njrat | 071fc19802f6780857fc4a516f64df6673cadba104828d7b2f11ed5fdf8e43c3

System Information Discovery

Processes:

90b0dacdb9974cb1f970960e3c082167_JaffaCakes118.exeofflineinstaller.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	90b0dacdb9974cb1f970960e3c082167_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	offlineinstaller.exe

Drops startup file 3 IoCs

Processes:

Google Root.execis.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\59e66e4fd01ed7a53bb65713760bdb7d.exe	Google Root.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\59e66e4fd01ed7a53bb65713760bdb7d.exe	cis.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\59e66e4fd01ed7a53bb65713760bdb7d.exe	Google Root.exe

Executes dropped EXE 37 IoCs

Processes:

Google Root.exeXcitium131.exeXcitium131.exeofflineinstaller.exeMSI4B21.tmpMSI4B21.tmpXcitium131.execfpconfg.execisbf.execmdagent.execmdicap.execavwp.execavwp.execfpconfg.exeedrsvc.exepython_x86_Lib.exeITSMService.exeITSMAgent.exeITSMAgent.exeITSMAgent.exeRmmService.exeRmmService.execfpconfg.execis.execis.execis.exeedrsvc.execmdinstall.execmdinstall.exeedrsvc.execis.execavwp.execavwp.execavwp.execis.exeRmmService.execfpconfg.exe

pid	process
4040	Google Root.exe
944	Xcitium131.exe
5076	Xcitium131.exe
2840	offlineinstaller.exe
3832	MSI4B21.tmp
3592	MSI4B21.tmp
516	Xcitium131.exe
924	cfpconfg.exe
1076	cisbf.exe
3640	cmdagent.exe
2708	cmdicap.exe
1348	cavwp.exe
1896	cavwp.exe
4784	cfpconfg.exe
1252	edrsvc.exe
3372	python_x86_Lib.exe
5436	ITSMService.exe
5196	ITSMAgent.exe
564	ITSMAgent.exe
3372	ITSMAgent.exe
5708	RmmService.exe
5860	RmmService.exe
1452	cfpconfg.exe
4900	cis.exe
3920	cis.exe
2460	cis.exe
6036	edrsvc.exe
5808	cmdinstall.exe
5876	cmdinstall.exe
4784	edrsvc.exe
5044	cis.exe
1132	cavwp.exe
4288	cavwp.exe
4344	cavwp.exe
64	cis.exe
2624	RmmService.exe
6112	cfpconfg.exe

Loads dropped DLL 64 IoCs

Processes:

MsiExec.exeMsiExec.execfpconfg.execmdagent.exeregsvr32.execavwp.execavwp.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.execfpconfg.exe

pid	process
2040	MsiExec.exe
2040	MsiExec.exe
2040	MsiExec.exe
4788	MsiExec.exe
4788	MsiExec.exe
4788	MsiExec.exe
4788	MsiExec.exe
4788	MsiExec.exe
4788	MsiExec.exe
924	cfpconfg.exe
924	cfpconfg.exe
924	cfpconfg.exe
3640	cmdagent.exe
3640	cmdagent.exe
652	regsvr32.exe
1348	cavwp.exe
1348	cavwp.exe
1348	cavwp.exe
3640	cmdagent.exe
1348	cavwp.exe
1348	cavwp.exe
1348	cavwp.exe
1348	cavwp.exe
1348	cavwp.exe
1348	cavwp.exe
1348	cavwp.exe
1348	cavwp.exe
1348	cavwp.exe
1348	cavwp.exe
1348	cavwp.exe
1348	cavwp.exe
1348	cavwp.exe
1348	cavwp.exe
1348	cavwp.exe
1348	cavwp.exe
1348	cavwp.exe
1348	cavwp.exe
1348	cavwp.exe
1348	cavwp.exe
1348	cavwp.exe
1896	cavwp.exe
1896	cavwp.exe
1896	cavwp.exe
4788	MsiExec.exe
4788	MsiExec.exe
4952	MsiExec.exe
664	MsiExec.exe
1876	MsiExec.exe
1200	MsiExec.exe
1200	MsiExec.exe
1384	MsiExec.exe
5060	MsiExec.exe
3364	MsiExec.exe
2712	MsiExec.exe
4788	MsiExec.exe
4788	MsiExec.exe
2204	MsiExec.exe
2204	MsiExec.exe
2204	MsiExec.exe
4784	cfpconfg.exe
4784	cfpconfg.exe
4784	cfpconfg.exe
3640	cmdagent.exe
2084

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

Change Default File Association

T1546.001

Processes:

MsiExec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Comodo Antivirus	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Comodo Antivirus\ = "{4255A182-CAD9-4214-A19B-7BA7FB633BBD}"	MsiExec.exe

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/4928-1-0x0000000000BD0000-0x0000000000C0A000-memory.dmp	agile_net
C:\Users\Admin\AppData\Local\Temp\Google Root.exe	agile_net

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

cmdagent.exemsiexec.exeMsiExec.exeregsvr32.exeMsiExec.exeMsiExec.exeregsvr32.exeMsiExec.exeMsiExec.exeMsiExec.execisbf.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31A70E75-5CD1-44D4-A9E4-10650F15B1C2}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\""	cmdagent.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{C288AC5A-D846-4696-8028-2DF6F508D0D9}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{10F58851-4358-4E4B-8494-DF34393F41A5}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B691E6DB-B216-4532-A2F3-1656BAC416FC}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvBoostHelper"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4BC4DEA8-AC1D-48B4-82D2-5E6E808A8E3D}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeTdtHost"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31A70E75-5CD1-44D4-A9E4-10650F15B1C2}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}\InProcServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}\InProcServer32\ThreadingModel = "Both"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\LocalServer32	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10F58851-4358-4E4B-8494-DF34393F41A5}\LocalServer32	cmdagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE4DEE24-6CFC-48DF-89C4-29BD4954B895}\InProcServer32\ = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwpps.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF101135-6584-46E7-8AA1-8FCD1FCA5042}\LocalServer32\ThreadingModel = "Free"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF101135-6584-46e7-8AA1-8FCD1FCA5042}\LocalServer32	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F70CAE4-E872-43DA-917C-71C02CCE2035}\LocalServer32	cmdagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F70CAE4-E872-43DA-917C-71C02CCE2035}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\""	cmdagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BBB01528-20FE-4bc2-9D26-C70E3ABB9CD1}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\""	cmdagent.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4255A182-CAD9-4214-A19B-7BA7FB633BBD}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{E8718E3A-1985-473C-9196-9A39AFB0028E}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{868A55F7-D79E-4C2E-8091-DEA9042B987F}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvSigChecker"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{FF101135-6584-46E7-8AA1-8FCD1FCA5042}\LOCALSERVER32	cmdagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\""	cmdagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67683718-82B8-4557-86A8-E04D169EF883}\InProcServer32\ThreadingModel = "Both"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{31A70E75-5CD1-44D4-A9E4-10650F15B1C2}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{4BC4DEA8-AC1D-48B4-82D2-5E6E808A8E3D}\LocalServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{10F58851-4358-4E4B-8494-DF34393F41A5}\LOCALSERVER32	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE4DEE24-6CFC-48DF-89C4-29BD4954B895}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7D729A7-3570-4902-944A-470C9919FCCB}\InProcServer32\ = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cisresc.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0E9D49D-65D1-4AB1-8235-DF90B6ED8483}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvMonitor"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1850D95-9C38-4D86-AC40-E559BC0E73C9}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvDllHost"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{C288AC5A-D846-4696-8028-2DF6F508D0D9}\LOCALSERVER32	cmdagent.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\LOCALSERVER32	cmdagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7D729A7-3570-4902-944A-470C9919FCCB}\InProcServer32\ThreadingModel = "Both"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE4DEE24-6CFC-48DF-89C4-29BD4954B895}\InProcServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE4DEE24-6CFC-48DF-89C4-29BD4954B895}\InProcServer32\ThreadingModel = "Both"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE4DEE24-6CFC-48DF-89C4-29BD4954B895}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31A70E75-5CD1-44D4-A9E4-10650F15B1C2}\LocalServer32\ThreadingModel = "Free"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F70CAE4-E872-43DA-917C-71C02CCE2035}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31A70E75-5CD1-44D4-A9E4-10650F15B1C2}\LocalServer32	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BBB01528-20FE-4bc2-9D26-C70E3ABB9CD1}\LocalServer32	cmdagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F70CAE4-E872-43DA-917C-71C02CCE2035}\LocalServer32\ThreadingModel = "Free"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9F70CAE4-E872-43DA-917C-71C02CCE2035}\LOCALSERVER32	cmdagent.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{2144259E-4C78-498D-A7D1-A1596E3AD5A2}\InProcServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2144259E-4C78-498D-A7D1-A1596E3AD5A2}\InProcServer32\ = "C:\\Program Files\\COMODO\\COMODO Internet Security\\AmsiProvider_x64.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE4DEE24-6CFC-48DF-89C4-29BD4954B895}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{FF101135-6584-46E7-8AA1-8FCD1FCA5042}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{9F70CAE4-E872-43DA-917C-71C02CCE2035}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C288AC5A-D846-4696-8028-2DF6F508D0D9}\LocalServer32	cmdagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C288AC5A-D846-4696-8028-2DF6F508D0D9}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\""	cmdagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED181758-F11B-4C85-AEA2-199B3DC9F7DE}\InprocServer32\ThreadingModel = "Free"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}\InProcServer32\ = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdcomps.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF101135-6584-46E7-8AA1-8FCD1FCA5042}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4D33F09-D11A-485D-AB08-8BFF862E7120}\LocalServer32	cisbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4D33F09-D11A-485D-AB08-8BFF862E7120}\LocalServer32\ServerExecutable = "C:\\Program Files\\COMODO\\COMODO Internet Security\\cisbf.exe"	cisbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10F58851-4358-4E4B-8494-DF34393F41A5}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\""	cmdagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8718E3A-1985-473C-9196-9A39AFB0028E}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeAvMerger"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B691E6DB-B216-4532-A2F3-1656BAC416FC}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{868A55F7-D79E-4C2E-8091-DEA9042B987F}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4D33F09-D11A-485D-AB08-8BFF862E7120}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cisbf.exe\""	cisbf.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{05E5F178-256F-42EE-9BF4-A7E080F7B354}\LocalServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{31A70E75-5CD1-44D4-A9E4-10650F15B1C2}\LOCALSERVER32	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED181758-F11B-4C85-AEA2-199B3DC9F7DE}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67683718-82B8-4557-86A8-E04D169EF883}\InProcServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C288AC5A-D846-4696-8028-2DF6F508D0D9}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\""	msiexec.exe

Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 45.77.153.162

description	ioc
Destination IP	45.77.153.162

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

cfpconfg.exemsiexec.exeGoogle Root.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cis.exe\" --cistrayUI"	cfpconfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Endpoint Manager = "C:\\Program Files (x86)\\COMODO\\Endpoint Manager\\ITSMAgent.exe"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\59e66e4fd01ed7a53bb65713760bdb7d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Google Root.exe\" .."	Google Root.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\59e66e4fd01ed7a53bb65713760bdb7d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Google Root.exe\" .."	Google Root.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	cfpconfg.exe

Blocklisted process makes network request 3 IoCs

Processes:

msiexec.exe

flow pid process

160 4516 msiexec.exe
162 4516 msiexec.exe
179 4516 msiexec.exe

flow	pid	process
160	4516	msiexec.exe
162	4516	msiexec.exe
179	4516	msiexec.exe

Checks for any installed AV software in registry 1 TTPs 64 IoCs

Security Software Discovery

T1518.001

Processes:

msiexec.execfpconfg.execmdagent.execis.execfpconfg.exemsiexec.execmdinstall.execis.exeMsiExec.execis.exeITSMService.execavwp.execfpconfg.execfpconfg.execis.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\ThemeName = "default.set"	msiexec.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UpdateURLS = 680074007400700073003a002f002f0064006f0077006e006c006f00610064002e0063006f006d006f0064006f002e0063006f006d002f00000068007400740070003a002f002f0070006c006100740066006f0072006d002d0064006f0077006e006c006f006100640073002e0063006f006d006f0064006f002e0063006f006d002f0000000000	cmdagent.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CIS\_Trace_Category_Include	cis.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CfpConfg\_Trace_Level	cfpconfg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\VolatileData	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{6AA9E24E-269F-4675-AE6A-67DF4BEE0E9E} = "1717525944"	cmdagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CavWp\_Trace_Enabled_To_WinLog = "1"	cfpconfg.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\VolatileData	cmdagent.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\ValkyrieApi	cis.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{0D85521A-A20D-44D9-8380-EFB7C9BE423B} = "1717524970"	cmdagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam\ProductID = "cis.paid_trial_free"	cmdinstall.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{B4865C2A-9D0E-423B-8DA7-087F623C4B4F} = "1717525945"	cmdagent.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\Proxy	cfpconfg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\IsLmdbCorrupted.cmdurl	cmdagent.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\InitialInstallation	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	cmdagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{84BA2452-41F4-470F-87E7-D5FA10F8956A} = "1717524964"	cmdagent.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\cis	cis.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{BEBAFD97-F7E0-43C2-A7DF-0D1B5EE26620} = "1717525944"	cmdagent.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\MsiExec	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CfpConfg\_Trace_Enabled_To_WinLog = "1"	cfpconfg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CmdAgent\_Trace_Category_Override	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UpdateURLS = 68007400740070003a002f002f0064006f0077006e006c006f00610064002e0063006f006d006f0064006f002e0063006f006d00000068007400740070003a002f002f0070006c006100740066006f0072006d002d0064006f0077006e006c006f006100640073002e0063006f006d006f0064006f002e0063006f006d002f0000000000	cmdagent.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CIS\_Trace_Category_Include	cis.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\VolumeUsns = cf4da0c200000000e0e5cc1600000000	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\VolatileData	cfpconfg.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity	ITSMService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{67CE8C55-02C1-4517-99F0-282BE2734181} = "1717524966"	cmdagent.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CIS\_Trace_Enabled_To_File	cis.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam	cmdinstall.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\LanguageId	cis.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\Langs.cmdres	cis.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{0177E1D2-4CAB-4DC3-9B87-21397CE42DA8} = "1717611372"	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options	cfpconfg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\ChannelID	cfpconfg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{67CE8C55-02C1-4517-99F0-282BE2734181} = "1717524908"	cfpconfg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\IsLmdbCorrupted.ccsautoruns	cmdagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{6AA9E24E-269F-4675-AE6A-67DF4BEE0E9E} = "1717524966"	cmdagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Scan.{F2CDDE95-E0D6-4830-B297-46FB4154B904} = "1717525349"	cmdagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{77261D84-1F4B-4BCD-9CCC-AEAEE39596D7} = "1717525944"	cmdagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{0D85521A-A20D-44D9-8380-EFB7C9BE423B} = "1717524908"	cfpconfg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\PostUpdateAction	cmdagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\Proxy\ProxyPort = "0"	cmdagent.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CIS\_Trace_Level	cis.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UpdateURLS = 680074007400700073003a002f002f0064006f0077006e006c006f00610064002e0063006f006d006f0064006f002e0063006f006d002f00000068007400740070003a002f002f0070006c006100740066006f0072006d002d0064006f0077006e006c006f006100640073002e0063006f006d006f0064006f002e0063006f006d002f0000000000	cfpconfg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\SwitchOn.{F4C59B28-6A03-4BED-9E60-4BCFBD037303}	cmdagent.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RmACF	cmdagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\AvDbCheckDate = "1717525348"	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\VolumeUsns = cf4da0c200000000e0afd61600000000	cmdagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\SaspSkipOnceInService = "1"	cfpconfg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CmdAgent\_Trace_Enabled	cmdagent.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CavWp\_Trace_Category_Exclude	cavwp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer	cfpconfg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CfpConfg\_Trace_Category_Include	cfpconfg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CavWp\_Trace_Enabled_To_WinLog	cavwp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UpgradeFlags	cfpconfg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{1AB2EC41-A04B-45CB-84CB-11BA5EBA283D} = "1717524919"	cmdagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{B7F04E87-441A-4F26-BE21-C4339F539F87} = "1717525608"	cmdagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam\ModeEx = "0"	cmdinstall.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\AvDbVersion = "36760"	cmdagent.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\BrandName	cis.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CfpConfg\_Trace_Enabled = "1"	cfpconfg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

Processes:

cfpconfg.exe

description	ioc	process
File opened for modification	C:\ProgramData\Shared Space\Desktop.ini	cfpconfg.exe
File created	C:\ProgramData\Shared Space\Desktop.ini	cfpconfg.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

MsiExec.execavwp.exeofflineinstaller.execfpconfg.execis.exemsiexec.exemsiexec.execavwp.exeMsiExec.exesvchost.exeMsiExec.execavwp.execfpconfg.execmdinstall.execavwp.exeMsiExec.execis.execavwp.execmdagent.execfpconfg.execmdinstall.exeWmiApSrv.execfpconfg.exeMsiExec.execis.execis.exeITSMService.execis.exe

description	ioc	process
File opened (read-only)	\??\I:	MsiExec.exe
File opened (read-only)	\??\R:	cavwp.exe
File opened (read-only)	\??\H:	offlineinstaller.exe
File opened (read-only)	\??\H:	cfpconfg.exe
File opened (read-only)	\??\W:	cis.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	cavwp.exe
File opened (read-only)	\??\X:	cavwp.exe
File opened (read-only)	\??\Y:	MsiExec.exe
File opened (read-only)	\??\Y:	svchost.exe
File opened (read-only)	\??\B:	MsiExec.exe
File opened (read-only)	\??\M:	cavwp.exe
File opened (read-only)	\??\O:	cfpconfg.exe
File opened (read-only)	\??\O:	svchost.exe
File opened (read-only)	\??\E:	cmdinstall.exe
File opened (read-only)	\??\K:	cavwp.exe
File opened (read-only)	\??\W:	MsiExec.exe
File opened (read-only)	\??\Y:	cmdinstall.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	cis.exe
File opened (read-only)	\??\E:	cavwp.exe
File opened (read-only)	\??\X:	cfpconfg.exe
File opened (read-only)	\??\G:	MsiExec.exe
File opened (read-only)	\??\M:	MsiExec.exe
File opened (read-only)	\??\U:	MsiExec.exe
File opened (read-only)	\??\G:	cmdagent.exe
File opened (read-only)	\??\Y:	cavwp.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	cis.exe
File opened (read-only)	\??\L:	MsiExec.exe
File opened (read-only)	\??\O:	MsiExec.exe
File opened (read-only)	\??\W:	cfpconfg.exe
File opened (read-only)	\??\V:	cavwp.exe
File opened (read-only)	\??\U:	MsiExec.exe
File opened (read-only)	\??\W:	cis.exe
File opened (read-only)	\??\B:	cmdinstall.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	MsiExec.exe
File opened (read-only)	\??\P:	cavwp.exe
File opened (read-only)	\??\Q:	WmiApSrv.exe
File opened (read-only)	\??\Y:	WmiApSrv.exe
File opened (read-only)	\??\V:	svchost.exe
File opened (read-only)	\??\J:	cavwp.exe
File opened (read-only)	\??\K:	cmdagent.exe
File opened (read-only)	\??\L:	WmiApSrv.exe
File opened (read-only)	\??\Y:	cfpconfg.exe
File opened (read-only)	\??\R:	cmdinstall.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	MsiExec.exe
File opened (read-only)	\??\H:	cfpconfg.exe
File opened (read-only)	\??\B:	MsiExec.exe
File opened (read-only)	\??\W:	cis.exe
File opened (read-only)	\??\A:	cis.exe
File opened (read-only)	\??\G:	cavwp.exe
File opened (read-only)	\??\W:	cfpconfg.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	MsiExec.exe
File opened (read-only)	\??\Y:	MsiExec.exe
File opened (read-only)	\??\H:	cfpconfg.exe
File opened (read-only)	\??\J:	ITSMService.exe
File opened (read-only)	\??\S:	cis.exe
File opened (read-only)	\??\G:	cis.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

