Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
22-02-2024 23:01
Static task
static1
Behavioral task
behavioral1
Sample
cmd_fw_installer_138430009_eb.exe
Resource
win7-20240221-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
cmd_fw_installer_138430009_eb.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
28 signatures
150 seconds
General
-
Target
cmd_fw_installer_138430009_eb.exe
-
Size
5.4MB
-
MD5
b48216dca6f745a40645248384659fdd
-
SHA1
3bc265e7282bfb5c63be6cc73a2b7aad9a060904
-
SHA256
9b6394b0d1da147c5c718ebf3aba211ce2d4aefc63eb0dc80ed5cfc0db269bcd
-
SHA512
488fbd2b606c4f829b0ec05217b7d9be687cb885b988bc7cdcf7e1d61da2ef06fc422646696e24c2a1c1a63d793bda2293204037bd5a0178a673c00e91b226ec
-
SSDEEP
98304:n3oeoi7dSeyJ6A89FbeCD25kvriejkx9sZjMK6vx6IF/M8aWzBWcPNkNzt9e:n3oeoYSeyJ6vnKCD25kvmeh6vFF//aFU
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 7 IoCs
description ioc Process File created C:\Windows\system32\Drivers\cmdGuard.sys msiexec.exe File created C:\Windows\system32\Drivers\cmdhlp.sys msiexec.exe File created C:\Windows\system32\Drivers\inspect.sys msiexec.exe File created C:\Windows\system32\drivers\cmdboot.sys MsiExec.exe File opened for modification C:\Windows\system32\drivers\cmdboot.sys MsiExec.exe File created C:\Windows\system32\drivers\isedrv.sys isestart.exe File created C:\Windows\system32\Drivers\cmderd.sys msiexec.exe -
Manipulates Digital Signatures 1 TTPs 4 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\6CD253D636A7B4D0E0981431BC064061A9853ED9\Blob = 0300000001000000140000006cd253d636a7b4d0e0981431bc064061a9853ed920000000010000001b06000030820617308204ffa003020102021032327facb1bd6f1fa93473ccc515fd82300d06092a864886f70d01010b0500308191310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564313730350603550403132e434f4d4f444f2052534120457874656e6465642056616c69646174696f6e20436f6465205369676e696e67204341301e170d3138303132343030303030305a170d3231303132333233353935395a308201153110300e060355040513073339313038303531133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e311a301806035504090c11313235352042726f61642053747265657431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100b7713778a66667b8cd67f828f378f80a5507c4e8aa143cfd5b9b953ab16d04a965dcd386a35efe8378c1e0e5ceaf124f188102958962014e493cd80f11fc2ba339953a8bb71a9f030ebbe8742b4252ab465a2d41a829508a9eef5d34d171fcf0b5be026fe15e1a70288b2ecd4af1332924d53c0eefe5c7033482769cae8b5c5e8d59033fac40e94d714c5cd05e8db6f0edb71bb26565d52a025f35323203e9a7846d00a235f973d1e43f29a81dcd1bfef625d373f94a51cc8d2be8ee69702a73a694da69d9b0fbae7d1dee353683a2037a2019b9260a1b53f6c89d945b384c275670bdfac333301504af00749373356a1e7a422eb9363bdab713f9ad6b5bb1970203010001a38201e2308201de301f0603551d23041830168014df8ff3200ce9caa604d85b58372a3dab46dc8349301d0603551d0e04160414e18081b3e9396b7109e8b2add6c3d20ebf4b4814300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010601302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f43505330550603551d1f044e304c304aa048a0468644687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e63726c30818606082b06010505070101047a3078305006082b060105050730028644687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33393130383035300d06092a864886f70d01010b050003820101004bc17929ea82f3c4787f7b29b69edb09e169797a9f4cd233f035412d2b9c586e352d2c0d1cd530a946a91ccd8858453573f0b45a0cdc743d662af4761420489adadbd9a84915b697f96ed1e49786c53000eb12555d3b2957eec18279326020737e2e3e4d621856026169ad6f6cf18ee7b59d5b6a7e6d8c252fa1a15363ec89a6efe5efdf4b260ad35c6a0e1db0250d1eb66ea7b91f15e0f57ecc0541e1ad74a2069f717dec0b1f03101b6812c13f64264f8c40a3614ffb8ccabedb974cda14eb50c061d5cd23dc7735cd0bcfdcef3fd178c1f95594a591031d05c8554cb5fe6fd23cb95931bf847f5b525a269aeac0336313e8f6e81ccb1692d86993724f709e cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\D70D7D00CA12E1B3E20F3BF7534DEB2C2E7C2404\Blob = 030000000100000014000000d70d7d00ca12e1b3e20f3bf7534deb2c2e7c24042000000001000000530500003082054f30820437a00302010202102f9f0a1d6764b5a6378747247087ba73300d06092a864886f70d01010b0500307d310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312330210603550403131a434f4d4f444f2052534120436f6465205369676e696e67204341301e170d3138313231313030303030305a170d3139313231313233353935395a3081b8310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303116301406035504090c0d313235352042726f616420537431223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100c1b2eafc6255d7a7780082967ba911a65b8160e697a9c81ae0816002356644b714895808a67b22551d87b879e80d0c1bff7bd847e1486bad3c3caa8c6f3258a7311f8b03c68c9ec5947950e57a1f99f4b47b8faaf46e282f68155ae6e8f13c9c125b5eb83ae4e63ee6081d0e8aae4f090175a538422b38e0600bd94b21b313567934ee959ddd6ab7ef62bce25dada05d7de6a75cefeffdcba6a1fc8e1ef7aa6d3e5ab328732c3d31759a20d7e69cef60ac9d152041dbd85167a78329f3a80fee19ea9edb102448aa9f5774794ecb560de2faa348f278b846a2a5d8238d5e4e4cd2a82f0e37415af2dc63f34f3e179aa1cae7290b411aaf5aa6acf5404ebe98130203010001a382018d30820189301f0603551d23041830168014299160ff8a4dfaebf9a66ab8cff9e64bbd49ce12301d0603551d0e041604146c5f99825f4ba8d4c19bae5169bab32fae7816ca300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e63726c307406082b0601050507010104683066303e06082b060105050730028632687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010b050003820101000f718c2aa40e9c44a95e1eca3844097ddb7fba896b5f5c73a6b9aede1d29f0e432f41c8a45ce38b1f52df73f45e67907a03ac58d407b3077b1cae246a54544ee365bcee4bf0f4cecc47b01e98d0478d8f4c93e2c582aa472577de9c67a0a8c2e37635e626258675e0e6669babee331594abed516679e8f1b14d7a65dc1b76ab33412689b135cf855335748e2d1998759e5b95f68d418d5486d385d0db7a8fa30e58e84f57bb7ec3f45efa549fab71775c822ec846545b6fc0ef1d3c2dad34940657088fc5f773a1cbe24f9228f9dd7e9611d5d682998c6041ba580a789f5571da01d6723784bbcec4fded61d0ba31e37fbc10c3dfe06169df4670c8d454019f7 cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\31D019FC7AB697D57D9C4AFB340ED7C4D10400DF\Blob = 03000000010000001400000031d019fc7ab697d57d9c4afb340ed7c4d10400df2000000001000000250600003082062130820509a00302010202101b427b060e2866bfb586cc267e1c3eaa300d06092a864886f70d01010b0500308191310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564313730350603550403132e434f4d4f444f2052534120457874656e6465642056616c69646174696f6e20436f6465205369676e696e67204341301e170d3138313230343030303030305a170d3231313230333233353935395a308201093110300e060355040513073339313038303531133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b3009060355040613025553310e300c06035504110c053037303133310b300906035504080c024e4a3110300e06035504070c07436c6966746f6e3116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100ad390c8bc919005d5894a91a9585ef887fbd7c2341ff5ebb3efc6f645a66c55e6da11febce740e53ed9416284dfc7d142e4dc21f99753b5f60ae9aadc764b59efd9ffd33b20ae1c54eba629408a1b095a59cf4af0ad9db9bc494250154dcd0edefcec62e4b248d9a793b703aa15255baf3553fa59d4dc558ba4303af630bb626cd6627e0c4a45764ec3b286c38ab2499f9dc13eefdffa7841297ff533b47061b9aa3ff09ee3f04a7b10ba70894e53f3352b1f60eddfc021a66546e3392795bb6ae49a92f189ec2a7cdd9a935fab33a5ce7fc16c4b7e8ca13b4551d38a6a7c0658298a5adf5f6796675f58e1bb4ce410ff704bc5e845bc1ef83c18a0d50e137370203010001a38201f8308201f4301f0603551d23041830168014df8ff3200ce9caa604d85b58372a3dab46dc8349301d0603551d0e041604142d99b81962209042dc650eb36ec07ad996e48c4d300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010601302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f43505330550603551d1f044e304c304aa048a0468644687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e63726c30818606082b06010505070101047a3078305006082b060105050730028644687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30440603551d11043d303ba02306082b06010505070803a01730150c1355532d44454c41574152452d33393130383035811473636f742e7765697240636f6d6f646f2e636f6d300d06092a864886f70d01010b050003820101007f4d3e6594a3e380fac36b00e97ccacce4786be2ecc13cf37e737aaca0328bb8bfdcd513daff94aba1c7ee00cc8a3bd073157a812f6e31f772781d0bb922a8b86932b296c2312cdf3b239c42bb443b4b1b89b36de34a7fae65ac63eb6ead8812f8d373fa6f1a4e8d9e62eb004caae3639e41e08ed48d640b04725b09b4411dc083587e7fe24b33d90677677960efa6299cc85c4b2bfae4cdfe36581d25e029f6af1a7e77f502882d87597f3cc5bb450a71f9fd57f43b321baa4cbe5213a48a2c5b785a9de4103d5029e4db79403e98784e51379d45a86996b183469e98470731d1a603eaa443a05527aca62f51631722dc0dfe5d74c8298d2aed885d34c9be61 cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E35E6F46A1A9A4D18A4DAA298BDA4D1E8879236E\Blob = 030000000100000014000000e35e6f46a1a9a4d18a4daa298bda4d1e8879236e20000000010000005f0500003082055b30820443a003020102021100d9218e2757ec45d84ec08b3e6700c85e300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3138313231313030303030305a170d3139303730373233353935395a3081a8310b3009060355040613025553310e300c06035504110c053037303133310b300906035504080c024e4a3110300e06035504070c07436c6966746f6e3116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100b73a668ff7984c8d990d7c6e51df5176c7842cc1bf351c27286c6139f4831fc718a35b0fa9145f0887de8bce335e8e3e12fce763cab5deeae08e0bf325cd79a4fbb328d7c7f7d53de51bd3c05c5966b634a9b1fc4362afd0267f927dd90a52b6a5f5f0e29c8e94dfe4199b2cf31142bb480e95ecb92b6ca20ecd71ff210df9655e9e9ac856ad7aab929b843052d4a21c27ea4054a9f4e8c4cd88943b1a4d3a58b3e06eb654c6c09cef472d6fb0d05a841ce229b53a5d36bd08cbfdc552f7c758efaa7824c1d27e30a83d7a9cecaab4bd91b2cbd60d1335fc4ac0f0294dd2eeb3f65139467761f091840246ff644edbfacb9ffd7ef2823fd9eea312dd299a39af0203010001a38201aa308201a6301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604147c4f2b645af103043ca7675e8c129c16dee7164c300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d301f0603551d1104183016811473636f742e7765697240636f6d6f646f2e636f6d300d06092a864886f70d01010505000382010100b33c0fee4668b9e86cd777fa94eb47dcaee7fb5b9b897b9458b12e511a194b6ad495ea4b6b820d1c7cd26badf92cfc13aaa9e66157a55545c7ea71460a4fa4e30e46b9ac16a36e94a1fcbc62b2abe402d2a58773344c4b23a0d907a9760029595421e478da67167f80876012443cd22573dc3806cdedbc6c8c4ed255bd926cecc7796ec36fb225d084f31afb5e5a2e86d26149212dda8aed2058ef0d7e7e677b463a7722431a0b5c0b9dc385b7d2e73bd781ee111c8f7e36d76e1db1f6ac98784227ed97cde3762d079741984d146a8ff96e411c1b1e4e711cd00a6150532ffaa13702a81f4514eae48ca0b98d8642a6cfe7711dc67d1b857bfecb4e863bc1f9 cfpconfg.exe -
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0006000000023250-2642.dat acprotect behavioral2/files/0x0006000000023251-2648.dat acprotect -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x0006000000023250-2642.dat upx behavioral2/files/0x0006000000023251-2648.dat upx behavioral2/memory/4088-2660-0x00000000708E0000-0x00000000708EA000-memory.dmp upx -
