde7ec4025543a3b216fc358cebe5482328b240
SHA51208592f2d922e2656c6f65dadfbaa81d328b8f5b9fcbb6b99d1fcd2c39be9ce8c3b244e7d5653c648988ad96e8e58435957c39b9c04d8247e9ac888e264805661
-
Filesize
276KB
MD5a41c803a25544c6caa57d878d76c4b3d
SHA155f90b038689cf66f1ad41f1bd5b628ec8748ffa
SHA256d3202e24272d2a2b6b37f55b3f4ac68d7bf9eb829d4a5d9955d5416cd831e402
SHA512d25ed1dddb5741fc95c40160c893b4f92b6ed55702318f9193f6d6a9b608a26803bac9816d7b6513b086e6006a48e858712a2f95baede186be75ce173dacf35c
-
Filesize
1.8MB
MD56b609b1f577f2040afecaaa65963153f
SHA175d58c5975f8fc59f73ff37304e440fb35607745
SHA25615c7d3b94761b18dcbd2367437bd428c1a6a6cac75c8fbc55681987f7c56513f
SHA5124eb364745ac9df54af0a622195a35b759fa5998afba92fba8bc35b77924a0823a6687aaf1c068c32ee57d8ad15bd43f8cb63484d12b684efd4d7832371dbdec5
-
Filesize
1.5MB
MD5d3cb9486e1826fdc7b00c1d7a533baa3
SHA1768df2fbeaaf11eeaf91d6e3132d10bd5a407cb0
SHA256796ae3ceb9f1db16c214fa01ae54c075e8f0dd5c0354753f396154a63ee1e3bb
SHA512c6bd22c6cf96dfbd798e1d492307da9212bdafbafc03f9c140a06531cb207e5f5f40b619ad87753ebc3c42a3f7a80bfc93b29b693e91f36af7481cd22b81d9d2