94 drive.google.com
95 drive.google.com

flow	ioc
94	drive.google.com
95	drive.google.com

Drops file in System32 directory 64 IoCs

Processes:

cmdagent.exeDrvInst.exeITSMService.execmdicap.exemsiexec.exeDrvInst.exeedrsvc.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC	cmdagent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_45766419D12CD4C47E1FA662463CD94E	cmdagent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8	cmdagent.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6e025dbb-63f2-b346-86c2-0cd48c6e9f30}\ceskbdflt.sys	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416	ITSMService.exe
File created	C:\Windows\System32\cmdIcap.log	cmdicap.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ceskbdflt.inf_amd64_ea937b232aea382e\ceskbdflt.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6e025dbb-63f2-b346-86c2-0cd48c6e9f30}	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	ITSMService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\229169D96B9C20761B929D428962A0A2_E724097EF7BBA8B1CB3228AA4D2ED312	cmdagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	ITSMService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A76F24BEACC5A31C76BB70908923C3E0	cmdagent.exe
File created	C:\Windows\SysWOW64\cmdvrt32.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FA0E447C3E79584EC91182C66BBD2DB7	cmdagent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_0D0888CE7AC1F2D5AD77780722B1FE14	cmdagent.exe
File created	C:\Windows\system32\cmdvrt64.dll	msiexec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7850C7BAFAC9456B4B92328A61976502_99F9D4361C7BB923778316121B0DD20D	cmdagent.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{71c81925-2576-7d48-aa8e-87ac1801cc39}\cesguard.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{71c81925-2576-7d48-aa8e-87ac1801cc39}\SET87CA.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FA0E447C3E79584EC91182C66BBD2DB7	cmdagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	ITSMService.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{71c81925-2576-7d48-aa8e-87ac1801cc39}\SET87A7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{71c81925-2576-7d48-aa8e-87ac1801cc39}\ceserd.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BD96F9183ADE69B6DF458457F594566C_18E66DF19533F0CBCF66A87F266D20AA	cmdagent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_466BAFE78D4077069B6C3828315C7C8D	cmdagent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8	cmdagent.exe
File created	C:\Windows\System32\DriverStore\Temp\{6e025dbb-63f2-b346-86c2-0cd48c6e9f30}\SET8AB5.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E455012CBF4BA8A2AC67618C00590908	ITSMService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7	cmdagent.exe
File created	C:\Windows\system32\guard64.dll	msiexec.exe
File created	C:\Windows\System32\cmdIcapCes.log	cmdagent.exe
File created	C:\Windows\system32\cmdcsr.dll	msiexec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0F7456FD78DEB390E51DB22FDEB14606	cmdagent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CA4458E7366E94A3C3A9C1FE548B6D21_82F29F3EF954016E2EAA30E22D51F9AE	cmdagent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784	cmdagent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\229169D96B9C20761B929D428962A0A2_E724097EF7BBA8B1CB3228AA4D2ED312	cmdagent.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6e025dbb-63f2-b346-86c2-0cd48c6e9f30}\SET8AC5.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_A925FAB5FFC3CEDB8E62B2DCCBBBB4F2	cmdagent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7850C7BAFAC9456B4B92328A61976502_99F9D4361C7BB923778316121B0DD20D	cmdagent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3E3E9689537B6B136ECF210088069D55_C4502B2ED7ABD16FF1FA41F55DB2B363	cmdagent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5F26A2159BA21EA573A1C5E3DE2CF211_7541962669C96CEAB06421EC12621007	cmdagent.exe
File created	C:\Windows\System32\DriverStore\Temp\{71c81925-2576-7d48-aa8e-87ac1801cc39}\SET87A7.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{6e025dbb-63f2-b346-86c2-0cd48c6e9f30}\SET8AC5.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5F26A2159BA21EA573A1C5E3DE2CF211_E3375A509D9058F6A8FFB74D3B4E6F77	cmdagent.exe
File opened for modification	C:\Windows\system32\edrpm64.dll	edrsvc.exe
File created	C:\Windows\SysWOW64\edrpm32.dll	edrsvc.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6e025dbb-63f2-b346-86c2-0cd48c6e9f30}\ceskbdflt.inf	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7833C286363AD25C70511661A83D581_8711B75F5BA6E4E1784F77B325FF96CB	cmdagent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49855FCDFA62840A2838AEF1EFAC3C9B	cmdagent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7	cmdagent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7833C286363AD25C70511661A83D581_8711B75F5BA6E4E1784F77B325FF96CB	cmdagent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3E3E9689537B6B136ECF210088069D55_A925FAB5FFC3CEDB8E62B2DCCBBBB4F2	cmdagent.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{71c81925-2576-7d48-aa8e-87ac1801cc39}\cesguard.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{71c81925-2576-7d48-aa8e-87ac1801cc39}\SET87B9.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95	cmdagent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_0D0888CE7AC1F2D5AD77780722B1FE14	cmdagent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0F7456FD78DEB390E51DB22FDEB14606	cmdagent.exe
File created	C:\Windows\system32\edrpm64.dll	edrsvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_C4502B2ED7ABD16FF1FA41F55DB2B363	cmdagent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D11549FC90445E1CE90F96A21958A17_941A5BE5FAF3230B9FC294754AF2A1C3	cmdagent.exe
File created	C:\Windows\System32\DriverStore\Temp\{6e025dbb-63f2-b346-86c2-0cd48c6e9f30}\SET8AC6.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D2F6556190F7B1A25A117FFB5467EEBD	cmdagent.exe

Drops file in Program Files directory 64 IoCs

Processes:

python_x86_Lib.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\La_Paz	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Australia\Hobart	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Etc\Greenwich	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk85.lib	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\models	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\distutils\command\build_clib.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\urllib3\contrib\pyopenssl.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\chardet\euckrprober.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\macCyrillic.enc	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\CST6CDT	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\Meter.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\ctext.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\xmllib.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\cp1251.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\inspect.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\commands\__init__.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Indianapolis	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\BtnBox.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\DLLs\unicodedata.pyd	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\fixer_base.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Chungking	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Bratislava	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\tis-620.enc	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Cairo	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Novosibirsk	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\bitmaps\plus.xbm	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\urllib3\util	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\pipes.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\exceptions.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\nntplib.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Anguilla	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\samples\DynTree.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\difflib.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\pgen2\literals.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\distutils\command\bdist.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Belize	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Ashgabat	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\EST	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Zulu	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\utils\filesystem.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Nouakchott	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Etc\UTC	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\fixes\fix_print.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Shiprock	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\compiler\pyassem.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\HISTORY.txt	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\platform.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\gyp-0.1-py2.7.egg\gyp\MSVSUtil.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Regina	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Budapest	python_x86_Lib.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.russian.lang	msiexec.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\bsddb\__init__.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\distutils\cmd.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\Icons\idle_48.gif	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\gyp-0.1-py2.7.egg\gyp\generator\msvs.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Guayaquil	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Atlantic\Bermuda	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Etc\Greenwich	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\ttk\aquaTheme.tcl	python_x86_Lib.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\cmdcomps.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\mac_croatian.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\six.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pkg_resources\_vendor\packaging\_compat.py	python_x86_Lib.exe

Drops file in Windows directory 64 IoCs

Processes:

cfpconfg.exemsiexec.exemsiexec.exeDrvInst.exeDrvInst.exeMsiExec.exeDrvInst.exeDrvInst.exesvchost.exe

description	ioc	process
File created	C:\Windows\ELAMBKUP\cesboot.sys	cfpconfg.exe
File opened for modification	C:\Windows\Installer\e5f3d31.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{1EC1BE12-7F79-4002-99F8-CF951EE9D8EE}\cis.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE1DE.tmp	msiexec.exe
File created	C:\Windows\Installer\e5f3d3b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF317.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4A64.tmp	msiexec.exe
File created	C:\Windows\Installer\e5f3d35.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9E28.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI347D.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	cfpconfg.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI26F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI351A.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIA8F9.tmp	msiexec.exe
File created	C:\Windows\Installer\e5f3d3a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1183.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{7DDE78A8-D612-4E47-A356-52EE7FC642D6}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\SourceHash{7DDE78A8-D612-4E47-A356-52EE7FC642D6}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA405.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF77F.tmp	msiexec.exe
File created	C:\Windows\Installer\{7DDE78A8-D612-4E47-A356-52EE7FC642D6}\itsm_offline.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1BB6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI43E9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{1EC1BE12-7F79-4002-99F8-CF951EE9D8EE}\cis.ico	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\e5f3d3b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF82C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4811.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\Installer\{7DDE78A8-D612-4E47-A356-52EE7FC642D6}\itsm_offline.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI808A.tmp	msiexec.exe
File created	C:\Windows\Installer\e5f3d40.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI436B.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE401.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE990.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1EC1BE12-7F79-4002-99F8-CF951EE9D8EE}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4AC3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF356.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1B96.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\e5f3d36.msi	msiexec.exe
File created	C:\Windows\Installer\e5f3d3c.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\e5f3d3c.mst	msiexec.exe
File created	C:\Windows\Installer\e5f3d31.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI835B.tmp	msiexec.exe
File created	C:\Windows\Installer\{7DDE78A8-D612-4E47-A356-52EE7FC642D6}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B21.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA9C5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI982C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI145.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{45CC556C-A03B-42FF-A2FE-000000000091}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF655.tmp	msiexec.exe
File created	C:\Windows\Installer\e5f3d36.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA5BC.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 53 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

DrvInst.exeDrvInst.exevssvc.exesvchost.execmdagent.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c9712a8ab103c3e30000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c9712a8a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900c9712a8a000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc9712a8a000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c9712a8a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	cmdagent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	cmdagent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	cmdagent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	cmdagent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	cmdagent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

runonce.exerunonce.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

DrvInst.exeDrvInst.exeITSMService.execfpconfg.exemsiexec.execfpconfg.execfpconfg.execmdagent.exemsiexec.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	cfpconfg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	cmdagent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cmdagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	cmdagent.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	cmdagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	cmdagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	cmdagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs	cmdagent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ITSMService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	cfpconfg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	cmdagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	cmdagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	ITSMService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = cc1700006b79c1e9acb6da01	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	cfpconfg.exe