Checks for any installed AV software in registry 1 TTPs 64 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer cmdinstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\InstallerName = "cfwinstallerx64" cmdinstall_138430009_eb.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UpdateURL msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UsageStatHost = "cmc.comodo.com" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\Desktop icon visibility = "1" msiexec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CmdAgent MsiExec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CfpConfg\_Trace_Enabled_To_File cfpconfg.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data cfpconfg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{B4865C2A-9D0E-423B-8DA7-087F623C4B4F} = "1708643083" cfpconfg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer\Instance\{48222F79-874D-414E-9563-03C664764923} = "4444" cmdinstall.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data cmdinstall_138430009_eb.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CfpConfg\_Trace_Category_Override cfpconfg.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer cmdinstall_138430009_eb.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS\Options cmdinstall_138430009_eb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam\ProductID = "cis.fw.free" cmdinstall_138430009_eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CmdAgent\_Trace_Level = "2" MsiExec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\VolatileData cmdinstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS\Data\CmcWindowsVersion = "{\"release_id\":2004,\"build\":19041,\"ubr\":1288,\"major\":0}" cmdinstall_138430009_eb.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer\MsiProductCode msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CIS MsiExec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CfpConfg\_Trace_Category_Include cfpconfg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{0D85521A-A20D-44D9-8380-EFB7C9BE423B} = "1708643083" cfpconfg.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS\Data cmdinstall_138430009_eb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\ThemeName = "lycia.set" msiexec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CfpConfg\_Trace_Enabled cfpconfg.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam cfpconfg.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\VolatileData msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CfpConfg\_Trace_Enabled = "1" MsiExec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CfpConfg\_Trace_Level cfpconfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\LanguageName = "English (United States)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UserEmail msiexec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer MsiExec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer\Proxy MsiExec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\Langs.cmdres cfpconfg.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options cmdinstall_138430009_eb.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer MsiExec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\LanguageName msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\AllowedDowngrade = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS MsiExec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS\Data cmdinstall_138430009_eb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UsageStatHost = "cmc.comodo.com" cmdinstall_138430009_eb.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\MsiExec MsiExec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer\Proxy MsiExec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer msiexec.exe Key queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace MsiExec.exe Key queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options cmdinstall_138430009_eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\Tray icon visibility = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\Silent diag support = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CavWp MsiExec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options cfpconfg.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Testing purposes cmdinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS cmdinstall.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS\Cam\ModeEx = "0" cmdinstall_138430009_eb.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UrlsUpdateHost msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data msiexec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\cfpconfg cfpconfg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CfpConfg\_Trace_Enabled_To_WinLog = "1" MsiExec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data cmdinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer\Instance cmdinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS cmdinstall_138430009_eb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS\Cam cmdinstall_138430009_eb.exe Key security queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CIS\_Trace_Enabled = "1" MsiExec.exe -
Downloads MZ/PE file
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: cfpconfg.exe File opened (read-only) \??\G: cmdinstall_138430009_eb.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: MsiExec.exe File opened (read-only) \??\B: MsiExec.exe File opened (read-only) \??\W: cfpconfg.exe File opened (read-only) \??\V: cfpconfg.exe File opened (read-only) \??\S: cmdinstall.exe File opened (read-only) \??\X: cmdinstall.exe File opened (read-only) \??\Q: cmdinstall_138430009_eb.exe File opened (read-only) \??\E: cfpconfg.exe File opened (read-only) \??\O: cfpconfg.exe File opened (read-only) \??\V: MsiExec.exe File opened (read-only) \??\L: cfpconfg.exe File opened (read-only) \??\M: cmdinstall.exe File opened (read-only) \??\P: cmdinstall_138430009_eb.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: MsiExec.exe File opened (read-only) \??\E: cmdinstall.exe File opened (read-only) \??\I: cmdinstall.exe File opened (read-only) \??\M: cfpconfg.exe File opened (read-only) \??\H: cfpconfg.exe File opened (read-only) \??\L: cfpconfg.exe File opened (read-only) \??\Y: cmdinstall_138430009_eb.exe File opened (read-only) \??\K: MsiExec.exe File opened (read-only) \??\B: cfpconfg.exe File opened (read-only) \??\Q: cfpconfg.exe File opened (read-only) \??\L: cfpconfg.exe File opened (read-only) \??\V: cmdinstall.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: MsiExec.exe File opened (read-only) \??\Y: MsiExec.exe File opened (read-only) \??\T: cfpconfg.exe File opened (read-only) \??\A: cmdinstall_138430009_eb.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: MsiExec.exe File opened (read-only) \??\G: cfpconfg.exe File opened (read-only) \??\H: cfpconfg.exe File opened (read-only) \??\K: cfpconfg.exe File opened (read-only) \??\J: cfpconfg.exe File opened (read-only) \??\N: cfpconfg.exe File opened (read-only) \??\H: cmdinstall_138430009_eb.exe File opened (read-only) \??\I: MsiExec.exe File opened (read-only) \??\M: MsiExec.exe File opened (read-only) \??\Q: MsiExec.exe File opened (read-only) \??\N: MsiExec.exe File opened (read-only) \??\U: cfpconfg.exe File opened (read-only) \??\U: cfpconfg.exe File opened (read-only) \??\A: cmdinstall.exe File opened (read-only) \??\H: cmdinstall.exe File opened (read-only) \??\Q: cmdinstall.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: cfpconfg.exe File opened (read-only) \??\R: MsiExec.exe File opened (read-only) \??\B: cmdinstall.exe File opened (read-only) \??\S: cmdinstall_138430009_eb.exe File opened (read-only) \??\X: cmdinstall_138430009_eb.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: MsiExec.exe File opened (read-only) \??\M: cmdinstall_138430009_eb.exe File opened (read-only) \??\E: MsiExec.exe File opened (read-only) \??\S: cfpconfg.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2132103209-3755304320-2959162027-1000\Control Panel\International\Geo\Nation cmd_fw_installer_138430009_eb.exe Key value queried \REGISTRY\USER\S-1-5-21-2132103209-3755304320-2959162027-1000\Control Panel\International\Geo\Nation cmdinstall.exe Key value queried \REGISTRY\USER\S-1-5-21-2132103209-3755304320-2959162027-1000\Control Panel\International\Geo\Nation cmdinstall_138430009_eb.exe Key value queried \REGISTRY\USER\S-1-5-21-2132103209-3755304320-2959162027-1000\Control Panel\International\Geo\Nation ise_installer.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\cmdvrt32.dll msiexec.exe File created C:\Windows\system32\cmdvrt64.dll msiexec.exe File created C:\Windows\SysWOW64\guard32.dll msiexec.exe File created C:\Windows\system32\guard64.dll msiexec.exe File created C:\Windows\syswow64\iseguard32.dll isestart.exe File created C:\Windows\system32\iseguard64.dll isestart.exe File created C:\Windows\system32\cmdcsr.dll msiexec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Comodo\Dragon\locales\sr.pak dragonsetup.exe File created C:\Program Files (x86)\Comodo\Dragon\extensions\flash_download_helper.crx dragonsetup.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\bin\pfpeapihoiogbcmdmnibeplnikfnhoge.xml msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\1046.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\virtkiosk.serbian.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\virtkiosk.turkish.lang msiexec.exe File created C:\Program Files (x86)\Comodo\Dragon\swiftshader\libEGL.dll dragonsetup.exe File created C:\Program Files (x86)\Comodo\Dragon\chrome_200_percent.pak dragonsetup.exe File created C:\Program Files (x86)\Comodo\Dragon\extensions\COS_Chrome_1.3.0.52.crx dragonsetup.exe File created C:\Program Files (x86)\COMODO\Internet Security Essentials\iseguard64.dll isestart.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\bin\hbdpomandigafcibbmofojjchbcdagbl.png msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\1048.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\1065.lang msiexec.exe File created C:\Program Files (x86)\Comodo\Dragon\locales\pt-BR.pak dragonsetup.exe File opened for modification C:\Program Files (x86)\Comodo\Dragon\dragon_id dragonsetup.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\1040.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\1045.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.arabic.lang msiexec.exe File created C:\Program Files (x86)\Comodo\Dragon\wow_helper.exe dragonsetup.exe File created C:\Program Files (x86)\Comodo\Dragon\locales\sv.pak dragonsetup.exe File created C:\Program Files (x86)\COMODO\Internet Security Essentials\isedrv_xp.sys isestart.exe File created C:\Program Files (x86)\COMODO\Internet Security Essentials\Translations\vkise.japanese.xml isestart.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\1026.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.croatian.lang msiexec.exe File created C:\Program Files (x86)\Comodo\Dragon\locales\pl.pak dragonsetup.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\1066.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.greek.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.serbian.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\SecurityProductInformation.ini msiexec.exe File created C:\Program Files (x86)\Comodo\Dragon\locales\he.pak dragonsetup.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\images\flip_out.png msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\cis.exe msiexec.exe File created C:\Program Files (x86)\Comodo\Dragon\icudtl.dat dragonsetup.exe File created C:\Program Files (x86)\Comodo\Dragon\locales\ja.pak dragonsetup.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\bin\Add_App.xml msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\resources\block.html msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.estonian.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.ukrainian.