Modifies registry class 64 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exemsiexec.execmdagent.exeMsiExec.exeregsvr32.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{98201BD6-E76C-47FA-A0C7-844DC519A4CC}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\CavShell.DLL\AppID = "{E11C8519-5595-4397-B515-AB036DEC467A}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B386E3C8-605F-4CE6-9CFF-A7E628B22752}\NumMethods	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EFFC3EF0-9FC8-48EE-85FB-1EAB811A5CFC}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A70211A1-E8DF-47DC-B336-74BF57292D88}\7.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E2CC28CC-68B2-440E-AE74-C93399CF37E2}\ = "ICisControlCallback"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A56C221-9E1C-4DF9-80AD-D2F1E74047D5}\ProxyStubClsid32\ = "{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C84B9C8A-4A02-41BD-96CB-A874492D159B}\ProxyStubClsid32\ = "{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A8BF23C-A4D7-4E26-92E6-BEBBC70DA914}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ABA12680-8559-43F8-B104-1A19428C61EB}\ProxyStubClsid32\ = "{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{90EC0BDD-7FC9-47C1-ACE3-C3B2B9A8282F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DFA6CCA1-8A26-4298-BE03-252C8B573534}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A87EDD7216D74E43A6525EEF76C246D\ProductName = "Endpoint Manager Communication Client"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4BC4DEA8-AC1D-48B4-82D2-5E6E808A8E3D}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cavwp.exe\" /ModeTdtHost"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05DF1A19-F496-489A-B985-F2E321793628}\ProxyStubClsid32\ = "{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E8321CA-014B-466E-ACCB-9DEF4A37726A}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{379DE05C-2339-463A-9BC1-BDC1F92C0CCA}\NumMethods\ = "24"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1826C627-0ABD-4660-9947-D5817D3153F0}\NumMethods	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A87EDD7216D74E43A6525EEF76C246D\Transforms = "C:\\Windows\\Installer\\{7DDE78A8-D612-4E47-A356-52EE7FC642D6}\\itsm_offline.mst"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E981C6A7-C5CD-4F19-9657-41DBB6C39614}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D03F7261-86EB-4A98-A251-2BA5C0816004}\NumMethods	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10F58851-4358-4E4B-8494-DF34393F41A5}\ = "CisWmiProvider Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1115D2C1-E7D1-4495-9A52-710A45FCA417}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E43FB77E-657A-4E59-94AC-EE6CAEE332EF}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1FE70F59-DA7B-445D-9970-5E6AEEACCE7D}\NumMethods	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{51461081-2DF8-40D5-9CEC-D9DC1CBDD25B}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E47859D8-9597-47FE-BFE4-4427113739A9}\NumMethods\ = "5"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1BB1056-BDBE-47B3-972F-9169F4030C65}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4655A35C-D0A0-47F1-AED3-DE7AAF397EDF}\NumMethods\ = "14"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7BD5E683-3193-434C-BFBC-DDF416AEDAC5}\NumMethods\ = "6"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C23BD847-4CA4-45E9-BF35-458D8F2B488F}\ = "ISvcSubmit"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C84B9C8A-4A02-41BD-96CB-A874492D159B}\NumMethods	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{186EBA6E-1BC8-43EF-8E83-BFA0DF9ECF13}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CA2BDA77-6460-46F7-8B4B-9138C47F1428}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CISSVC.CisExplorer.1\CLSID\ = "{9F70CAE4-E872-43DA-917C-71C02CCE2035}"	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F59E0E1B-1F5D-4CBD-AE67-AC51DF97C4B0}\NumMethods	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F8C8C537-0997-4D12-BD50-9B6C31A4883E}\1.0\0	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D03F7261-86EB-4A98-A251-2BA5C0816004}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50F20026-4FF2-4C2B-8C19-1F37B8072F96}\ = "_ICisEvents"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{962492A7-4286-472A-B50A-C933FFFB1913}\NumMethods	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1BB1056-BDBE-47B3-972F-9169F4030C65}\NumMethods	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{28342371-2B04-446C-A68B-130B4771A1F1}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DD1CBA7-A94F-42E0-B896-4C8346B8046A}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BBB01528-20FE-4bc2-9D26-C70E3ABB9CD1}\TypeLib\ = "{A70211A1-E8DF-47dc-B336-74BF57292D88}"	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6608C38E-B5EB-4433-BFFB-D0DECD7BC1AC}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF101135-6584-46E7-8AA1-8FCD1FCA5042}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{51461081-2DF8-40D5-9CEC-D9DC1CBDD25B}\ = "IEnumObsoleteFilesItems"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31A70E75-5CD1-44D4-A9E4-10650F15B1C2}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0FC72786-07DD-431C-995C-93858B75575F}\ProxyStubClsid32\ = "{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\TypeLib\ = "{E37FA5BA-9E34-49AE-8C97-2C9E537A5D24}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2CC28CC-68B2-440E-AE74-C93399CF37E2}\NumMethods\ = "5"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EE60D0A4-6690-4EF2-B811-6E1CC3271D65}\NumMethods\ = "24"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2CC28CC-68B2-440E-AE74-C93399CF37E2}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{12473B3F-F0FB-4577-8EB4-0F5BBDB3DD4D}\NumMethods	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1A209FB0-3797-4430-955B-5EF4320081B9}\ = "ICisRmControl35"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{46E040B5-3395-4B9A-985D-E498640315AB}\NumMethods	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5007103C-3A2D-416E-91B8-0DE02362E442}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE82AC8D-7DFB-43E2-BF84-C8E3E52CFB28}\NumMethods\ = "17"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CISSVC.CisAmsi.1\CLSID	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EDEC89D0-308C-43EB-9401-07A86DAD7DAC}\NumMethods	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A87EDD7216D74E43A6525EEF76C246D\SourceList\PackageName = "ITSM.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBE300CA-7532-4515-AEBD-392BBBEAE404}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D11E551-B3C7-4E88-97D7-F76E9F716AD6}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	regsvr32.exe

Modifies system certificate store 2 TTPs 64 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

Processes:

cmdagent.execfpconfg.execfpconfg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E73C45BE88C6FBE7562D8B9D1B7E4FE03E29811D	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E73C45BE88C6FBE7562D8B9D1B7E4FE03E29811D\Blob = 0f000000010000001400000059ca050be20779c74b6dd1634db95e0d7ac8e6d5030000000100000014000000e73c45be88c6fbe7562d8b9d1b7e4fe03e29811d200000000100000068050000308205643082044ca003020102021039f51ff05883bd411616bfa62c1c74ef300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3134303430313030303030305a170d3135303430313233353935395a3081b9310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303117301506035504090c0e313235352042726f61642053742e31223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100efe97b1f62481eb08572c14dac7faf5de0544ca4e0b636be10f09f0481ec5f08176888bc5da73ccf1debfba8d16449ad4ca6f017d01cdb3b41ff05b193438132cf6b7c6b90e35289c67281f9cb59d25cf067d17cf3f325384aa1e4f066a193559119faaf864cb6998d5f12109c938c6fe76af32817a3cd004e87fd0d055439886eb41734f78c1e9059dc7de0a2e4839b83441e7b5cd2c2e90628aeb7803567b321950f564557d13ede1519afb734e6bb4d6c1bddf59070342b7f478dd5efc6efb488c1dc1e8acb86fe60fc433070c560e76c30bd74661f1ff91cafb763c8fd32c041752d01fd0df035fb57ef7f4d7117fe4377e9a382540142fdd2441d00f1f70203010001a38201a33082019f301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604147835e6598d5572201de9a55f8a527b1e51ff37b7300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30180603551d110411300f810d636140636f6d6f646f2e636f6d300d06092a864886f70d0101050500038201010039881a7fb87fae796492551ea2dc77b2a01f17e98a2a584ac9f72d0e8f2740f777dba416b35bc88cf30b4b8b05009892ab13e0c4fc7cbe9a177bffea416446d39b6cf91f65967d23f907549ff56a424b307a9a9c48eacd8b9cba65be4ca3d92baf5958dd58c6e41cc35699a17e899a7a8d6df61c2149c629af40638d02613298d112c3597122ae120dec12f2537d585ed9525f4b64926903fba082a7c0f1f04517477a17ab5ed1f9ec2bc7e7154ad0c1822952de2d1cd7ad2cf3929d67a8b491f9401339ca7bcc3d81ee5b93b5a6c5a4bbad53cbae560cfb54fb39ab932d32280a25cbcd9850b68ab6361b04fa2a2ec9b09c5cc8842b832f72e4e919fdcaf5e1	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\31D019FC7AB697D57D9C4AFB340ED7C4D10400DF\Blob = 0f0000000100000020000000c6dcba6192a502eb4e7caebea466be00c8abbf2269740faa6156a5341ba0a2be03000000010000001400000031d019fc7ab697d57d9c4afb340ed7c4d10400df2000000001000000250600003082062130820509a00302010202101b427b060e2866bfb586cc267e1c3eaa300d06092a864886f70d01010b0500308191310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564313730350603550403132e434f4d4f444f2052534120457874656e6465642056616c69646174696f6e20436f6465205369676e696e67204341301e170d3138313230343030303030305a170d3231313230333233353935395a308201093110300e060355040513073339313038303531133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b3009060355040613025553310e300c06035504110c053037303133310b300906035504080c024e4a3110300e06035504070c07436c6966746f6e3116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100ad390c8bc919005d5894a91a9585ef887fbd7c2341ff5ebb3efc6f645a66c55e6da11febce740e53ed9416284dfc7d142e4dc21f99753b5f60ae9aadc764b59efd9ffd33b20ae1c54eba629408a1b095a59cf4af0ad9db9bc494250154dcd0edefcec62e4b248d9a793b703aa15255baf3553fa59d4dc558ba4303af630bb626cd6627e0c4a45764ec3b286c38ab2499f9dc13eefdffa7841297ff533b47061b9aa3ff09ee3f04a7b10ba70894e53f3352b1f60eddfc021a66546e3392795bb6ae49a92f189ec2a7cdd9a935fab33a5ce7fc16c4b7e8ca13b4551d38a6a7c0658298a5adf5f6796675f58e1bb4ce410ff704bc5e845bc1ef83c18a0d50e137370203010001a38201f8308201f4301f0603551d23041830168014df8ff3200ce9caa604d85b58372a3dab46dc8349301d0603551d0e041604142d99b81962209042dc650eb36ec07ad996e48c4d300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010601302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f43505330550603551d1f044e304c304aa048a0468644687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e63726c30818606082b06010505070101047a3078305006082b060105050730028644687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30440603551d11043d303ba02306082b06010505070803a01730150c1355532d44454c41574152452d33393130383035811473636f742e7765697240636f6d6f646f2e636f6d300d06092a864886f70d01010b050003820101007f4d3e6594a3e380fac36b00e97ccacce4786be2ecc13cf37e737aaca0328bb8bfdcd513daff94aba1c7ee00cc8a3bd073157a812f6e31f772781d0bb922a8b86932b296c2312cdf3b239c42bb443b4b1b89b36de34a7fae65ac63eb6ead8812f8d373fa6f1a4e8d9e62eb004caae3639e41e08ed48d640b04725b09b4411dc083587e7fe24b33d90677677960efa6299cc85c4b2bfae4cdfe36581d25e029f6af1a7e77f502882d87597f3cc5bb450a71f9fd57f43b321baa4cbe5213a48a2c5b785a9de4103d5029e4db79403e98784e51379d45a86996b183469e98470731d1a603eaa443a05527aca62f51631722dc0dfe5d74c8298d2aed885d34c9be61	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\8D170F91DE1907BF03CD9F1DEBFEF61E3D3670CC\Blob = 0300000001000000140000008d170f91de1907bf03cd9f1debfef61e3d3670cc2000000001000000130500003082050f308203f7a00302010202102c01585522e8fa61138aefa4f627eea8300d06092a864886f70d01010505003081b6310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f7270612028632930393130302e06035504031327566572695369676e20436c617373203320436f6465205369676e696e6720323030392d32204341301e170d3130303330323030303030305a170d3131303330323233353935395a3081cc310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a6572736579204369747931283026060355040a141f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e207632312830260603550403141f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30819f300d06092a864886f70d010101050003818d0030818902818100b78b6ba1d6ad632f49c5b7ad19ac17479b5bb3d66034124eba28c27dc98235f41b4996e53da458d3a5d5b7539f44126b203fbb8a9201b13d7860c645f83f2633f8d9e08e2a424f3ca50e48aae25614645c3fe3fea64764476478569e5e0a617568cb78a79f933cc071fd9a0aa0e74371f184a63bb6e82962416ac3c6263602890203010001a38201833082017f30090603551d1304023000300e0603551d0f0101ff04040302078030440603551d1f043d303b3039a037a0358633687474703a2f2f637363332d323030392d322d63726c2e766572697369676e2e636f6d2f435343332d323030392d322e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307506082b0601050507010104693067302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303f06082b060105050730028633687474703a2f2f637363332d323030392d322d6169612e766572697369676e2e636f6d2f435343332d323030392d322e636572301f0603551d2304183016801497d06ba82670c8a13f941f082dc4359ba4a11ef2301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d0101050500038201010023e7d8b884c4cb85444c8cf519168ad5377a4c6cd1210690ef8ff7e3c1d26395f54eec8be2e3673c46cf0e7dae32818bad45ed786d10d63c968001c35f455b3f828cd7f8cf995c6b7bfb2bd915c802f49ec9c5a74870af2740950fc71d8cb7512bea2ff1ad13e9f3615fc515c8fd35b0df32293ef5be1c660e544682d2b12968d0ea991f1ce83d69127de6e9b90898536f6d2d2e345a5174b970694af8415a9866a64c786047627717e382a445877348cfbcc631c2fba28185efbe4ae5bdfa9b7c682ac66797c80528aa9ec74d05eb6d6c1b376b439fe312329968f466e345f16ff92c7cbcfa6a6116cd1cfba2bf32c066c2c8181028a315914824130b95abb2	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\03D22C9C66915D58C88912B64C1F984B8344EF09	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\F5F8EEAC5A0127025E936C01493D1C11D5012BA4	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E73C45BE88C6FBE7562D8B9D1B7E4FE03E29811D\Blob = 030000000100000014000000e73c45be88c6fbe7562d8b9d1b7e4fe03e29811d200000000100000068050000308205643082044ca003020102021039f51ff05883bd411616bfa62c1c74ef300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3134303430313030303030305a170d3135303430313233353935395a3081b9310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303117301506035504090c0e313235352042726f61642053742e31223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100efe97b1f62481eb08572c14dac7faf5de0544ca4e0b636be10f09f0481ec5f08176888bc5da73ccf1debfba8d16449ad4ca6f017d01cdb3b41ff05b193438132cf6b7c6b90e35289c67281f9cb59d25cf067d17cf3f325384aa1e4f066a193559119faaf864cb6998d5f12109c938c6fe76af32817a3cd004e87fd0d055439886eb41734f78c1e9059dc7de0a2e4839b83441e7b5cd2c2e90628aeb7803567b321950f564557d13ede1519afb734e6bb4d6c1bddf59070342b7f478dd5efc6efb488c1dc1e8acb86fe60fc433070c560e76c30bd74661f1ff91cafb763c8fd32c041752d01fd0df035fb57ef7f4d7117fe4377e9a382540142fdd2441d00f1f70203010001a38201a33082019f301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604147835e6598d5572201de9a55f8a527b1e51ff37b7300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30180603551d110411300f810d636140636f6d6f646f2e636f6d300d06092a864886f70d0101050500038201010039881a7fb87fae796492551ea2dc77b2a01f17e98a2a584ac9f72d0e8f2740f777dba416b35bc88cf30b4b8b05009892ab13e0c4fc7cbe9a177bffea416446d39b6cf91f65967d23f907549ff56a424b307a9a9c48eacd8b9cba65be4ca3d92baf5958dd58c6e41cc35699a17e899a7a8d6df61c2149c629af40638d02613298d112c3597122ae120dec12f2537d585ed9525f4b64926903fba082a7c0f1f04517477a17ab5ed1f9ec2bc7e7154ad0c1822952de2d1cd7ad2cf3929d67a8b491f9401339ca7bcc3d81ee5b93b5a6c5a4bbad53cbae560cfb54fb39ab932d32280a25cbcd9850b68ab6361b04fa2a2ec9b09c5cc8842b832f72e4e919fdcaf5e1	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\872CD334B7E7B3C3D1C6114CD6B221026D505EAB\Blob = 030000000100000014000000872cd334b7e7b3c3d1c6114cd6b221026d505eab200000000100000059050000308205553082043da003020102021024be55999e338f74f91f0f4570845e51300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3137303130363030303030305a170d3138303130363233353935395a3081c4310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100ed95073c8ec3d17a4c21362d65d31f6835641be6a0d9a9d5072d3a6e00883eea41fca3f5a0b1d74693f49a26b99d2d601292be9cfda68fdaba56544fd75cbf1123626a2890d27cc8de2fbd504f6ac74255481483fcf45458f1887e8d5a3767c1fdb427ea7021ca9709451de51c1fa529f920e478de2d1c19e5e09d0168326d9257f5d4dda80112835171a125a8d34125f1237a2100fe79eff05d78d8a52113510c01f74d43f8884b559a5c1bd70b36c599594bd567fe3a533eadc6450a74e4922d4ccc525ba35a1844c190a6f3a4d34a48e7b852a26ea446cdaf4b8de433dd10efca232a605d88617116c1b632f37a87c3b1de4a317fec53ee9aa87cc9f07e790203010001a382018930820185301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604145cfe6910a18681d46ca19cb26662da9ed10a524b300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d0101050500038201010086d177654176251a873d7a8023bcb603de50958307f4f54da2988e652be3005cf46516fcdbd42e3d933bfc05b7f0f87d4410c12f58f4ec0f1926e9b1a2f525a59575266afac8493dab23ccb9fd4f4fd26dba1db7491789c96c9e2ecf609e6c71d6cd868b9c34be32f99f1f6315656df7b3c10e18e3074bb8da6b8e22a55cebb7b3c79e251a8a53d0d4b7d044fa3d00db8e674f163d60f24d2ab87719c4fef1ea2eb87814e6efe2390dfa9c19f2b57287e048496b7ce9c8b990fe54b58d901bb722cccab45b3cea1322108a15f33392a612de66f646a5b4cf51b3d12d481b86b2a32f59ee94abdc13889480d47c1479930733f69b2391ff1a8455385326054fa5	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\F5F8EEAC5A0127025E936C01493D1C11D5012BA4\Blob = 0f0000000100000014000000682f39d016e5bbf4cddc31964847e835e2cc777e030000000100000014000000f5f8eeac5a0127025e936c01493d1c11d5012ba4200000000100000089050000308205853082046da0030201020210147a12fd3751e51604ae354c04a6a272300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293130312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303130204341301e170d3133303231383030303030305a170d3134303431393233353935395a3081c8310b3009060355040613025553311330110603550408130a4e6577204a65727365793110300e06035504071307436c6966746f6e31283026060355040a141f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e207632312830260603550403141f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100eb8a277c9120c5993641acf5ab7ba26b4946c7da781f59042bade17eae013d296dd6c6958729cbc17bf9987feac0cd3f05dadbbcf9a5ae6b885985cbbb7b7385d1137388939499b437bf8ed45e001b1d70827842edb1b872025f856fa6c57ed017b5d0df789ae9172c424038cdc408a9dc6615369327c9037f1aebad6f1dc57edb1796ba924f77febf6841ea654595ddb7ae00a7c9dde8489da2d54a3cfd8831ecc8ece15eb0a0725d37c548651cc6f5b17880f4ebab1e5e61f3b21afeb5ebfc1d9be5e44695a6e4b90265ab8f3d85d917e919dd16526fce540e96e2d339b246484384dafcc8dcf8c7b5ecceb22ad0463e5e9b72c37b3bc1c095f9e58a4373b90203010001a382017b3082017730090603551d1304023000300e0603551d0f0101ff04040302078030400603551d1f043930373035a033a031862f687474703a2f2f637363332d323031302d63726c2e766572697369676e2e636f6d2f435343332d323031302e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307106082b0601050507010104653063302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303b06082b06010505073002862f687474703a2f2f637363332d323031302d6169612e766572697369676e2e636f6d2f435343332d323031302e636572301f0603551d23041830168014cf99a9ea7b26f44bc98e8fd7f00526efe3d2a79d301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d0101050500038201010005842bf05f73d4686fb6732dae68e9737fef8ce405f98d81530eb83e337c0d5db63fb8a53046401776bae043f46bb1e3af164a76666265cde608d81b37b049125b7c5fae6c1c952f769da55293b0e63ecf8d783ec86ba5c44feabc1867c1fdb1e032e34e118f0bc33095aed6b52f60b3b694c28faf7ea7d0217810c81fc4c41fb2f1e226c8685963910c4d4bd44237f86e0ae5d1495d28ebc6ab142dbd93ff23bed1cc987a1aaf8dd5d6c0ab8b85986b5790eb6d042815ee3a80e65ce71b9ca3cce6ce330c97ff764f6352d2e79f926554429360df991394fe6268865faabb12ef3f87c9f8079f69aad532ce3ed6a2af09f2a39fa123896ba646b2ca5e3c0173	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 0f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\272CCBC264497707D8DBAEF39868F500CD26BCF4\Blob = 030000000100000014000000272ccbc264497707d8dbaef39868f500cd26bcf420000000010000008d0500003082058930820471a00302010202104a708f805e46e4a95ec561404df11189300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293130312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303130204341301e170d3132303232393030303030305a170d3133303330333233353935395a3081cc310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a6572736579204369747931283026060355040a141f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e207632312830260603550403141f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cb75d6a03819b826e841a62bf9dfb81997d8710b4dd05ee4419b27ed8ae5c09796c84801e7eb3af986e43d8bee487d2f0b2a1c86c01564615ede2a366975407e3c6c86fdc460a3c0f130f583888911df7e529d15e2040897cc3c50fca0efccbcb91c8a59b704f7fa48aea6f3cf0726201a65ebe2bfe5dda03ab947bafc82d8318752bdb09b29fec492a876e511c352a44935b7499c99f384d2672496884c42ddc0230354f1040df837f5e1dc3d7a510a3e1a6ad33546a9e655268ad6df7087b987dd8111798110a7080461fb031e3716e383beee54a0d182fa004e982b11e18a56b2d93f5577c69574105af141981e0466a75996ecc44705dc254ff0bb4fe9b50203010001a382017b3082017730090603551d1304023000300e0603551d0f0101ff04040302078030400603551d1f043930373035a033a031862f687474703a2f2f637363332d323031302d63726c2e766572697369676e2e636f6d2f435343332d323031302e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307106082b0601050507010104653063302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303b06082b06010505073002862f687474703a2f2f637363332d323031302d6169612e766572697369676e2e636f6d2f435343332d323031302e636572301f0603551d23041830168014cf99a9ea7b26f44bc98e8fd7f00526efe3d2a79d301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d01010505000382010100606a05f3b174504f923fcc5b4d89643109a2202ec9cd8f1dd8facc1b092b4edcc997e3ec03f8e50eee82b92ebf3e4a2b934dc8c0250307e6cba460ef0b9d57067fea51542488289c721a6031cf4b9a71c65bf200ecb2409ebca5be1f1cc2bf4956f94f6d0614a0ffc076c8f7919807eecbdafa6400d41c45b28c2c72afc86e8a522b5a2c8adfd0a38abdadb8d08b4bec6c25d64540d39caebb6b68716bbe1c2570e92ecab27cc670ce025b7cc21f12a8c1645183710ae2dc2fe385f24ba1a79e122571a64de3afa4c3e8bd9071151d74e0305d4f4e12f86041be1df530d21a00ecad9be7968e99c5f4d4079dc2092375810ebebd5e54e2191ed42a142384951f	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\872CD334B7E7B3C3D1C6114CD6B221026D505EAB\Blob = 0f00000001000000140000005595481af6538298bd0e35edb6d7de5ceee313f6030000000100000014000000872cd334b7e7b3c3d1c6114cd6b221026d505eab200000000100000059050000308205553082043da003020102021024be55999e338f74f91f0f4570845e51300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3137303130363030303030305a170d3138303130363233353935395a3081c4310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100ed95073c8ec3d17a4c21362d65d31f6835641be6a0d9a9d5072d3a6e00883eea41fca3f5a0b1d74693f49a26b99d2d601292be9cfda68fdaba56544fd75cbf1123626a2890d27cc8de2fbd504f6ac74255481483fcf45458f1887e8d5a3767c1fdb427ea7021ca9709451de51c1fa529f920e478de2d1c19e5e09d0168326d9257f5d4dda80112835171a125a8d34125f1237a2100fe79eff05d78d8a52113510c01f74d43f8884b559a5c1bd70b36c599594bd567fe3a533eadc6450a74e4922d4ccc525ba35a1844c190a6f3a4d34a48e7b852a26ea446cdaf4b8de433dd10efca232a605d88617116c1b632f37a87c3b1de4a317fec53ee9aa87cc9f07e790203010001a382018930820185301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604145cfe6910a18681d46ca19cb26662da9ed10a524b300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d0101050500038201010086d177654176251a873d7a8023bcb603de50958307f4f54da2988e652be3005cf46516fcdbd42e3d933bfc05b7f0f87d4410c12f58f4ec0f1926e9b1a2f525a59575266afac8493dab23ccb9fd4f4fd26dba1db7491789c96c9e2ecf609e6c71d6cd868b9c34be32f99f1f6315656df7b3c10e18e3074bb8da6b8e22a55cebb7b3c79e251a8a53d0d4b7d044fa3d00db8e674f163d60f24d2ab87719c4fef1ea2eb87814e6efe2390dfa9c19f2b57287e048496b7ce9c8b990fe54b58d901bb722cccab45b3cea1322108a15f33392a612de66f646a5b4cf51b3d12d481b86b2a32f59ee94abdc13889480d47c1479930733f69b2391ff1a8455385326054fa5	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\98D9D6CB8497105298536D86E468DD0323DCF318	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C6C9520866B57431E708BB81342E072205CB5BE0	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\6CD253D636A7B4D0E0981431BC064061A9853ED9	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\AAEEC9D4420C8885AB80A78275A504E13DF78F63	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\AAEEC9D4420C8885AB80A78275A504E13DF78F63\Blob = 030000000100000014000000aaeec9d4420c8885ab80a78275a504e13df78f6320000000010000004f0500003082054b30820433a003020102021100b7b845b45da5c6005dcd7eda4d8c2f94300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3135303430323030303030305a170d3135313233313233353935395a3081b9310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303117301506035504090c0e313235352042726f61642053742e31223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100e5f713b0311badd1b9bfba6140900b94304d8b54cbbd334e44af09addb457a07d451677595b5fd58634ba6de15c31a589307b3f06ae03a71faf301a38adc8b4551eb4a0a5f03b879cfe14c83683cdf303e813af00d7580b8c698930b706f2129b22e07896973e536db15bc595ba61064844c778e0c0c1d311543a4cc0cd3f08d03b8e7f83824e545f7166e146958d8fe0ff8ddd5082b0b7d46d001d6522885f1f9984c5c1c128120e870acc31c791d2a62cef6ecdf28f20f5385f96d59b9ad571e980d1ae120263859e1c184d5a072dc6e84d8636fd795163c3f359050f5aaaaef14c77547260547ead00b06ba4c976cac8345d8582044468a67121fa0bb22490203010001a382018930820185301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e04160414a3e91fb45376d935db1e36a801470ea0c52520dd300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d010105050003820101001dece50ca6750a8c01517ce5d8511a13c14fa76fb2d8bf2c9b4f136522ff18271d12ba269c4bad9c3250331a712998c55780d5e66be856233bf4e30557657568e1e2b0955580a2a14d5cd153df7751e0251d5616a6855a3f1d087b7d1c1dab0ed79aff614d7316fca143eeb791e5e8c48fb4574f1805210704e3957c5802f654b94177bfe5e36353d80125335e7d870cbf0c87d3809f9203a1120e5f196ee5c6fe81128ce392a9d5b0126b2b38447e587c51ab2fb95bd97d3d2621409f074b584f013ba552aba2de6d8a3afa63e164ba9ffc3b19980e36855885a0f66c17315e0302ac4556e283aa970dacffc004f342a9f408c5886bb41e70a1b8a636c24cb1	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\16232A798863E5950F9F44977A033CF91793D8F1	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F14CDC50FA95DFA78F9488E6A96FF0B4011F460	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\03D22C9C66915D58C88912B64C1F984B8344EF09\Blob = 0f000000010000002000000049e1d274c369098b74ade85fdc204a4093683e58a6a4e2d53e386e1d3a3172ac03000000010000001400000003d22c9c66915d58c88912b64c1f984b8344ef092000000001000000220600003082061e30820506a003020102021100909bd8c9e6e31da161991dd98a992433300d06092a864886f70d01010b0500308191310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564313730350603550403132e434f4d4f444f2052534120457874656e6465642056616c69646174696f6e20436f6465205369676e696e67204341301e170d3136303131323030303030305a170d3138303131313233353935395a3082011b3110300e060355040513073339313038303531133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b3009060355040613025553310e300c06035504110c053037303133310b300906035504080c024e4a3110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303116301406035504090c0d313235352042726f616420537431273025060355040a0c1e436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e633127302506035504030c1e436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e6330820122300d06092a864886f70d01010105000382010f003082010a0282010100d9c268a473b03c64865a19f078bd931c10a3f69e1bb034714399f815cc77ddc8bd02154aa978d07f397bbacf382809acbbb80bee3079b1d7337e1590e95090fa820fd775ecbcceb3aa37a5dfaa002e0a11bab6eac483086de41eaa09b76bc84c703a5abb4416d27a9d91a162274264b68a44faeba0676ff317d4976688b0498b4a0fb721e82b66dd4ca0030261f9d50b34b74df3eb8241344a1fe67b8fb74fb9d9ca7a0ab5dfee12c247ac5a971f02a775b5817c7567fa329163bc346070b0c429e678f0cb1789488878a1b934f7820d6e5687da101b3f85faafc631122c7f12131fc472a0a585b40d490ba440cf36f3f289f70fc507788c573bb2cad81185770203010001a38201e2308201de301f0603551d23041830168014df8ff3200ce9caa604d85b58372a3dab46dc8349301d0603551d0e04160414e44bdb3217f4a88a2348bf0c261f3d65858737fd300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010601302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f43505330550603551d1f044e304c304aa048a0468644687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e63726c30818606082b06010505070101047a3078305006082b060105050730028644687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33393130383035300d06092a864886f70d01010b0500038201010058c500c5a67c7a185c5c643fc2185072f2fdbac641b92017efd129efda442175d7e77f53e87a9325cb6c6fdc0aab804bc1248ecc295fa352bdaa214b34496bbafaffcef1c9822242eb0bda7431015bacade8904e7abe4343bf182a2f1a6ba4b10e9ca843001a25787977095918731bfd850e42373e5c0258693090560c5584b95458b82a90d12876474ba1d3cb93cf8eac26b4fd122890fe0f6bdc2631020242d87646d20731b98a4b735bc9240d2f3c4c12e7825ff3fdbb7af84855892fb292a3a0600534710785897d0666c6f2f7a9b7784a020f9f74acaa0cd8d8651af4e6b1c56e000c97d90fbe64e6f49ef2969bd6dc5e4f5841b148d1ca19118c4c6b29	