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\bin\lfbgimoladefibpklnfmkpknadbklade.png msiexec.exe File created C:\Program Files (x86)\Comodo\Dragon\dragon_register.exe dragonsetup.exe File created C:\Program Files (x86)\COMODO\Internet Security Essentials\Translations\vkise.russian.xml isestart.exe File created C:\Program Files\COMODO\COMODO Internet Security\scanners\script.cav msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\virtkiosk.english.lang.template msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\cmdcom32.dll msiexec.exe File created C:\Program Files (x86)\Comodo\Dragon\d3dcompiler_47.dll dragonsetup.exe File created C:\Program Files\COMODO\COMODO Internet Security\scanners\gunpack.cav msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\bin\ejjicmeblgpmajnghnpcppodonldlgfn.xml msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\drivers\win10\cmdboot.inf msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\drivers\win10\cmdboot.sys msiexec.exe File created C:\Program Files (x86)\Comodo\Dragon\restart_helper.exe dragonsetup.exe File created C:\Program Files (x86)\Comodo\Dragon\locales\bg.pak dragonsetup.exe File created C:\Program Files (x86)\COMODO\Internet Security Essentials\Translations\vkise.dutch.xml isestart.exe File created C:\Program Files\COMODO\COMODO Internet Security\vddata\vduserdata\bin\comodo_dragon.xml msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\virtkiosk.polish.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe msiexec.exe File created C:\Program Files (x86)\COMODO\Internet Security Essentials\isedrv_vista.sys isestart.exe File created C:\Program Files (x86)\COMODO\Internet Security Essentials\isedrv_win7.sys isestart.exe File created C:\Program Files\COMODO\COMODO Internet Security\scanners\mach32.dll msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\translations\virtkiosk.croatian.lang msiexec.exe File created C:\Program Files\COMODO\COMODO Internet Security\database\signers.tvt msiexec.exe File created C:\Program Files (x86)\Comodo\Dragon\locales\cs.pak dragonsetup.exe File created C:\Program Files (x86)\COMODO\Internet Security Essentials\Translations\vkise.ukrainian.xml isestart.exe File created C:\Program Files (x86)\Comodo\Dragon\dragon_id dragonsetup.exe File created C:\Program Files (x86)\Comodo\Dragon\locales\hr.pak dragonsetup.exe -
Drops file in Windows directory 22 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI274A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI28C3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI28F3.tmp msiexec.exe File created C:\Windows\ELAMBKUP\cmdboot.sys MsiExec.exe File created C:\Windows\Installer\e591e3c.msi msiexec.exe File opened for modification C:\Windows\Installer\e591e3c.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI21E7.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{529CC629-B436-4886-B322-4BE75B97783D} msiexec.exe File opened for modification C:\Windows\Installer\MSI5CBB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5C3D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2247.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI265E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5AF3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2217.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI564D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5B9F.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI213A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2864.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI56EA.tmp msiexec.exe -
Executes dropped EXE 15 IoCs
pid Process 4444 cmdinstall.exe 2456 cmdinstall_138430009_eb.exe 4088 dragonsetup.exe 452 dragon.exe 1112 dragon.exe 1200 dragon.exe 448 dragon_updater.exe 1444 ise_installer.exe 3772 isestart.exe 1480 MSI28F3.tmp 1576 MSI28F3.tmp 3996 cfpconfg.exe 4232 cisbf.exe 4560 cfpconfg.exe 116 cfpconfg.exe -
Loads dropped DLL 64 IoCs
pid Process 4444 cmdinstall.exe 2456 cmdinstall_138430009_eb.exe 2456 cmdinstall_138430009_eb.exe 2456 cmdinstall_138430009_eb.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 452 dragon.exe 1112 dragon.exe 452 dragon.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe -
Registers COM server for autorun 1 TTPs 39 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7D729A7-3570-4902-944A-470C9919FCCB}\InProcServer32\ = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cisresc.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\LocalServer32\ThreadingModel = "Free" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{C288AC5A-D846-4696-8028-2DF6F508D0D9}\LocalServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{05E5F178-256F-42EE-9BF4-A7E080F7B354}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0E9D49D-65D1-4AB1-8235-DF90B6ED8483}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvMonitor" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{B691E6DB-B216-4532-A2F3-1656BAC416FC}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{868A55F7-D79E-4C2E-8091-DEA9042B987F}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvSigChecker" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B691E6DB-B216-4532-A2F3-1656BAC416FC}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvBoostHelper" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1850D95-9C38-4D86-AC40-E559BC0E73C9}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvDllHost" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7D729A7-3570-4902-944A-470C9919FCCB}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67683718-82B8-4557-86A8-E04D169EF883}\InProcServer32\ = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cisbfps.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{10F58851-4358-4E4B-8494-DF34393F41A5}\LocalServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{1B1E2B7F-DDF5-4722-A450-085CC9EAC96C}\LocalServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{E8718E3A-1985-473C-9196-9A39AFB0028E}\LocalServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED181758-F11B-4C85-AEA2-199B3DC9F7DE}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10F58851-4358-4E4B-8494-DF34393F41A5}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED181758-F11B-4C85-AEA2-199B3DC9F7DE}\InprocServer32\ = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cisresc.dll" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{A1850D95-9C38-4D86-AC40-E559BC0E73C9}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED181758-F11B-4C85-AEA2-199B3DC9F7DE}\InprocServer32\ThreadingModel = "Free" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4D33F09-D11A-485D-AB08-8BFF862E7120}\LocalServer32 cisbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67683718-82B8-4557-86A8-E04D169EF883}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4D33F09-D11A-485D-AB08-8BFF862E7120}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cisbf.exe\"" cisbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF101135-6584-46E7-8AA1-8FCD1FCA5042}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C288AC5A-D846-4696-8028-2DF6F508D0D9}\LocalServer32\ThreadingModel = "Free" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B1E2B7F-DDF5-4722-A450-085CC9EAC96C}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B1E2B7F-DDF5-4722-A450-085CC9EAC96C}\LocalServer32\ThreadingModel = "Free" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05E5F178-256F-42EE-9BF4-A7E080F7B354}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvScanner" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{E0E9D49D-65D1-4AB1-8235-DF90B6ED8483}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4D33F09-D11A-485D-AB08-8BFF862E7120}\LocalServer32\ServerExecutable = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cisbf.exe" cisbf.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{FF101135-6584-46E7-8AA1-8FCD1FCA5042}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8718E3A-1985-473C-9196-9A39AFB0028E}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvMerger" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{868A55F7-D79E-4C2E-8091-DEA9042B987F}\LocalServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7D729A7-3570-4902-944A-470C9919FCCB}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67683718-82B8-4557-86A8-E04D169EF883}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF101135-6584-46E7-8AA1-8FCD1FCA5042}\LocalServer32\ThreadingModel = "Free" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C288AC5A-D846-4696-8028-2DF6F508D0D9}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10F58851-4358-4E4B-8494-DF34393F41A5}\LocalServer32\ThreadingModel = "Both" msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000008713e697204af040000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000008713e690000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090008713e69000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d08713e69000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000008713e6900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client" svchost.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{E0E9D49D-65D1-4AB1-8235-DF90B6ED8483}\ProgID msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1850D95-9C38-4D86-AC40-E559BC0E73C9}\ProgID msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\safe\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4EEF9DE1-A3AB-47B0-AD33-9598D96AF543}\ = "IUSBBurner" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05E5F178-256F-42EE-9BF4-A7E080F7B354}\ProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CavWp.AvMonitor\ = "AvMonitor Class" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CavWp.AvSigChecker\ = "AvSigChecker Class" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4EEF9DE1-A3AB-47B0-AD33-9598D96AF543}\ProxyStubClsid32\ = "{67683718-82B8-4557-86A8-E04D169EF883}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF101135-6584-46E7-8AA1-8FCD1FCA5042}\ProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DBA82F1B-DE79-4CF1-8F33-F1C1E27812DC}\7.0\0\win64\ = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{05E5F178-256F-42EE-9BF4-A7E080F7B354}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8718E3A-1985-473C-9196-9A39AFB0028E}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvMerger" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CavWp.AvDllHost msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67683718-82B8-4557-86A8-E04D169EF883}\ProxyStubClsid32\ = "{67683718-82B8-4557-86A8-E04D169EF883}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4D33F09-D11A-485D-AB08-8BFF862E7120}\Version cisbf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\kiosk\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED181758-F11B-4C85-AEA2-199B3DC9F7DE}\InprocServer32\ = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cisresc.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F8C8C537-0997-4D12-BD50-9B6C31A4883E}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CavWp.AvMonitor\CLSID\ = "{E0E9D49D-65D1-4AB1-8235-DF90B6ED8483}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CavWp.AvMonitor.1\CLSID\ = "{E0E9D49D-65D1-4AB1-8235-DF90B6ED8483}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CavWp.AvMerger\CLSID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{A1850D95-9C38-4D86-AC40-E559BC0E73C9}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4D33F09-D11A-485D-AB08-8BFF862E7120}\ = "USBBurner Class" cisbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF101135-6584-46E7-8AA1-8FCD1FCA5042}\ = "CisRmControl Class" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF101135-6584-46E7-8AA1-8FCD1FCA5042}\TypeLib\ = "{39DFE5A6-14E4-4A43-B022-B791EDA973BC}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CIS.CisLpsIntegration msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BAFAD68A-E0A2-4EB2-B2BA-1D0DE7CB2910} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BAFAD68A-E0A2-4EB2-B2BA-1D0DE7CB2910}\6.0\FLAGS\ = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\safe\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\safe\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED181758-F11B-4C85-AEA2-199B3DC9F7DE}\TypeLib\ = "{F8C8C537-0997-4D12-BD50-9B6C31A4883E}" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\CIS.CisRmControl\CLSID msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B1E2B7F-DDF5-4722-A450-085CC9EAC96C}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8718E3A-1985-473C-9196-9A39AFB0028E}\TypeLib\ = "{BAFAD68A-E0A2-4EB2-B2BA-1D0DE7CB2910}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D7D729A7-3570-4902-944A-470C9919FCCB}\NumMethods\ = "9" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4EEF9DE1-A3AB-47B0-AD33-9598D96AF543}\NumMethods\ = "4" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B1E2B7F-DDF5-4722-A450-085CC9EAC96C} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CavWp.AvBoostHelper.1\CLSID\ = "{B691E6DB-B216-4532-A2F3-1656BAC416FC}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{BAFAD68A-E0A2-4EB2-B2BA-1D0DE7CB2910}\6.0\FLAGS msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comodo\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C288AC5A-D846-4696-8028-2DF6F508D0D9}\ProgID\ = "CISSVC.CisGate" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10F58851-4358-4E4B-8494-DF34393F41A5}\ProgID\ = "CIS.CisWmiProvider" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10F58851-4358-4E4B-8494-DF34393F41A5}\LocalServer32\ThreadingModel = "Both" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.xhtml dragon.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{59A8627E-99C2-4995-81D3-44A31D62EA3A}\7.0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CIS.CisLpsIntegration\CLSID\ = "{1B1E2B7F-DDF5-4722-A450-085CC9EAC96C}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\safe\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4D33F09-D11A-485D-AB08-8BFF862E7120}\Version\ = "1.0" cisbf.exe Key created \REGISTRY\MACHINE\Software\Classes\DragonHTML dragon.exe Key created \REGISTRY\MACHINE\Software\Classes\.svg\OpenWithProgids dragon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{59A8627E-99C2-4995-81D3-44A31D62EA3A} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CavWp.AvSigChecker.1\ = "AvSigChecker Class" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{A70211A1-E8DF-47DC-B336-74BF57292D88}\7.0\0\win64 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{A70211A1-E8DF-47DC-B336-74BF57292D88}\7.0\FLAGS msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B1E2B7F-DDF5-4722-A450-085CC9EAC96C}\LocalServer32\ThreadingModel = "Free" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DBA82F1B-DE79-4CF1-8F33-F1C1E27812DC}\7.0\0\win64 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.html dragon.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{FF101135-6584-46E7-8AA1-8FCD1FCA5042}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CIS.CisCceIntegration\CLSID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\LocalServer32\ThreadingModel = "Free" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1850D95-9C38-4D86-AC40-E559BC0E73C9} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0E9D49D-65D1-4AB1-8235-DF90B6ED8483} msiexec.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\D70D7D00CA12E1B3E20F3BF7534DEB2C2E7C2404 cfpconfg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\31D019FC7AB697D57D9C4AFB340ED7C4D10400DF cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd cmdinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4 cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4\Blob = 5c00000001000000040000000010000019000000010000001000000082218ffb91733e64136be5719f57c3a1030000000100000014000000afe5d244a8d1194230ff479fe2f897bbcd7a8cb41d0000000100000010000000cb39c3d4272cdf63774e1db810c5a89e140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d462000000010000002000000052f0e1c4e58ec629291b60317f074671b85d7ea80d5b07273463534b32b402340b000000010000003a0000005300650063007400690067006f002000280066006f0072006d00650072006c007900200043006f006d006f0064006f002000430041002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000030000000761613f4cd8607508c3d520fbefe68773735fc73746f42a9fd6254ba3b72f0047994e5af57677cf6d2c1965984965df10400000001000000100000001b31b0714036cc143691adc43efdec182000000001000000dc050000308205d8308203c0a00302010202104caaf9cadb636fe01ff74ed85b03869d300d06092a864886f70d01010c0500308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f72697479301e170d3130303131393030303030305a170d3338303131383233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a3423040301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201000af1d54684b7ae51bb6cb24d411400934c9ccbe5c054cfa0258e02f9fdb0a20df520983c132dac56a2b0d67e1192e92eba9e2e9a72b1bd19446c6135a29ab41612695a8ce1d73ea41ae82f03f4ae611d101b2aa48b7ac5fe05a6e1c0d6c8fe9eae8f2bba3d99f8d8730958466ea69cf4d727d395da3783721cd373e0a2479903385dd5497900291cc7ec9b201c0724695778b239fc3a84a0b59c7c8dbf2e936227b739da1718aebd3c0968ff849b3cd5d60b03e3579e14f7d1eb4fc8bd8723b7b6494379855cbaeb920ba1c6e868a84c16b11a990ae8532c92bba10918750c65a87bcb23b71ac22885c31bffd02b62efa47b099198678c1401cd68066a6321750380888a6e81c685f2a9a42de7f4a524104783cacdf48d7958b1069be71a2ad99d01d7947ded034acaf0dbe8a9013ef55699c91e8e493dbbe509b9e04f49923d168240cccc59c6e63aed122e693c6c95b1fdaa1d7b7f86be1e0e3246fbfb138f757f4c8b4b4663fe00344070c1c3b9a1dda670e204b341bce98091ea649c7ae12203a99c6e6f0e654f6c87875ef36ea0f975a59b40e853b2279d4ab9c077218dff87f2debc8cef17dfb7490bd1f26e300b1a0e4e76ed11fcf5e956b27dbfc76d0a938ca5d0c0b61dbe3a4e94a2d76e6c0bc28a7cfa20f3c4e4e5cd0da8cb9192b17c85ecb51469660e82e7cdcec82da6517f21c1355385064a5d9fadbb1b5f74 cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\6CD253D636A7B4D0E0981431BC064061A9853ED9\Blob = 0300000001000000140000006cd253d636a7b4d0e0981431bc064061a9853ed920000000010000001b06000030820617308204ffa003020102021032327facb1bd6f1fa93473ccc515fd82300d06092a864886f70d01010b0500308191310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564313730350603550403132e434f4d4f444f2052534120457874656e6465642056616c69646174696f6e20436f6465205369676e696e67204341301e170d3138303132343030303030305a170d3231303132333233353935395a308201153110300e060355040513073339313038303531133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e311a301806035504090c11313235352042726f61642053747265657431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100b7713778a66667b8cd67f828f378f80a5507c4e8aa143cfd5b9b953ab16d04a965dcd386a35efe8378c1e0e5ceaf124f188102958962014e493cd80f11fc2ba339953a8bb71a9f030ebbe8742b4252ab465a2d41a829508a9eef5d34d171fcf0b5be026fe15e1a70288b2ecd4af1332924d53c0eefe5c7033482769cae8b5c5e8d59033fac40e94d714c5cd05e8db6f0edb71bb26565d52a025f35323203e9a7846d00a235f973d1e43f29a81dcd1bfef625d373f94a51cc8d2be8ee69702a73a694da69d9b0fbae7d1dee353683a2037a2019b9260a1b53f6c89d945b384c275670bdfac333301504af00749373356a1e7a422eb9363bdab713f9ad6b5bb1970203010001a38201e2308201de301f0603551d23041830168014df8ff3200ce9caa604d85b58372a3dab46dc8349301d0603551d0e04160414e18081b3e9396b7109e8b2add6c3d20ebf4b4814300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010601302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f43505330550603551d1f044e304c304aa048a0468644687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e63726c30818606082b06010505070101047a3078305006082b060105050730028644687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33393130383035300d06092a864886f70d01010b050003820101004bc17929ea82f3c4787f7b29b69edb09e169797a9f4cd233f035412d2b9c586e352d2c0d1cd530a946a91ccd8858453573f0b45a0cdc743d662af4761420489adadbd9a84915b697f96ed1e49786c53000eb12555d3b2957eec18279326020737e2e3e4d621856026169ad6f6cf18ee7b59d5b6a7e6d8c252fa1a15363ec89a6efe5efdf4b260ad35c6a0e1db0250d1eb66ea7b91f15e0f57ecc0541e1ad74a2069f717dec0b1f03101b6812c13f64264f8c40a3614ffb8ccabedb974cda14eb50c061d5cd23dc7735cd0bcfdcef3fd178c1f95594a591031d05c8554cb5fe6fd23cb95931bf847f5b525a269aeac0336313e8f6e81ccb1692d86993724f709e cfpconfg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 5c00000001000000040000000008000019000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b6885186868000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b0400000001000000100000001d3554048578b03f42424dbf20730a3f20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 cmdinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 cmdinstall_138430009_eb.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E35E6F46A1A9A4D18A4DAA298BDA4D1E8879236E\Blob = 030000000100000014000000e35e6f46a1a9a4d18a4daa298bda4d1e8879236e20000000010000005f0500003082055b30820443a003020102021100d9218e2757ec45d84ec08b3e6700c85e300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3138313231313030303030305a170d3139303730373233353935395a3081a8310b3009060355040613025553310e300c06035504110c053037303133310b300906035504080c024e4a3110300e06035504070c07436c6966746f6e3116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100b73a668ff7984c8d990d7c6e51df5176c7842cc1bf351c27286c6139f4831fc718a35b0fa9145f0887de8bce335e8e3e12fce763cab5deeae08e0bf325cd79a4fbb328d7c7f7d53de51bd3c05c5966b634a9b1fc4362afd0267f927dd90a52b6a5f5f0e29c8e94dfe4199b2cf31142bb480e95ecb92b6ca20ecd71ff210df9655e9e9ac856ad7aab929b843052d4a21c27ea4054a9f4e8c4cd88943b1a4d3a58b3e06eb654c6c09cef472d6fb0d05a841ce229b53a5d36bd08cbfdc552f7c758efaa7824c1d27e30a83d7a9cecaab4bd91b2cbd60d1335fc4ac0f0294dd2eeb3f65139467761f091840246ff644edbfacb9ffd7ef2823fd9eea312dd299a39af0203010001a38201aa308201a6301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604147c4f2b645af103043ca7675e8c129c16dee7164c300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d301f0603551d1104183016811473636f742e7765697240636f6d6f646f2e636f6d300d06092a864886f70d01010505000382010100b33c0fee4668b9e86cd777fa94eb47dcaee7fb5b9b897b9458b12e511a194b6ad495ea4b6b820d1c7cd26badf92cfc13aaa9e66157a55545c7ea71460a4fa4e30e46b9ac16a36e94a1fcbc62b2abe402d2a58773344c4b23a0d907a9760029595421e478da67167f80876012443cd22573dc3806cdedbc6c8c4ed255bd926cecc7796ec36fb225d084f31afb5e5a2e86d26149212dda8aed2058ef0d7e7e677b463a7722431a0b5c0b9dc385b7d2e73bd781ee111c8f7e36d76e1db1f6ac98784227ed97cde3762d079741984d146a8ff96e411c1b1e4e711cd00a6150532ffaa13702a81f4514eae48ca0b98d8642a6cfe7711dc67d1b857bfecb4e863bc1f9 cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F8DB7E1C16F1FFD4AAAD4AAD8DFF0F2445184AEB\Blob = 