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\76FBABF1EADED3B91DD7A76A6678301F1F87AA97	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\98D9D6CB8497105298536D86E468DD0323DCF318\Blob = 03000000010000001400000098d9d6cb8497105298536d86e468dd0323dcf318200000000100000001050000308204fd308203e5a003020102021015f007bd5f4ef8079892414f2c01d1d1300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293034312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303034204341301e170d3039303333313030303030305a170d3130303333313233353935395a3081c0310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a6572736579204369747931223020060355040a1419436f6d6f646f20536563757269747920536f6c7574696f6e73313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e2076323122302006035504031419436f6d6f646f20536563757269747920536f6c7574696f6e7330819f300d06092a864886f70d010101050003818d0030818902818100c98a30777f1383df7fd5858ac100e27deaaae1b334d290c2f5c80caf0da0fe0d867093e41a8306582d1645f3227c76e9dd517915d9d934df581873f4e8eb1707eef36402f320aba6fd4a31baecafa515473ea7d7b18275b9527cae10747f2468640e050a260064328393b7ba7a6372af443b24d461e4465c80ab1f720a4936890203010001a382017f3082017b30090603551d1304023000300e0603551d0f0101ff04040302078030400603551d1f043930373035a033a031862f687474703a2f2f435343332d323030342d63726c2e766572697369676e2e636f6d2f435343332d323030342e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307506082b0601050507010104693067302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303f06082b060105050730028633687474703a2f2f435343332d323030342d6169612e766572697369676e2e636f6d2f435343332d323030342d6169612e636572301f0603551d2304183016801408f551e8fbfe3d3d64367c68cf5b78a8dfb9c537301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d0101050500038201010010da5f375376fdc6aef5a9771878d640588ecb4348af3ce8d157fcc3bd313d17d24f3f0cd56417b74cdccd93fefc71f5391c3851ecda633dfb854a4426927cf1cabf5b0577c0e435588889cffa768ee31961b70b287fabcc46d8cd97fcbc6ccb05ebf4bb866693936cfc04e39da95a03002b85ef6136029cf1abd2a645daf6fcaf8f656f52ce020a9c7cb50efd0c7a8870064e739588be196d11a51009ddd1b14ebfa77674f5a83a6fcc3e4944de515fc63bb1f09d4af60412df166dac76f6ffce977a3672c75d234bb6720b86a0e8d7e34070af8ce063ec686463596c71f3eb61bed40332a588f7e2a3a99da776af16bc94e218fdc5af008a304a716c73f624	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\39488FE6BE0D00E76D475BD2902442A541A0E1A3	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\577DB581A72DAC211A2E3E547077529D54671825	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c000000010000000400000000100000040000000100000010000000be954f16012122448ca8bc279602acf5030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\577DB581A72DAC211A2E3E547077529D54671825	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\F89A37FB24B0417D93BFB760B12121F5A358F9D9\Blob = 0f00000001000000140000004af632248aedb7ff558427f06389a5acbf941e7c030000000100000014000000f89a37fb24b0417d93bfb760b12121f5a358f9d920000000010000004e0500003082054a30820432a0030201020210474bf5dfd0395ca926b2f2367e46dce8300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3136303130343030303030305a170d3136313233313233353935395a3081b9310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303117301506035504090c0e313235352042726f61642053742e31223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100b512f8d9138a6e9889f0afac2c1f2402e9fe96acc0b45a85110b39d9d8de6998199750cb863df84a12796591b7f5426bc0f101c0b6afd1bd5e1f14e4c9805e4f6eab19b893342a581e832bcd90776a9eca9ed04acf2776b4e4bcea4f31824e76dd03fd1ad5376c1bfa095b474350ad21c618884680acf98350336c5c21308188bc942bcbdfc456828ea1fa7f1ae3e8b01a4756348120db21f6c32e0b968e65351c1f46db2a0e94fdcfb0e7e0ff8f26c26c1cb649602b0f1a2f5eb3a546f8e713831f6474d9f79c725cb32cfcbc9999520e2b8012fa758548bc909bc1c5adedd904af9ca03de0fbc0a45d7c5ebc571787e1e7d8ff5c8d627368997dce3beffb2b0203010001a382018930820185301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604141221ea3afddda8a617401cf0f7252824021e4559300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010505000382010100067db05f13966dfcef07fa46bc1de610588943d981e2f71f0035cf57df75efed23789498faf85c62ce1ed4f5e8415105ec7febfb50a26ff1c551f7e23ec81f2635b29f444a1db4780623ff96421e2019b125687b083921490d97cf2d281d1e44d114692c61df0da4ff82c7d8820e710879c644fea724977a52be3cb8135e3717d5eb144a07dea4a6a70087ccde43f7f62b8c8cced2887cc7e3b625e02e855840fb585a2066f2bf345a8ecf50a3a443250382cbe9e9177f5f666266a49c68262addcc6cfc25bd66601b5799e459318dcd250b0ddeac26f07e2126794054ff0f97cc84e70741601e7941f0a7a2d62a4ee10723215efcf93d3933517e87b00ef2b5	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\8D170F91DE1907BF03CD9F1DEBFEF61E3D3670CC\Blob = 0f0000000100000014000000aa0ce7c3ca656a11aca42410066480cc1cddda610300000001000000140000008d170f91de1907bf03cd9f1debfef61e3d3670cc2000000001000000130500003082050f308203f7a00302010202102c01585522e8fa61138aefa4f627eea8300d06092a864886f70d01010505003081b6310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f7270612028632930393130302e06035504031327566572695369676e20436c617373203320436f6465205369676e696e6720323030392d32204341301e170d3130303330323030303030305a170d3131303330323233353935395a3081cc310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a6572736579204369747931283026060355040a141f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e207632312830260603550403141f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30819f300d06092a864886f70d010101050003818d0030818902818100b78b6ba1d6ad632f49c5b7ad19ac17479b5bb3d66034124eba28c27dc98235f41b4996e53da458d3a5d5b7539f44126b203fbb8a9201b13d7860c645f83f2633f8d9e08e2a424f3ca50e48aae25614645c3fe3fea64764476478569e5e0a617568cb78a79f933cc071fd9a0aa0e74371f184a63bb6e82962416ac3c6263602890203010001a38201833082017f30090603551d1304023000300e0603551d0f0101ff04040302078030440603551d1f043d303b3039a037a0358633687474703a2f2f637363332d323030392d322d63726c2e766572697369676e2e636f6d2f435343332d323030392d322e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307506082b0601050507010104693067302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303f06082b060105050730028633687474703a2f2f637363332d323030392d322d6169612e766572697369676e2e636f6d2f435343332d323030392d322e636572301f0603551d2304183016801497d06ba82670c8a13f941f082dc4359ba4a11ef2301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d0101050500038201010023e7d8b884c4cb85444c8cf519168ad5377a4c6cd1210690ef8ff7e3c1d26395f54eec8be2e3673c46cf0e7dae32818bad45ed786d10d63c968001c35f455b3f828cd7f8cf995c6b7bfb2bd915c802f49ec9c5a74870af2740950fc71d8cb7512bea2ff1ad13e9f3615fc515c8fd35b0df32293ef5be1c660e544682d2b12968d0ea991f1ce83d69127de6e9b90898536f6d2d2e345a5174b970694af8415a9866a64c786047627717e382a445877348cfbcc631c2fba28185efbe4ae5bdfa9b7c682ac66797c80528aa9ec74d05eb6d6c1b376b439fe312329968f466e345f16ff92c7cbcfa6a6116cd1cfba2bf32c066c2c8181028a315914824130b95abb2	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf5030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e2000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\6CD253D636A7B4D0E0981431BC064061A9853ED9	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\98D9D6CB8497105298536D86E468DD0323DCF318	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\39488FE6BE0D00E76D475BD2902442A541A0E1A3\Blob = 0f0000000100000014000000ec90220b9fc81a6e1bbb4c4523e5adfeb4c56a6e03000000010000001400000039488fe6be0d00e76d475bd2902442a541a0e1a3200000000100000068050000308205643082044ca0030201020210071ae4a2402bb0ad40f3fbd4402b9290300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3133303430383030303030305a170d3134303430383233353935395a3081b9310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303117301506035504090c0e313235352042726f61642053742e31223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100d16dbef9f9b66b60cd10d445259a1340e176ea68a389e786588ea50ddede49f026ee9fadcdfaf92a4d5759e4157f166827acef7aaec040e4ec816905e85396416ae568b0f57672069ab644792bef047fcbb11ec708f7e6e8c06f484b328cfbf769aaaad4aafb9f6c4f4c22e552bbd41b367ad3a5130f06f71bdfce3f295a2eb35c6863496588a6a018ef0205d950bb2aa130263f0e4dcc3976de1c04a41d6f825e47e6d0da838b1454fe7bc35449984bc83e906f76ddc59e70fd00f8393b377dd459a3ed394db48a66dc4b6411d7d65dddbc1a964022d77bb4fe6bbc1a6d39f4832c15dbee8183f2fe46aa57bca4e2df4a3f7843f3bf677abf63c363d39c1b410203010001a38201a33082019f301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604145e313f971a8d01f8288f3edaef539b06c99d97fa300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30180603551d110411300f810d636140636f6d6f646f2e636f6d300d06092a864886f70d0101050500038201010044a773cdd6d5f08fc0a6d76d84ca14d5cb7ff98f2c9b2a9d28902d5d24282fd9fe6e3cad24fa31199ee0f2ef48e973ccb133e9007791b76362a14839b97b80bfefce0accfb9dedaa51e2c3a213114442009d1479088e2beca664c6ade7ba8e3913bdfa8589fc8ac59177ca3705e58585f1887685b89bdbf1b7bc6efa82a2b4ae273eebd53dea3651cb0e77e016b69ca726f759106338c242f1596225f235854d612ffaf7e9a8756403d802a071dbafab7cd14a44005bb3bd1ba21235816372cf32775985b2a09248f8f52065cb58b9c09cbf50e7e3bbbc78e69118e67e882a52385d456ee824e1f4d631d87b394cc1d19eda889b4933ddecb183548df778759b	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E35E6F46A1A9A4D18A4DAA298BDA4D1E8879236E	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\F89A37FB24B0417D93BFB760B12121F5A358F9D9	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4\Blob = 