030000000100000014000000f8db7e1c16f1ffd4aaad4aad8dff0f2445184aeb20000000010000000906000030820605308203eda0030201020210078f0a9d03df119e434e4fec1bf0235a300d06092a864886f70d01010b0500308194310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313e303c060355040313354d6963726f736f667420446576656c6f706d656e7420526f6f7420436572746966696361746520417574686f726974792032303134301e170d3134303532383136343334365a170d3339303532383136353134385a308194310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313e303c060355040313354d6963726f736f667420446576656c6f706d656e7420526f6f7420436572746966696361746520417574686f72697479203230313430820222300d06092a864886f70d01010105000382020f003082020a0282020100c20f7f6d49bb39f04d943fe8fb4dc5eb3be1285ab9892a467ea5c333271d82893feb33a1876aeae882b9dac39d77d135c0cb833672a6571912bc15e2c83c7b83623414d5abb6de368ba15a71a65196a70633b3221d146253c2a5af9a40cabe2c485499e72a9368a769190b99693bc1b2acae94dc5fab7e02cade3ca774a68c10a0e5aeb69c35ef838b10e5972aba916b9a6a4595d9d054718e653fc48a53ca1e38470ae9d04184a5da1e66016504e6505b7735f5b42e29320cc6bf5f61ee3220b77c39f911faff605efec669f46f1e1ded1d06e7651e9a112e6344065f31431733e9a32682d44b83124fd2a126032548e13abd84f58ad5b46e1ae871200e45530167ade31e6be8b2e4abfdf53b8eba67af5984cc5c75d09daa5c72c42636a2ac324c6ab1f8331744d2a77d70eeeb70949abceaba1c104b635b38ddd2254504b2f0b35a7c0b0a8e21406437114d96694533e493839ef9b3b51c2b0571ea6dcce748b6b6de805010ca4938b35905704ebd9e880222586489eb40dab12d2d6a40885d23c33ed0f5d5b7908a28543962a2c5c6b1bf74cd8695f9456bccf207eaac5cd336f7a27ab5b472532a063ec337945858b14a71bb5ccd9cb2af109ad943363e528519e7422891118c8ce7bbdfe6c855087375f3960d86b7d2e506b2c08a54a86177207d6cd1feba68f3454aaf1184eb867d2f04f354ea20ffd5db3d250270870203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604148570009f77591e8cac3c9f77262819cc9ac18f32301006092b06010401823715010403020100300d06092a864886f70d01010b050003820201004f2574bd1f624f5f0ff74222d7d1d65304232ec5d5d7072b6b793b5f6d90ed1355d382f1f5028f3ef996267e0d421876fc6055825a86bd113339690fcee0b02bf15d19dfd8d2fa86a4cccdacf0d0ae9a8b2b248f03c1350d20b3dfc742ea77292e0a12fc0b1a458dd931840d8d02c0acfad212bf1e6a343eea8300a348754e72662da1a5129f37a85d4a7759cfd63afc30c5a609a5bfb108e3fb2c9f76c4fb4e611d6d23f3766985eb49bb0df73dd0aa05bcdd3d6e80445ed99a68ecc989c7e61a18f860a0e78cf6e6516f0ee025b863f9f9c20b8c3c9cb2f042cdbec3f5fe4929559c5e8696fba1ed6d2686e8b8208b5cc6e72d31c5aaca7d4b7da059a41efb5071e9afcfd6aa0d99de8e95269731a5f47f6df46815b8e3f7add8efd13875025ffd6d4efcb6fc2f451ba9cad11e7aff75181536c120e45f483a95eb7be4f5f6f4fec94b21a2a9ea8a9925cbe8444090d539b46b239b52bcc0c17e17666e650bf5741596a866ed856854b224e87588644589853c7a656b96e0f259ea4725660f6a1b0c3fd44ae64b26174709fed4d7b8e0cee72f94ad808b6770ccb77bcf1b2bb9d15bbdb8035cb1f01b412ce6535516e74a0e41089937e2a9d76d0e6a45e5ece388a9fdb69bc32820ceabc2936b516553bfa05e7b9d26349a514c8ca638d5865b3c55ee50ec000bcaacdcca10abdf189bd2ac0c8d084515af8535355ae526bc cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 190000000100000010000000e843ac3b52ec8c297fa948c9b1fb2819030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4668000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d86200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703080b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a00650063007400290000000f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb20000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 cmdinstall_138430009_eb.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 040000000100000010000000a7f2e41606411150306b9ce3b49cb0c90f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb0b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a0065006300740029000000090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703086200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d81d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67087e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d901030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d46190000000100000010000000e843ac3b52ec8c297fa948c9b1fb281920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 cmdinstall_138430009_eb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F8DB7E1C16F1FFD4AAAD4AAD8DFF0F2445184AEB cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4\Blob = 0f0000000100000030000000761613f4cd8607508c3d520fbefe68773735fc73746f42a9fd6254ba3b72f0047994e5af57677cf6d2c1965984965df1090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003a0000005300650063007400690067006f002000280066006f0072006d00650072006c007900200043006f006d006f0064006f002000430041002900000062000000010000002000000052f0e1c4e58ec629291b60317f074671b85d7ea80d5b07273463534b32b40234140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d41d0000000100000010000000cb39c3d4272cdf63774e1db810c5a89e030000000100000014000000afe5d244a8d1194230ff479fe2f897bbcd7a8cb42000000001000000dc050000308205d8308203c0a00302010202104caaf9cadb636fe01ff74ed85b03869d300d06092a864886f70d01010c0500308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f72697479301e170d3130303131393030303030305a170d3338303131383233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a3423040301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201000af1d54684b7ae51bb6cb24d411400934c9ccbe5c054cfa0258e02f9fdb0a20df520983c132dac56a2b0d67e1192e92eba9e2e9a72b1bd19446c6135a29ab41612695a8ce1d73ea41ae82f03f4ae611d101b2aa48b7ac5fe05a6e1c0d6c8fe9eae8f2bba3d99f8d8730958466ea69cf4d727d395da3783721cd373e0a2479903385dd5497900291cc7ec9b201c0724695778b239fc3a84a0b59c7c8dbf2e936227b739da1718aebd3c0968ff849b3cd5d60b03e3579e14f7d1eb4fc8bd8723b7b6494379855cbaeb920ba1c6e868a84c16b11a990ae8532c92bba10918750c65a87bcb23b71ac22885c31bffd02b62efa47b099198678c1401cd68066a6321750380888a6e81c685f2a9a42de7f4a524104783cacdf48d7958b1069be71a2ad99d01d7947ded034acaf0dbe8a9013ef55699c91e8e493dbbe509b9e04f49923d168240cccc59c6e63aed122e693c6c95b1fdaa1d7b7f86be1e0e3246fbfb138f757f4c8b4b4663fe00344070c1c3b9a1dda670e204b341bce98091ea649c7ae12203a99c6e6f0e654f6c87875ef36ea0f975a59b40e853b2279d4ab9c077218dff87f2debc8cef17dfb7490bd1f26e300b1a0e4e76ed11fcf5e956b27dbfc76d0a938ca5d0c0b61dbe3a4e94a2d76e6c0bc28a7cfa20f3c4e4e5cd0da8cb9192b17c85ecb51469660e82e7cdcec82da6517f21c1355385064a5d9fadbb1b5f74 cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4\Blob = 19000000010000001000000082218ffb91733e64136be5719f57c3a1030000000100000014000000afe5d244a8d1194230ff479fe2f897bbcd7a8cb41d0000000100000010000000cb39c3d4272cdf63774e1db810c5a89e140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d462000000010000002000000052f0e1c4e58ec629291b60317f074671b85d7ea80d5b07273463534b32b402340b000000010000003a0000005300650063007400690067006f002000280066006f0072006d00650072006c007900200043006f006d006f0064006f002000430041002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000030000000761613f4cd8607508c3d520fbefe68773735fc73746f42a9fd6254ba3b72f0047994e5af57677cf6d2c1965984965df12000000001000000dc050000308205d8308203c0a00302010202104caaf9cadb636fe01ff74ed85b03869d300d06092a864886f70d01010c0500308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f72697479301e170d3130303131393030303030305a170d3338303131383233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a3423040301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201000af1d54684b7ae51bb6cb24d411400934c9ccbe5c054cfa0258e02f9fdb0a20df520983c132dac56a2b0d67e1192e92eba9e2e9a72b1bd19446c6135a29ab41612695a8ce1d73ea41ae82f03f4ae611d101b2aa48b7ac5fe05a6e1c0d6c8fe9eae8f2bba3d99f8d8730958466ea69cf4d727d395da3783721cd373e0a2479903385dd5497900291cc7ec9b201c0724695778b239fc3a84a0b59c7c8dbf2e936227b739da1718aebd3c0968ff849b3cd5d60b03e3579e14f7d1eb4fc8bd8723b7b6494379855cbaeb920ba1c6e868a84c16b11a990ae8532c92bba10918750c65a87bcb23b71ac22885c31bffd02b62efa47b099198678c1401cd68066a6321750380888a6e81c685f2a9a42de7f4a524104783cacdf48d7958b1069be71a2ad99d01d7947ded034acaf0dbe8a9013ef55699c91e8e493dbbe509b9e04f49923d168240cccc59c6e63aed122e693c6c95b1fdaa1d7b7f86be1e0e3246fbfb138f757f4c8b4b4663fe00344070c1c3b9a1dda670e204b341bce98091ea649c7ae12203a99c6e6f0e654f6c87875ef36ea0f975a59b40e853b2279d4ab9c077218dff87f2debc8cef17dfb7490bd1f26e300b1a0e4e76ed11fcf5e956b27dbfc76d0a938ca5d0c0b61dbe3a4e94a2d76e6c0bc28a7cfa20f3c4e4e5cd0da8cb9192b17c85ecb51469660e82e7cdcec82da6517f21c1355385064a5d9fadbb1b5f74 cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4\Blob = 0400000001000000100000001b31b0714036cc143691adc43efdec180f0000000100000030000000761613f4cd8607508c3d520fbefe68773735fc73746f42a9fd6254ba3b72f0047994e5af57677cf6d2c1965984965df1090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003a0000005300650063007400690067006f002000280066006f0072006d00650072006c007900200043006f006d006f0064006f002000430041002900000062000000010000002000000052f0e1c4e58ec629291b60317f074671b85d7ea80d5b07273463534b32b40234140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d41d0000000100000010000000cb39c3d4272cdf63774e1db810c5a89e030000000100000014000000afe5d244a8d1194230ff479fe2f897bbcd7a8cb419000000010000001000000082218ffb91733e64136be5719f57c3a12000000001000000dc050000308205d8308203c0a00302010202104caaf9cadb636fe01ff74ed85b03869d300d06092a864886f70d01010c0500308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f72697479301e170d3130303131393030303030305a170d3338303131383233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a3423040301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201000af1d54684b7ae51bb6cb24d411400934c9ccbe5c054cfa0258e02f9fdb0a20df520983c132dac56a2b0d67e1192e92eba9e2e9a72b1bd19446c6135a29ab41612695a8ce1d73ea41ae82f03f4ae611d101b2aa48b7ac5fe05a6e1c0d6c8fe9eae8f2bba3d99f8d8730958466ea69cf4d727d395da3783721cd373e0a2479903385dd5497900291cc7ec9b201c0724695778b239fc3a84a0b59c7c8dbf2e936227b739da1718aebd3c0968ff849b3cd5d60b03e3579e14f7d1eb4fc8bd8723b7b6494379855cbaeb920ba1c6e868a84c16b11a990ae8532c92bba10918750c65a87bcb23b71ac22885c31bffd02b62efa47b099198678c1401cd68066a6321750380888a6e81c685f2a9a42de7f4a524104783cacdf48d7958b1069be71a2ad99d01d7947ded034acaf0dbe8a9013ef55699c91e8e493dbbe509b9e04f49923d168240cccc59c6e63aed122e693c6c95b1fdaa1d7b7f86be1e0e3246fbfb138f757f4c8b4b4663fe00344070c1c3b9a1dda670e204b341bce98091ea649c7ae12203a99c6e6f0e654f6c87875ef36ea0f975a59b40e853b2279d4ab9c077218dff87f2debc8cef17dfb7490bd1f26e300b1a0e4e76ed11fcf5e956b27dbfc76d0a938ca5d0c0b61dbe3a4e94a2d76e6c0bc28a7cfa20f3c4e4e5cd0da8cb9192b17c85ecb51469660e82e7cdcec82da6517f21c1355385064a5d9fadbb1b5f74 cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd cmdinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46 cmdinstall_138430009_eb.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 0f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb0b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a0065006300740029000000090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703086200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d81d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67087e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d901030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4620000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 cmdinstall_138430009_eb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E35E6F46A1A9A4D18A4DAA298BDA4D1E8879236E cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\31D019FC7AB697D57D9C4AFB340ED7C4D10400DF\Blob = 03000000010000001400000031d019fc7ab697d57d9c4afb340ed7c4d10400df2000000001000000250600003082062130820509a00302010202101b427b060e2866bfb586cc267e1c3eaa300d06092a864886f70d01010b0500308191310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564313730350603550403132e434f4d4f444f2052534120457874656e6465642056616c69646174696f6e20436f6465205369676e696e67204341301e170d3138313230343030303030305a170d3231313230333233353935395a308201093110300e060355040513073339313038303531133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b3009060355040613025553310e300c06035504110c053037303133310b300906035504080c024e4a3110300e06035504070c07436c6966746f6e3116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100ad390c8bc919005d5894a91a9585ef887fbd7c2341ff5ebb3efc6f645a66c55e6da11febce740e53ed9416284dfc7d142e4dc21f99753b5f60ae9aadc764b59efd9ffd33b20ae1c54eba629408a1b095a59cf4af0ad9db9bc494250154dcd0edefcec62e4b248d9a793b703aa15255baf3553fa59d4dc558ba4303af630bb626cd6627e0c4a45764ec3b286c38ab2499f9dc13eefdffa7841297ff533b47061b9aa3ff09ee3f04a7b10ba70894e53f3352b1f60eddfc021a66546e3392795bb6ae49a92f189ec2a7cdd9a935fab33a5ce7fc16c4b7e8ca13b4551d38a6a7c0658298a5adf5f6796675f58e1bb4ce410ff704bc5e845bc1ef83c18a0d50e137370203010001a38201f8308201f4301f0603551d23041830168014df8ff3200ce9caa604d85b58372a3dab46dc8349301d0603551d0e041604142d99b81962209042dc650eb36ec07ad996e48c4d300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010601302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f43505330550603551d1f044e304c304aa048a0468644687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e63726c30818606082b06010505070101047a3078305006082b060105050730028644687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30440603551d11043d303ba02306082b06010505070803a01730150c1355532d44454c41574152452d33393130383035811473636f742e7765697240636f6d6f646f2e636f6d300d06092a864886f70d01010b050003820101007f4d3e6594a3e380fac36b00e97ccacce4786be2ecc13cf37e737aaca0328bb8bfdcd513daff94aba1c7ee00cc8a3bd073157a812f6e31f772781d0bb922a8b86932b296c2312cdf3b239c42bb443b4b1b89b36de34a7fae65ac63eb6ead8812f8d373fa6f1a4e8d9e62eb004caae3639e41e08ed48d640b04725b09b4411dc083587e7fe24b33d90677677960efa6299cc85c4b2bfae4cdfe36581d25e029f6af1a7e77f502882d87597f3cc5bb450a71f9fd57f43b321baa4cbe5213a48a2c5b785a9de4103d5029e4db79403e98784e51379d45a86996b183469e98470731d1a603eaa443a05527aca62f51631722dc0dfe5d74c8298d2aed885d34c9be61 cfpconfg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0400000001000000100000001d3554048578b03f42424dbf20730a3f0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d90103000000010000001400000002faf3e291435468607857694df5e45b6885186819000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e cmdinstall_138430009_eb.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 5c000000010000000400000000080000190000000100000010000000e843ac3b52ec8c297fa948c9b1fb2819030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4668000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d86200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703080b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a00650063007400290000000f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb040000000100000010000000a7f2e41606411150306b9ce3b49cb0c920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 cmdinstall_138430009_eb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\6CD253D636A7B4D0E0981431BC064061A9853ED9 cfpconfg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E cmdinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e cmdinstall_138430009_eb.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\D70D7D00CA12E1B3E20F3BF7534DEB2C2E7C2404\Blob = 030000000100000014000000d70d7d00ca12e1b3e20f3bf7534deb2c2e7c24042000000001000000530500003082054f30820437a00302010202102f9f0a1d6764b5a6378747247087ba73300d06092a864886f70d01010b0500307d310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312330210603550403131a434f4d4f444f2052534120436f6465205369676e696e67204341301e170d3138313231313030303030305a170d3139313231313233353935395a3081b8310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303116301406035504090c0d313235352042726f616420537431223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100c1b2eafc6255d7a7780082967ba911a65b8160e697a9c81ae0816002356644b714895808a67b22551d87b879e80d0c1bff7bd847e1486bad3c3caa8c6f3258a7311f8b03c68c9ec5947950e57a1f99f4b47b8faaf46e282f68155ae6e8f13c9c125b5eb83ae4e63ee6081d0e8aae4f090175a538422b38e0600bd94b21b313567934ee959ddd6ab7ef62bce25dada05d7de6a75cefeffdcba6a1fc8e1ef7aa6d3e5ab328732c3d31759a20d7e69cef60ac9d152041dbd85167a78329f3a80fee19ea9edb102448aa9f5774794ecb560de2faa348f278b846a2a5d8238d5e4e4cd2a82f0e37415af2dc63f34f3e179aa1cae7290b411aaf5aa6acf5404ebe98130203010001a382018d30820189301f0603551d23041830168014299160ff8a4dfaebf9a66ab8cff9e64bbd49ce12301d0603551d0e041604146c5f99825f4ba8d4c19bae5169bab32fae7816ca300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e63726c307406082b0601050507010104683066303e06082b060105050730028632687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010b050003820101000f718c2aa40e9c44a95e1eca3844097ddb7fba896b5f5c73a6b9aede1d29f0e432f41c8a45ce38b1f52df73f45e67907a03ac58d407b3077b1cae246a54544ee365bcee4bf0f4cecc47b01e98d0478d8f4c93e2c582aa472577de9c67a0a8c2e37635e626258675e0e6669babee331594abed516679e8f1b14d7a65dc1b76ab33412689b135cf855335748e2d1998759e5b95f68d418d5486d385d0db7a8fa30e58e84f57bb7ec3f45efa549fab71775c822ec846545b6fc0ef1d3c2dad34940657088fc5f773a1cbe24f9228f9dd7e9611d5d682998c6041ba580a789f5571da01d6723784bbcec4fded61d0ba31e37fbc10c3dfe06169df4670c8d454019f7 cfpconfg.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 4088 dragonsetup.exe 3772 isestart.exe 3772 isestart.exe 3772 isestart.exe 3772 isestart.exe 3772 isestart.exe 3772 isestart.exe 3772 isestart.exe 3772 isestart.exe 4864 msiexec.exe 4864 msiexec.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 652 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTcbPrivilege 4444 cmdinstall.exe Token: SeTcbPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeDebugPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeDebugPrivilege 3772 isestart.exe Token: SeDebugPrivilege 3772 isestart.exe Token: SeDebugPrivilege 3772 isestart.exe Token: SeDebugPrivilege 3772 isestart.exe Token: SeShutdownPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeIncreaseQuotaPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeSecurityPrivilege 4864 msiexec.exe Token: SeCreateTokenPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeAssignPrimaryTokenPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeLockMemoryPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeIncreaseQuotaPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeMachineAccountPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeTcbPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeSecurityPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeTakeOwnershipPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeLoadDriverPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeSystemProfilePrivilege 2456 cmdinstall_138430009_eb.exe Token: SeSystemtimePrivilege 2456 cmdinstall_138430009_eb.exe Token: SeProfSingleProcessPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeIncBasePriorityPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeCreatePagefilePrivilege 2456 cmdinstall_138430009_eb.exe Token: SeCreatePermanentPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeBackupPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeRestorePrivilege 2456 cmdinstall_138430009_eb.exe Token: SeShutdownPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeDebugPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeAuditPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeSystemEnvironmentPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeChangeNotifyPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeRemoteShutdownPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeUndockPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeSyncAgentPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeEnableDelegationPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeManageVolumePrivilege 2456 cmdinstall_138430009_eb.exe Token: SeImpersonatePrivilege 2456 cmdinstall_138430009_eb.exe Token: SeCreateGlobalPrivilege 2456 cmdinstall_138430009_eb.exe Token: SeRestorePrivilege 4864 msiexec.exe Token: SeTakeOwnershipPrivilege 4864 msiexec.exe Token: SeRestorePrivilege 4864 msiexec.exe Token: SeTakeOwnershipPrivilege 4864 msiexec.exe Token: SeTcbPrivilege 4056 MsiExec.exe Token: SeRestorePrivilege 4864 msiexec.exe Token: SeTakeOwnershipPrivilege 4864 msiexec.exe Token: SeTcbPrivilege 4056 MsiExec.exe Token: SeRestorePrivilege 4864 msiexec.exe Token: SeTakeOwnershipPrivilege 4864 msiexec.exe Token: SeTcbPrivilege 4056 MsiExec.exe Token: SeRestorePrivilege 4864 msiexec.exe Token: SeTakeOwnershipPrivilege 4864 msiexec.exe Token: SeTcbPrivilege 4056 MsiExec.exe Token: SeRestorePrivilege 4864 msiexec.exe Token: SeTakeOwnershipPrivilege 4864 msiexec.exe Token: SeRestorePrivilege 4864 msiexec.exe Token: SeTakeOwnershipPrivilege 4864 msiexec.exe Token: SeTcbPrivilege 4056 MsiExec.exe Token: SeRestorePrivilege 4864 msiexec.exe Token: SeTakeOwnershipPrivilege 4864 msiexec.exe Token: SeTcbPrivilege 2432 MsiExec.exe Token: SeRestorePrivilege 4864 msiexec.exe Token: SeTakeOwnershipPrivilege 4864 msiexec.exe Token: SeTcbPrivilege 2432 MsiExec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4272 cmd_fw_installer_138430009_eb.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2456 cmdinstall_138430009_eb.exe 2456 cmdinstall_138430009_eb.exe 2456 cmdinstall_138430009_eb.exe 2456 cmdinstall_138430009_eb.exe 3772 isestart.exe 3772 isestart.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4272 wrote to memory of 4444 4272 cmd_fw_installer_138430009_eb.exe 89 PID 4272 wrote to memory of 4444 4272 cmd_fw_installer_138430009_eb.exe 89 PID 4272 wrote to memory of 4444 4272 cmd_fw_installer_138430009_eb.exe 89 PID 4444 wrote to memory of 2456 4444 cmdinstall.exe 90 PID 4444 wrote to memory of 2456 4444 cmdinstall.exe 90 PID 4444 wrote to memory of 2456 4444 cmdinstall.exe 90 PID 2456 wrote to memory of 4088 2456 cmdinstall_138430009_eb.exe 97 PID 2456 wrote to memory of 4088 2456 cmdinstall_138430009_eb.exe 97 PID 2456 wrote to memory of 4088 2456 cmdinstall_138430009_eb.exe 97 PID 4088 wrote to memory of 452 4088 dragonsetup.exe 100 PID 4088 wrote to memory of 452 4088 dragonsetup.exe 100 PID 4088 wrote to memory of 452 4088 dragonsetup.exe 100 PID 452 wrote to memory of 1112 452 dragon.exe 101 PID 452 wrote to memory of 1112 452 dragon.exe 101 PID 452 wrote to memory of 1112 452 dragon.exe 101 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 452 wrote to memory of 1200 452 dragon.exe 102 PID 4088 wrote to memory of 448 4088 dragonsetup.exe 104 PID 4088 wrote to memory of 448 4088 dragonsetup.exe 104 PID 4088 wrote to memory of 448 4088 dragonsetup.exe 104 PID 2456 wrote to memory of 1444 2456 cmdinstall_138430009_eb.exe 106 PID 2456 wrote to memory of 1444 2456 cmdinstall_138430009_eb.exe 106 PID 2456 wrote to memory of 1444 2456 cmdinstall_138430009_eb.exe 106 PID 1444 wrote to memory of 3772 1444 ise_installer.exe 107 PID 1444 wrote to memory of 3772 1444 ise_installer.exe 107 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cmd_fw_installer_138430009_eb.exe"C:\Users\Admin\AppData\Local\Temp\cmd_fw_installer_138430009_eb.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe" -log -setupname "cmd_fw_installer_138430009_eb.exe" -sfx "C:\Users\Admin\AppData\Local\Temp" -theme lycia -type web -mode cfwfree2⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall_138430009_eb.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall_138430009_eb.exe" -log -theme "lycia" -setupname "cmd_fw_installer_138430009_eb.exe" -type "web" -mode "cfwfree" -sfx "C:\Users\Admin\AppData\Local\Temp" -logfile "C:\Users\Admin\AppData\Local\Temp\\cmdinstall.exe_24-02-22_23.02.23.log" -parent 4444 "Admin" 19003⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\ProgramData\Comodo Downloader\cis\download\installs\8050\xml_binaries\dragon\dragonsetup.exe"C:\ProgramData\Comodo Downloader\cis\download\installs\8050\xml_binaries\dragon\dragonsetup.exe" --silent --do-not-auto-launch --disable-secure-dns --defer-start-updateservice --cid=138430009 --cv=12.2.2.8012 --nt4⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Program Files (x86)\Comodo\Dragon\dragon.exe"C:\Program Files (x86)\Comodo\Dragon\dragon.exe" --no-first-run --register-dragon-browser5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Program Files (x86)\Comodo\Dragon\dragon.exe"C:\Program Files (x86)\Comodo\Dragon\dragon.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Comodo\Dragon\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Comodo\Dragon\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Comodo\Dragon\User Data" --annotation=plat=Win32 --annotation=prod=Dragon --annotation=ver=75.0.3770.100 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1d4,0x1e8,0x707ca250,0x707ca260,0x707ca26c6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1112
-
-
C:\Program Files (x86)\Comodo\Dragon\dragon.exe"C:\Program Files (x86)\Comodo\Dragon\dragon.exe" --type=gpu-process --field-trial-handle=1704,8708418929962115728,17572580715894145644,131072 --gpu-preferences=KAAAAAAAAADgAgAwAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=6816571592410877204 --mojo-platform-channel-handle=1712 --ignored=" --type=renderer " /prefetch:26⤵
- Executes dropped EXE
PID:1200
-
-
-
C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe"C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe" install -15⤵
- Executes dropped EXE
PID:448
-
-
-
C:\ProgramData\Comodo\Installer\ise_installer.exe"C:\ProgramData\\Comodo\Installer\ise_installer.exe" /quiet /chid=138430009 /aff=1384300094⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\bin\ise_installer\isestart.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\bin\ise_installer\isestart.exe" /quiet /chid=138430009 /aff=1384300095⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3772
-
-
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
PID:4104
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Drops file in Drivers directory
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4864 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding B60015E0CC1D9530AA12A52E442520A32⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4056
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding DED15801750B5EB2FE055BA06A4D6C91 E Global\MSI00002⤵
- Drops file in Drivers directory
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2432 -
C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --langID 1033 --createConfig "active=fw;dplus=opt;esm=0;av=0;fw=1;cesfw=1;cesav=0;cessandbox=1;free=1;noalerts=1;cloud=1;sendstats=1;configfile=;fwstate=0;dfstate=0;avstate=0;bbstate=0;avservers=0;standalone=1;useblob=1;trustnewnets=0;"3⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
- Executes dropped EXE
PID:116
-
-
C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --upgradeBackuped=""3⤵PID:4936
-
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r3⤵PID:4744
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o4⤵PID:3080
-
-
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r3⤵PID:1292
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o4⤵PID:2888
-
-
-
-
C:\Windows\Installer\MSI28F3.tmp"C:\Windows\Installer\MSI28F3.tmp" -rptype 0 -descr "Installing COMODO Firewall" -logfile "C:\Users\Admin\AppData\Local\Temp\COMODO Internet Security dbgout.log"2⤵
- Executes dropped EXE
PID:1480 -
C:\Windows\Installer\MSI28F3.tmp"C:\Windows\Installer\MSI28F3.tmp" -rptype 0 -descr "Installing COMODO Firewall" -logfile "C:\Users\Admin\AppData\Local\Temp\COMODO Internet Security dbgout.log" -working3⤵
- Executes dropped EXE
PID:1576 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:24⤵PID:1740
-
-
-
-
C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --installCertificates2⤵
- Manipulates Digital Signatures
- Checks for any installed AV software in registry
- Enumerates connected drives
- Executes dropped EXE
- Modifies system certificate store
PID:3996
-
-
C:\Windows\system32\regsvr32.exe"regsvr32.exe" /s "C:\Program Files\COMODO\COMODO Internet Security\cisresc.dll"2⤵
- Registers COM server for autorun
- Modifies registry class
PID:3952
-
-
C:\Windows\system32\regsvr32.exe"regsvr32.exe" /s "C:\Program Files\COMODO\COMODO Internet Security\cisbfps.dll"2⤵
- Registers COM server for autorun
- Modifies registry class
PID:2512
-
-
C:\Program Files\COMODO\COMODO Internet Security\cisbf.exe"C:\Program Files\COMODO\COMODO Internet Security\cisbf.exe" /RegServer2⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
PID:4232
-
-
C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --updateHtml2⤵
- Enumerates connected drives
- Executes dropped EXE
PID:4560
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵PID:2564
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files\COMODO\COMODO Internet Security\drivers\win10\inspect.inf" "9" "471514ecf" "00000000000000E8" "WinSta0\Default" "000000000000012C" "208" "C:\Program Files\COMODO\COMODO Internet Security\drivers\win10"2⤵PID:4288
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD57ab2202a75327a097a7f007283cc4ae2
SHA1855a518b2abd49cf5b04c01f9d1abe4b0bb164b3
SHA256d24935b73cc6a95d9a66cc7ef3648c4b8f43192ab14cc2c0bfa6ca992959c219
SHA51233f8afd8316df6071d32f51d11b8dea711895d38f6b0818b61e2c6fde1345782db5f71045354fbe6e7c397a6ad2058c7d309a3b099c331828953bb439448f262
-
Filesize
2.2MB
MD5e8cc20617d1adc73fea895455f744f4e
SHA1f239535c76d475fca81413b2b09c8e4d2930baee
SHA256b85fadce340f8e3aba5db4a095b711a05505ded72378c870e78bddf034f32a51
SHA512a721adf625c8b2d3f6977ddce95d6aa3c15d16360d09d2e2268283ecf038dec303c194ca663f88e473749ece1605c11ee59a19bcf792d405785e6682948792e0
-
Filesize
13KB
MD5facd46953c26cd626fa3f6cb29d60742
SHA1a3672c62e1135d32315d35f5590802ee9258fe64
SHA25641f937e4ebbe896af36bef092ae4ca73ef00ea11000aeff7929ce97124bbc315
SHA512dde68640cd8623aaed04f4b62219f350dea271cf09bf3ebfa7ad10531a05fd2a9d0f14a3a4766916456f9db50c5c8e72ae42093bbff4c5f3683278a3624724f8
-
Filesize
16KB
MD50894672edc430d9d8834bcd33c5ab8e7
SHA16e6b93db3d2f7cd248dcb9ca27b19b762339de02
SHA2567d9fd95b3fda7a9b69becb293426568df783e2fc6ac8b8d84467980b11ac4763
SHA512c8211c18ae431c61e49ab8621175eab75270ed0c8af9cbcbd611ab8c89363bc8cded0ee07744f921b5deb661593c0b42e77379b7d0caf7f75a7dd54c76473fb2
-
Filesize
9KB
MD50e4c8c2570a02b28dd75298c02d3c580
SHA192f340d353318f3723ff3cdeff6821e3b9464fea
SHA25644bee669b086b0c933584c0b09f849e9250fd819bb5d63f467962fda37bfd65b
SHA5127684166ea42a63798b3f8e24a1a14a9c0364c60e49a004991b95963da38cb0032ea73473be22ff98c8f4410bf5523a455dca022b443a54274c4b48a90fbb7487
-
Filesize
11KB
MD50ead33065c4f043ef3d1d37823ab8838
SHA10d937760c7662543a3a80f9f6f9d293845fc7ff9
SHA256109345931feff40c783e54e5d59c3615274e42c6b3cadfa0197bfae3ea3471bf
SHA512d07af8b3c2e848a5c83c14553185aff224fc4bbe3155afa0db2e143be770a9d04282eb31ca7a8a5f91929edee518db4f26aaf763ba8b1cbb0c39f031b448a6aa
-
Filesize
10KB
MD5b1cac70cb032f9a02e1c67ee071c2661
SHA149ca56ae953e12854a8d06a3020fca3c6bec2abf
SHA2560e37da1951fdf219548bc23db3b7e6b4df5c032b062084e3245df90a261aea73
SHA512756dabf14719cb3b385bafd4a65f29122c51415542e72ead072e342190cefe0c8a6a4f0a86ab8e81263ddd78ae1962502cd4c05e3c06befdf11c83194a20e560
-
Filesize
12KB
MD5a2c74563ff6181a6c1092ee2f2fe1d21
SHA136935fefdf6a2c6c991890ee5be3b7f680b5a393
SHA25684171087e7055e3f1a801a6a81cc6e7671e13522a6f9d7d6463251081ce0fdd2
SHA512b1f89f2bb15f71b10992895168e059c2d8c4ba48903ff081d06e2490a8ac98a13d82c4b921f2b39d56b10cb640887df3f089f16ad1fa0a775e4956a221fa7758
-
Filesize
12KB
MD5e22f930a1fd304fd51bf9b6713bfd76c
SHA104424433fd046e3594aee159ee4d777c4de3ed06
SHA2565b125c0f1c6e1980e6befb5713f337715b72ccecf366edf6e9b7ba0d10b9b04f
SHA512b2fbda95c542de99dde2f9d03fe793ecf677ab76fd13ff9677cbb509c6086c817c05d5465069f24279ef8dd74ecdd2f439b6b2dde766b609b61f3cff316c192b
-
Filesize
11KB
MD5791994c34e987f6ed90de9233b899d19
SHA1aeb724f10ec1d157317512db5e05e23d8be63950
SHA256a93fe19d0fa9931efec4716c56be6d0958fdb5593c0fab7a4aba59ba0e01ab7d
SHA5125f2397dc62bd1550e76af8f8bf451036f0f337525b0926b5eb0fcd3f1fa3f9ca660daac556223d1655fdcb7a053a1b2b3840ab872b152c74b48bc820b37c9885
-
Filesize
13KB
MD5398911eee0c4e38497fcd62a582ec392
SHA15c89bcb4cdca6e169c07a78c3407a4c5f99d8721
SHA2564e25fb1f9e854eea3e0b4924eb9fb7b211f1ed0f99abfb73dc1147370a70904e
SHA512d0eec39769f95a4478e584234d7718041c3b74be79f8cdd1c0e74dad6e933e975986c35e4467b1e06359c2ccb761af23b4982363a65f82e9acff75a58c0d46d3
-
Filesize
11KB
MD5e55e481ea2bd5e34fcee496aa45ee004
SHA18a0dbadb2bd032cd4ba322e85ca7dae45ed86973
SHA2569cb79a35e93453fb8aa852def622ad132873705a0e52b5d9347e5e6ac6edb26a
SHA512d7e89295214b4368423ec1fab23528122b27f1a6cb31298464eeb934cfbbcf64bcf1d9abceaa05378c335065326e694c532b586070ead8af43a4d5cdebbe191d
-
Filesize
16KB
MD50a057a5ab279eab124c060aac78cae28
SHA18a691c058c097a0f507be8148b3364f941bdad91
SHA25665ef2010d9a453b2a698d52bb7d078ae3ddb469d5006d3199f23b75f2b5e8a7b
SHA5127157a2c10462b272336bad8ecf23770e04beffebe7842e105050c59771f13232c7a26d4ad879fbfa0a68fd1ccf0f2167ca0c786e8d9eefe4133119f951bae262
-
Filesize
11KB
MD5addf389664acba7b252dde919e3da80b
SHA15d5ae70a083df903f5daf19bf6d384553a9b58b7
SHA256010d0dc67d53002477b53597a2bd03ee136d1f41bd5b1fd84b78f0388f195c63
SHA5128f49c50fe3e42550b7960ab315a5abf760ccb7115fa4836ee88b389da80da2186c53272ea1e9f1a7e5a51b73527ddf83f35d0ada9e7754852c7175025dd8c981
-
Filesize
11KB
MD50324e960a6433ef5fca1e6326a5d1cc2
SHA121dc7b7bc2f7396ae613ae6cb2676ad8c7c4a3d1
SHA2566f9e9523a414425c39f0d4b87c632803e6feb7f0e6b3784fba0c8a5823bf8b7f
SHA512bfa224c194bc320aade189e1594449dddaab8f2477271b758f6d3cf6a8eb28c85fa463ee7ff98a08edc1606f224782237363ba74ee91ecdc92fc6631b92395f9
-
Filesize
15KB
MD58e6b03ec680ae4ae559b5dac0003d694
SHA1db4195a601cac1ad09ab82ae84e3023bbf5b2fce
SHA256d5e0962626bbaaef67b1349476e5a4575d71a61aad3c687eb8b7b1dcaa453cbd
SHA512c4775a09c5680d18821819d471404daa0f0df1093b1ad26d6652e882f762695fbbedb26526828364256283fb46ce2b8a8d48f2416c6dc248b04ed3e4ee604e59
-
Filesize
12KB
MD56170ce0de810d31d22546bca729681cf
SHA1eec4c4224ff5965f09858beefc5b3994ed2b8310
SHA25659892e59d6fdf97b01ce7c67c5071754c495af822005b5cb6c2256434c558d3f
SHA512f069a0ca94a4aec4bb8edaf2e12e3523130afc240eb3db67b29cce1285a4673d8c727dd30f52f3cef135d17df66f50d7ceedc209e1867c9261beb7779b59715a
-
Filesize
5.5MB
MD550a9b8ada65d917c4470c35a24e5321f
SHA1cf7b45814560418fdef69aaad2f0bc348f95aa78
SHA256604e6a806d37c436b5858d9521d52f18bb779caa23f7b79d534de19d141a2d8e
SHA512b69049aef1f1f80e6a4494d265ea65e01a979b3e9521966a5f608ace6c4fa05e7cf3d4f44260d2f38d7f7ebd723221867ccdd8e31d7f728de18151fa2d8e367d
-
Filesize
34KB
MD5f42c56a1f750bdf43155a2aee0f1407c
SHA10929dd9594fccffe5e7e43ea33a5eb6467afab0b
SHA25686e8a71d1327fe5f26901c8a7d10bac322dce1ff621e1339db9c7b6ab905244c
SHA51231dc56d6455391a0075ab59d438335c9d38da43e1ef974bcdf14be059d63d48f8a8f7a1f6cd9eb5e790519a3824f59387abafef48417bbeb74e34b526646b8d9
-
C:\ProgramData\Comodo Downloader\cis\download\installs\8050\installer_data\eula\eula_cfwfree.html.tmp
Filesize171KB
MD5b655d81127550b07fbe2ac849e6e1e42
SHA161fa51e4c9f01d5c7302a8a9ac6c43bbc665c45d
SHA25632ac5b1265a7cae273baab2be295ee71a9033ff4233bf92630872523770cc241
SHA5124a8d05f7488e6bc91aa545618e1d6dedb7508bcf7d635777e2f67c82fcc40e29116924598ed563c7778c32e6a837a5f6467d8d4c01ae282a84b89783fbde9571
-
Filesize
85.8MB
MD5014f6ae3cbd1d846f5fed7bc561d364d
SHA10e13d9ebf0c307644055951b5218960307aab5d8
SHA2569c736311fc8b836d6669f622b455bcfbdf2c49a43014dd17f609bb2d3d956f76
SHA5120c6d29c1b62f0bd6e46424fd06f7573e29f939869c7465bc3b1b2227d2e3da555a2f0efe0f0b5c29d91ab90fa849334175aa514c295c30b91e0ef20617692338
-
Filesize
21.4MB
MD532fa4e3390021ae105de063415d390a0
SHA199a3e39ec6bddbf5b58357990b94af09d2f84418
SHA25688d900b98b0dff13709d2ce87af01f56471fc8395b4f3b1953fc012f5ed5096e
SHA512720c0f9446104c0bea9fa5468b106a0d2335f25c5d42dcfb9885a9b852d0365443df70422e6ff14c32bb95117cb06e46a63ed9c7e1fe7eda53795e97d55e5cab
-
Filesize
19.2MB
MD5c480a24463f267eb0c296ecb3959537d
SHA146a50a80f3782a7c8b6a36e82fd62426967ffaa7
SHA2561345a70ac692091fa0e507096c4f659d5d8f93f91b15c2e697f05b94cbe9bcef
SHA5121c24e26687e42195ec8ad26bb65d06c1f8f629176ceba544d95335885403901c2433bc0db40844b3186bb15bb77bc9a579955c1e496145c9a3ac16a175b993d2
-
Filesize
16.5MB
MD504b4ace2858a60bb6d51b3570b7552d2
SHA1ffe17de296653abc914a4ea7e2c89b5deb9013ac
SHA2562136e8b615a315bdc7991594fd1f37ea8dc7533388cd449475e771bf97694ef2
SHA5127c6dcbbb8c47cb593e07bc61ea7af3f24564538fba674801eb17ceb20ffef04a9ad2f02da6f2ae6e1f3735e69719543aa799832fa0c52112c4b77abcfd4c7d03
-
Filesize
4.3MB
MD5bc5be4070c49a53b67f38e6620c47b99
SHA13979c599941b75ac693b4fe8ebe8bedde2a809e9
SHA256ec3e0dbb7d9c14bad85c80367d1ffe777ceaa19dd8ef9e75d6c12c4c3902ec83
SHA51292573222ec9502036c55f672cacd4a133b896cc38d9b3d6dfab03233241cc5ead5b25880ba5cbd196eefd31a597df2ea2595df323f000a7ac858ee718225b9f9
-
Filesize
20KB
MD506c0057d77fc4789b1428dd6710cd5ab
SHA1660445d67f92e84ee9aa96a7aa6cd50ba43148ca
SHA256e3a998c06b37cec5570409e0714af72a1a936759b4420adf1b0dfaf43bb7218e
SHA512497a86bd35149465ef3ce3d7b483a3d4950475963a9cc20075f4f92a54b05fbffa97b537b256c9bcc31a3a20f4229d33ceed45f6bd30fc9057cf879bbb368a91
-
Filesize
131KB
MD5ce1f7f1ec218784c28fb288752e06cb6
SHA16379efd953b3e080d66fdcd3b85a9702c7b166b8
SHA256dccfc0f8e3af2bcb462da2d9273e024ac49cb71d348b9ac797827b24e7b143c6
SHA51282b72ebe4d35f22f7d9506e6c98d55a2728d41372244dd269aff6f2611ae2cc55c678d5852beff28328423d1754173bc032770ecccadc140cba546e44ce48146
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5F26A2159BA21EA573A1C5E3DE2CF211_7541962669C96CEAB06421EC12621007
Filesize766B
MD52e5fa4187fb6415eecc96ad803ef7a1f
SHA168b78c4f61f4d520b33f57cafea093af55d908b7
SHA256b062016459e7153d726d2c02b9cce214725a628a07750b54478e9ff30fe0e6c3
SHA512bc01349a89f2ef26f38e9eb075eaf6a11c34a0fe52a493d3b24d1d79ce81e797e5588e5e67dc32efc73a6f3a173c7f6e05de25f39e28217744d0702ae0d91b13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D11549FC90445E1CE90F96A21958A17_941A5BE5FAF3230B9FC294754AF2A1C3
Filesize509B
MD5fea8620759cc1b00f3bb49e396daf6ce
SHA11858314388b1a18502a21d96acf2461057512e0a
SHA256d55895833630c4627a1a796bb8c276ec08ef9c385ccea58b5b6c77186602efa2
SHA51233d7131b3a8f71c7c2f8defe2ac9f83f1b3e8cf64aa68109c3c991d4daa0941d5f1a15b929dcbf899d2f21448a6b5e4981f06eb7c149af1af8dc759f8c4d7532
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5F26A2159BA21EA573A1C5E3DE2CF211_7541962669C96CEAB06421EC12621007
Filesize484B
MD510e3fab9c6b835772ad4eb15dc8adffb
SHA193512c8e4b017b65fadea130bff0752763843fad
SHA25611ce2c2cdb53fcc8bfe7ac4bddff91f6b62d0cb85107a4f5864947ebcfd6ade4
SHA512ddee34464df065d7fcd011e5895c046d7b16acceb2d28ad9aeddbdca65a0dbc08472d7fc91c6dd1e7d537a5c56791a1ae1c55d48e8496ce143d2a48d8b97f16c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D11549FC90445E1CE90F96A21958A17_941A5BE5FAF3230B9FC294754AF2A1C3
Filesize490B
MD5e0e15f56ada3d8460e71fd249dab1b73
SHA1e2fbd6b250a73bfb94eca04ac4ce165332cde685
SHA25656fc331575fdb5553a0bbbcbb45a245136f8092bd849d85931fea0461ebf0a6c
SHA5129ec78cd57f51f58bfe811bb165b5facfd0583ce6f1e501790889fc5285b32eb89fb32282065f9cf7629fce65245503926f563e9c58ae9b108a31db74df8c5dc3
-
Filesize
40B
MD5c30b9ca88016a30b47fb0f85afe4899b
SHA1bacfd46387d8c38ed7d8569d62696f3538898ae3
SHA25691a42191c4776044b31bd6c984e6e92c73c9f6b156eb8bb28ad2ff638a1a027b
SHA512486bb0af8a1448491e2448558dadd87a321e9d21df87216be7752333f70bf485bc7640ce162d9a224f5dcb438917d7cd22f877913bd6826934849acaa434b3e3
-
Filesize
1KB
MD5d7b86887841214741b59522e5cd27fd3
SHA16edb6a7f0138378a2a56015852d6c6f1ace3f37f
SHA2563c5d10635e419eab97228306a7cd531267ce5c162866728298be4c82eea7339d
SHA51212114e8956540dacc4b4d6767c8e090d560edfabc203f9fd9fd8416db97e99d2fd0547a4a798ffc7954e60b63b047094d40b7517a18502b0d3e42fdcb6f86d11
-
Filesize
277KB
MD57baac18fb157c76574ca3d7a2f5eb193
SHA16460577ce621fa28133096073376f6a88f8acd61
SHA256347144ae998d96c6b8664abf56f3ff8cfa4dcdfd6e13205d7e8ee2f3b77eefc2
SHA512513cc213da81db470f8675c29162f4b724bb92a690edd451025eb68588971eebb937f88cc5a659222f2bbbd99440aa56800bf4167bb8912ea87a0b2648b002ea
-
Filesize
4.2MB
MD56d9aa26bb18af69dc74ae8e822eb53dd
SHA16ef20da9b9e70afa742f047f1c6f9d3e58290450
SHA256cf140523b8834de1c37efa29b02adcdc88babc0f8ee90ba93dd98c260d7036c3
SHA5123a9e8f15d207e98bb182f8d1838e93dba9750e6cfc79b72aab0706f969866447e50b3ab28bc1768a7cac7e7733cde80085cabcefefae0d287f08374578935c36
-
Filesize
5.7MB
MD574cf93a3d559a630911fc94568b99e1e
SHA1a5f164154e164174c715e493f440b1935ec53af8
SHA256fe82eb2103b177370e742aee40a2b840805516ff23867f6b9bd3655a401eb50b
SHA512c000d512e270d7f89058fe52a3ecfac6f60462eed21b134ebb57640cc6425e7ece9b6ce683acc666d8358875c8d621497a8e3eb95b4ad72311efb9d12c03100a
-
Filesize
367KB
MD5a4b3e07a9d407bca7a0ed76ea7c4945f
SHA1af16d87110e2f9e64d5c35a6d522151b69377bbc
SHA256b115a17e7500dbc34cce1f8e84a59f072a26ad49be5dcde6ac5908e4d2ad3555
SHA51277c6ba298f5bd4c04192660d365d2a45ecb23fa441818735bd01050677037e1976670dcb457b6684343fbccb02a6fcfd98f22ae9f2de263057157917ee28d981
-
Filesize
5KB
MD5b80eda6258e28b537651f8e5ebd997ff
SHA1826741e138e8342f4bc3303838e347a44bb93546
SHA2566e960dfed451c2dfb99352d25d3df8dd46fe7d80c9af79805c0cfbd1a99a2709
SHA5129fce1cb5fe8b6a2bc4d13c1ca3ec31c926c6dd33717f145da6952ae33144eb11a6ee9e751e1d3e2d5d6ce7768e9f9602773a917d9f5f8473670e6d631b932b74
-
Filesize
764KB
MD57b85f91536c8342ac64d3edece2af7fe
SHA11e28c62364f606f03078e985222a2e3400a483c6
SHA256918e7aad857776a895ecdf850665c355026882bcf1e0eba279ff4f7aa4b6bbae
SHA51242cbaca95018eba8b05d3d586dbe8537ec1130af9edd813c4e7affef88c804a4ae65d9a446a95326508cd21da03a7e6a7969f6de5a68e69ce86c827f4308ac5a
-
Filesize
2.3MB
MD5ae9a7049b38b22598e09b9b64b850d1a
SHA1049d9e0d1dc4c3223c2a2e7725d05aadc030ccf7
SHA25663bb102753c6208306d86e5f6eac009d0b9a60c9882b5265d0c7fd3b44614f0d
SHA51261a2d549cbd39d05d7d94b89c3d90054c3126fb91195921d0a87856faf121dfc46eb60f20510cf915bf58dc849c15837d3d4202f6df8ad75b0959188d0973a58
-
Filesize
7KB
MD55e61b9b5d4a00d46e3ca69ed3fa73cc5
SHA17b63150c2ffa881afa8c6fd757bcf1238df43449
SHA256cec0e0166640f2d1b6f4ee5b9c94a5e4871ff7ecbbf3b5f51ddd583ae898781a
SHA512c57cc5987d10cb44b0632afa5174eb085d49dd1b04e01e86cdd3d72b8336e798dacf5f098d81f245d112c77d342be3a3c322d437e06ed8dd07100a20da2d8fd8
-
Filesize
10KB
MD565868a2da7e9da98c04fbec508799ee4
SHA11e7fd052862b59c4ac7e5b83cec8559d4b2dcd3e
SHA2561fa1be097355642ca1e544d88c8ff3f8d55bc71d0e0745548c1a67d2acf084ee
SHA51213f7e7298b059ee794638faac9a9069a637fcad78d026f97dde89a80aaedc6a6ef2dda97739090e13d59aeb8eec9f71ef90727dbe67246355988493f94f1bc75
-
Filesize
12KB
MD5e378224790dc97b0b3045a5c5326f203
SHA160ab41d4b32b7778481c8f8e1dfc570dccd9098e
SHA256ed4054fa42caf43da96c6284103c457a0ebfeb58b68a7849d03bc5bae70fedd9
SHA512e08a18d3da16ffc30d9912a64d5fc8c004644a8ab4d96f2d51b2111de2f046ff7d158c678460fb911a363b873476b2c7b725e4f74fbe3927514f64400856bb78
-
Filesize
2.2MB
MD5493664f7387714f6edc32b3f0cf51357
SHA1f033c54d581c996e7efa44bbfd775ee0689b61ea
SHA2560865eaf55253dc9d5b0b94e57147bb6a2577f14959627be13acf4ac1cdbb7139
SHA512b7a055d3cec1b57d7ba3ddf035ef88fcae2682501c925295391919f2d79c264b47986aff9d28f8354379716906d9270deb3d546caa64aeb07dd6e3e69889ee4e
-
Filesize
2.0MB
MD5993f653773ff7e5ba536e65f03fa45e7
SHA1ef2f3bed5504af5fb6373b63c7f8491e190578b6
SHA256af90ef33c9afca6a72c211c08679f0d2f0932f84dffdd8f1d0eef561944cfec2
SHA512b9ae9b2e43e0b228ea7d8b60ccb7d8e7036313f1b7909ee033c44a854a92f3afc5810a5bee535606c95e03c2940ea6745f1008b2271822e4fa31a87f887409d9
-
Filesize
11KB
MD50ff2d70cfdc8095ea99ca2dabbec3cd7
SHA110c51496d37cecd0e8a503a5a9bb2329d9b38116
SHA256982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
SHA512cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
-
Filesize
7KB
MD578b913fcd04259634a5e901c616e6074
SHA1ad5e1c651851a1125bcad79b01ccdcfa45df4799
SHA256e3ce60666bb88c2412615ef9f432ec24e219532dee5cc1c7aebc65ed9ec94d59
SHA512cbe07179dd93011f3d9a8f83541961ff34fb83d96658ac82a433ef0aa3399b183eaec3e6a49ec1c1e478d1eada2d3ebc78ffb1ae0574984ae66a7a9cab5d59e5
-
Filesize
15KB
MD5365e712eafd3fbfedcd9cd711526c977
SHA1e5984443d51c95daa8ad3a7ea8c16e4f8b3e3466
SHA256939e81ad5c29211790e5a1a8f6bea7b258bf37b55224631feb71dd31bb0ef852
SHA512848f2fba59a2c19ee8d98d2ec7f8bc5132014601bb641179eea6d52695290d7ef21908bfd03482e065eb797dcb0f9f87591a9696c1ab399c739cd0348f2a67de
-
Filesize
22KB
MD5fbe588b15eb1bd86defade69f796b56f
SHA12f63cf44039addddb22c2c0497673b49e6b3ad7a
SHA25631144e8b156fe87317073c48a09abcb033fda8dbdd96986c4abea8c00c00355f
SHA512e1a9e29e4c62e77a2ec2c539344f0b5a8cd67ca3fd8dfefb0b0666a992eb2fabadb0034d439c4adbbdffd9c9439f23ee5757fac0ed669d3c9db48f50c677143d
-
Filesize
1.6MB
MD50d1b3d26a9d0c59e8da1d3df6f5235a9
SHA1d4f7c0253c0d8fd02a3cee0462d3912db759b962
SHA256355fd71a76f85e8dc7fa18a007809c4381c2afe887d7a25ce9e1e95070f26b33
SHA512ef0ce0879a1cda3822f7281373e31dd196dfee76ada9645e89332473ba416b691ca3ab710ad4e86dc37de143dd6cadc1b3955f13a318a1c49fd2890660844c56
-
Filesize
200KB
MD538d09762bb34b740f231eb8ef92a9c59
SHA113f4fc057a77ca9a39e15cd706dee793139c3f5a
SHA2565b85665cc8235f51e28ad01652a38a79825d4984508035fc7b783e62e47d66e9
SHA512d08503836bee3e9116b1e3d6f813b8eeb7e45b5f5b6d0a25f61524e3ed08569697e23d28d50b454f13649d2d32c904852cdc3eaca146001ee7fc8d518c4a4ac6
-
Filesize
10KB
MD57c977268ee60fd92ef58849e19431483
SHA1f371323947552968ae0f4439c819d071520c3794
SHA256ea0aa16e6d3ed58fa312fd6b25e252806afa095e6dc121b9ba0e1dc1b089fffc
SHA512f29b97906999133da7eb59b6f92bde043d889bd624a8c692fced43a329a70a3b2725b6cc52d638c64a6896842b7c31efc3b4bbe55d23be7b15358377949d89bd
-
Filesize
2KB
MD5df44c02cbfa857c9bf77a35594391d04
SHA1e018b8c2b3213d4e7ac05d90d0b958e88a8e5953
SHA2565357482e9f2f5dad518e4fc80b2a36c2de2e356cf3bed5ea453afa5a0e748da7
SHA512486a33465bedfd84d66c91ef2fa86810aeaba9e592b6cd759c28a0365d92ca2194494d198f954487744073bb069f03bf9bffbf31ad4c0f1dbded87070859f440
-
Filesize
127KB
MD54e2fa027252a2b9fcf213152d098b352
SHA1a3f07b79417454c0ab0f34ace7d2d309ab941178
SHA256803b69cc009d92c4b7685f718a5cf55cb80a8cc9f648376e9d8d2eef05490274
SHA5123b302f4580e5ff330dc210bf80c52e5e69c93aa1114664d10ee9f64a5d775749587fbb267ceb6b443f02439ef0df8635dd8c3d0eba7b44ba641db9a10a809e3a
-
Filesize
37KB
MD5d3d25a9b82ce6ba3078ee519394579e3
SHA1756e832100613d083de579204c6cbe77be508e0d
SHA25667aa0540e2893d7cdbd04d4ed264e8c7b517530b2c9d12370f65c2473965bf70
SHA5128a1a6c48a8db3614b0cb47fc04f0d964f2097123ac0eca01270823e408ef670334f16a401324dea5e7fd8c40e8204de81c92f318f74dd56f5ce8edcf1ed0bd17
-
Filesize
824KB
MD5188a4a7112d216741adeacab8495e400
SHA1467b7539aa977db3f4a0a460f8788f55b3699cd1
SHA256fd92e07aefa0739cacbac2c2e99fb74413279c4930b9d4f274d580ba52020903
SHA512b776181d6a040f7ee3468e155e0de2417113a2565d7629dad5a37e4a2f744fa1d1ee52e06523f07474e500defb9ed508fb69cb2792986d31704214b75e138a6a
-
Filesize
46KB
MD56cee7521136e5b1eab4f723c44b8a850
SHA187fd9dab6304d19d6c9fefa44ebe5085c60a52a0
SHA2560edd7f07bd14770a40b6895649f0715d234db0137f6456fa7b639e26f768ba38
SHA51218e23156cc5a1b05e9a4a304442555786569ba99034f33c8b514e47e67609e7504e625680bef9926f8f5aeed3b8a60cb756c857295620f6dd5bc16c93bce862d
-
Filesize
61KB
MD50beb78ac69a1e8b77fe407cf5be9db1e
SHA1932eade3d7ee1b2bcc808b5456f7f82703fa023a
SHA256f755651b14b063cb26fd7f85562b7ed7799bd124a835cd9e6939ff8970fdb908
SHA5122b9c1cb72d3d94acfcd7020b62daa01ab2bd2093d2b423eb70712fc83e5d76363045188dec64554d73d51e73f602c564547e6860dfc2ea8ec259272ca676cbe4
-
Filesize
248KB
MD5809642a2a3b54e3026aaba7a65bcea1e
SHA14a631c9316e89cda4ecedfc046d3d8d02ee0ce75
SHA256524581b6a48d8b40b13da7057623896dd8b4d099ab3553f395db4d91a3d282ae
SHA512bcaeb67260b44ef2d4fc04d43a8eefa2da5bf1868c54781da2221cddb2520afedde6b7695874ec0a2deb74b22ca441b79cdf8d933e7474327d35d5dea947d9db