19000000010000001000000082218ffb91733e64136be5719f57c3a1030000000100000014000000afe5d244a8d1194230ff479fe2f897bbcd7a8cb41d0000000100000010000000cb39c3d4272cdf63774e1db810c5a89e140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d462000000010000002000000052f0e1c4e58ec629291b60317f074671b85d7ea80d5b07273463534b32b402340b000000010000003a0000005300650063007400690067006f002000280066006f0072006d00650072006c007900200043006f006d006f0064006f002000430041002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000030000000761613f4cd8607508c3d520fbefe68773735fc73746f42a9fd6254ba3b72f0047994e5af57677cf6d2c1965984965df12000000001000000dc050000308205d8308203c0a00302010202104caaf9cadb636fe01ff74ed85b03869d300d06092a864886f70d01010c0500308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f72697479301e170d3130303131393030303030305a170d3338303131383233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a3423040301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201000af1d54684b7ae51bb6cb24d411400934c9ccbe5c054cfa0258e02f9fdb0a20df520983c132dac56a2b0d67e1192e92eba9e2e9a72b1bd19446c6135a29ab41612695a8ce1d73ea41ae82f03f4ae611d101b2aa48b7ac5fe05a6e1c0d6c8fe9eae8f2bba3d99f8d8730958466ea69cf4d727d395da3783721cd373e0a2479903385dd5497900291cc7ec9b201c0724695778b239fc3a84a0b59c7c8dbf2e936227b739da1718aebd3c0968ff849b3cd5d60b03e3579e14f7d1eb4fc8bd8723b7b6494379855cbaeb920ba1c6e868a84c16b11a990ae8532c92bba10918750c65a87bcb23b71ac22885c31bffd02b62efa47b099198678c1401cd68066a6321750380888a6e81c685f2a9a42de7f4a524104783cacdf48d7958b1069be71a2ad99d01d7947ded034acaf0dbe8a9013ef55699c91e8e493dbbe509b9e04f49923d168240cccc59c6e63aed122e693c6c95b1fdaa1d7b7f86be1e0e3246fbfb138f757f4c8b4b4663fe00344070c1c3b9a1dda670e204b341bce98091ea649c7ae12203a99c6e6f0e654f6c87875ef36ea0f975a59b40e853b2279d4ab9c077218dff87f2debc8cef17dfb7490bd1f26e300b1a0e4e76ed11fcf5e956b27dbfc76d0a938ca5d0c0b61dbe3a4e94a2d76e6c0bc28a7cfa20f3c4e4e5cd0da8cb9192b17c85ecb51469660e82e7cdcec82da6517f21c1355385064a5d9fadbb1b5f74	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 1900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\D70D7D00CA12E1B3E20F3BF7534DEB2C2E7C2404	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F14CDC50FA95DFA78F9488E6A96FF0B4011F460\Blob = 0f00000001000000200000001705f30c1efa865484eda67d661a2ab216476c3a8ffba79e46b502660e8191cc0300000001000000140000003f14cdc50fa95dfa78f9488e6a96ff0b4011f46020000000010000005f0500003082055b30820443a0030201020210124ee46d5e92cc4dbd6ebf3acd2e7fd0300d06092a864886f70d01010b0500307d310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312330210603550403131a434f4d4f444f2052534120436f6465205369676e696e67204341301e170d3137313231333030303030305a170d3138313231333233353935395a3081c4310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a7f0a04410f74dd9a1c24a14699f977551af2f528fe1a83b461da7a6d4e3099d5853b065396e990d9fa3c4ad1232128868cbebfc1aa5edf788f6d8aedb9ab5a82e923276061bb0d6980237f6dcdf8876f8bac93bc05edcaa0b8f93d0d03c132c8bf0a11bbaa16106732d636fab5f2710acd3711181454cf419d27f3078cda5c96ed284c2102ef8723e1e7510fbaa7fb3025a00d72f226fbcb69ea8192e7862f422fd83c221b77eb4953f1ad779765b2f8292004a11fd266bbcbbe0448fd199ce6a70e990ffdc11105bc4b92b1b90b82010ff56eb8daa434bd6405b519552649c4e136ae8c381171fe2d1a4e0522dbd2feecddc2cb40a01accc49b5bc55d59fb50203010001a382018d30820189301f0603551d23041830168014299160ff8a4dfaebf9a66ab8cff9e64bbd49ce12301d0603551d0e0416041470cfd4fe3684b3c7eb2a7f08aae10493a839344d300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e63726c307406082b0601050507010104683066303e06082b060105050730028632687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010b0500038201010020d13cee9ecf43b51c1a9ef12f4ff2f85516a21fd1c4df41ef814d29d3113647e46e39dda693e0548c31f714e64b8176e537f6191407bb7f422a9bcc941f4a4703b0a508e29adb32b527f50b68e0294971778d1ccde7126f5536d488267cf7a0cdd83fb1e93af6b43fa6cbf4a2f01d6c8cf4a253c2c94f7518bf38efa43239155ef7b7bb4c139540d49af1ca750469f06f01c82d11b0f2fdfbdf3d9c778c8d23d2d40a66ce10d6e07a74955907a2937a6ba6a5dcd7071fb61e3ce34b610e03ca8e6c5a003da76d492fc19ee8666d237499f486b6b8d8a1da4f3052abee516491d09f9d687129f44ba62151e2656710b8dd9a7e9a19d1d4a91e9b6a642d5996b3	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\F5F8EEAC5A0127025E936C01493D1C11D5012BA4	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\8D170F91DE1907BF03CD9F1DEBFEF61E3D3670CC	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\39488FE6BE0D00E76D475BD2902442A541A0E1A3\Blob = 03000000010000001400000039488fe6be0d00e76d475bd2902442a541a0e1a3200000000100000068050000308205643082044ca0030201020210071ae4a2402bb0ad40f3fbd4402b9290300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3133303430383030303030305a170d3134303430383233353935395a3081b9310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303117301506035504090c0e313235352042726f61642053742e31223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100d16dbef9f9b66b60cd10d445259a1340e176ea68a389e786588ea50ddede49f026ee9fadcdfaf92a4d5759e4157f166827acef7aaec040e4ec816905e85396416ae568b0f57672069ab644792bef047fcbb11ec708f7e6e8c06f484b328cfbf769aaaad4aafb9f6c4f4c22e552bbd41b367ad3a5130f06f71bdfce3f295a2eb35c6863496588a6a018ef0205d950bb2aa130263f0e4dcc3976de1c04a41d6f825e47e6d0da838b1454fe7bc35449984bc83e906f76ddc59e70fd00f8393b377dd459a3ed394db48a66dc4b6411d7d65dddbc1a964022d77bb4fe6bbc1a6d39f4832c15dbee8183f2fe46aa57bca4e2df4a3f7843f3bf677abf63c363d39c1b410203010001a38201a33082019f301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604145e313f971a8d01f8288f3edaef539b06c99d97fa300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30180603551d110411300f810d636140636f6d6f646f2e636f6d300d06092a864886f70d0101050500038201010044a773cdd6d5f08fc0a6d76d84ca14d5cb7ff98f2c9b2a9d28902d5d24282fd9fe6e3cad24fa31199ee0f2ef48e973ccb133e9007791b76362a14839b97b80bfefce0accfb9dedaa51e2c3a213114442009d1479088e2beca664c6ade7ba8e3913bdfa8589fc8ac59177ca3705e58585f1887685b89bdbf1b7bc6efa82a2b4ae273eebd53dea3651cb0e77e016b69ca726f759106338c242f1596225f235854d612ffaf7e9a8756403d802a071dbafab7cd14a44005bb3bd1ba21235816372cf32775985b2a09248f8f52065cb58b9c09cbf50e7e3bbbc78e69118e67e882a52385d456ee824e1f4d631d87b394cc1d19eda889b4933ddecb183548df778759b	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\31D019FC7AB697D57D9C4AFB340ED7C4D10400DF	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\272CCBC264497707D8DBAEF39868F500CD26BCF4	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0400000001000000100000001d3554048578b03f42424dbf20730a3f0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d90103000000010000001400000002faf3e291435468607857694df5e45b6885186819000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\31D019FC7AB697D57D9C4AFB340ED7C4D10400DF	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F8DB7E1C16F1FFD4AAAD4AAD8DFF0F2445184AEB\Blob = 030000000100000014000000f8db7e1c16f1ffd4aaad4aad8dff0f2445184aeb20000000010000000906000030820605308203eda0030201020210078f0a9d03df119e434e4fec1bf0235a300d06092a864886f70d01010b0500308194310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313e303c060355040313354d6963726f736f667420446576656c6f706d656e7420526f6f7420436572746966696361746520417574686f726974792032303134301e170d3134303532383136343334365a170d3339303532383136353134385a308194310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313e303c060355040313354d6963726f736f667420446576656c6f706d656e7420526f6f7420436572746966696361746520417574686f72697479203230313430820222300d06092a864886f70d01010105000382020f003082020a0282020100c20f7f6d49bb39f04d943fe8fb4dc5eb3be1285ab9892a467ea5c333271d82893feb33a1876aeae882b9dac39d77d135c0cb833672a6571912bc15e2c83c7b83623414d5abb6de368ba15a71a65196a70633b3221d146253c2a5af9a40cabe2c485499e72a9368a769190b99693bc1b2acae94dc5fab7e02cade3ca774a68c10a0e5aeb69c35ef838b10e5972aba916b9a6a4595d9d054718e653fc48a53ca1e38470ae9d04184a5da1e66016504e6505b7735f5b42e29320cc6bf5f61ee3220b77c39f911faff605efec669f46f1e1ded1d06e7651e9a112e6344065f31431733e9a32682d44b83124fd2a126032548e13abd84f58ad5b46e1ae871200e45530167ade31e6be8b2e4abfdf53b8eba67af5984cc5c75d09daa5c72c42636a2ac324c6ab1f8331744d2a77d70eeeb70949abceaba1c104b635b38ddd2254504b2f0b35a7c0b0a8e21406437114d96694533e493839ef9b3b51c2b0571ea6dcce748b6b6de805010ca4938b35905704ebd9e880222586489eb40dab12d2d6a40885d23c33ed0f5d5b7908a28543962a2c5c6b1bf74cd8695f9456bccf207eaac5cd336f7a27ab5b472532a063ec337945858b14a71bb5ccd9cb2af109ad943363e528519e7422891118c8ce7bbdfe6c855087375f3960d86b7d2e506b2c08a54a86177207d6cd1feba68f3454aaf1184eb867d2f04f354ea20ffd5db3d250270870203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604148570009f77591e8cac3c9f77262819cc9ac18f32301006092b06010401823715010403020100300d06092a864886f70d01010b050003820201004f2574bd1f624f5f0ff74222d7d1d65304232ec5d5d7072b6b793b5f6d90ed1355d382f1f5028f3ef996267e0d421876fc6055825a86bd113339690fcee0b02bf15d19dfd8d2fa86a4cccdacf0d0ae9a8b2b248f03c1350d20b3dfc742ea77292e0a12fc0b1a458dd931840d8d02c0acfad212bf1e6a343eea8300a348754e72662da1a5129f37a85d4a7759cfd63afc30c5a609a5bfb108e3fb2c9f76c4fb4e611d6d23f3766985eb49bb0df73dd0aa05bcdd3d6e80445ed99a68ecc989c7e61a18f860a0e78cf6e6516f0ee025b863f9f9c20b8c3c9cb2f042cdbec3f5fe4929559c5e8696fba1ed6d2686e8b8208b5cc6e72d31c5aaca7d4b7da059a41efb5071e9afcfd6aa0d99de8e95269731a5f47f6df46815b8e3f7add8efd13875025ffd6d4efcb6fc2f451ba9cad11e7aff75181536c120e45f483a95eb7be4f5f6f4fec94b21a2a9ea8a9925cbe8444090d539b46b239b52bcc0c17e17666e650bf5741596a866ed856854b224e87588644589853c7a656b96e0f259ea4725660f6a1b0c3fd44ae64b26174709fed4d7b8e0cee72f94ad808b6770ccb77bcf1b2bb9d15bbdb8035cb1f01b412ce6535516e74a0e41089937e2a9d76d0e6a45e5ece388a9fdb69bc32820ceabc2936b516553bfa05e7b9d26349a514c8ca638d5865b3c55ee50ec000bcaacdcca10abdf189bd2ac0c8d084515af8535355ae526bc	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E35E6F46A1A9A4D18A4DAA298BDA4D1E8879236E	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\76FBABF1EADED3B91DD7A76A6678301F1F87AA97\Blob = 0f00000001000000140000001dcb79ef0387b641fad2722ff112e69ccc73389f03000000010000001400000076fbabf1eaded3b91dd7a76a6678301f1f87aa9720000000010000005a050000308205563082043ea003020102021100c5144cf5e535f748a9afa6fc384c0775300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3138303130343030303030305a170d3139303130343233353935395a3081c4310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100e7cbaab2f00e8651180214f1ed65f1eb65ecd2f22b19bdc1d1d2c868f9e0e39acce5af71db4f0dce385be0a9d9893de4c279fd4d443102a027e15e1d61162a3215dde877f8bf3fe0683ed7c43cd7d43f1f1022739cb1f3753d70025a598b42101c9df0cb4fe5bf88417379322b139c038443b11e5bd176d6a4104ee46e6c977a23b6ebf0b37c581c2eb8175c19847a4515dbc2d1cba91a643b66a1d7ed2693894015fa5e3090c634ab718f91869cc46625e9b82208e5a3f645bc22bf0d30c0192c31af3a41d441f9c5c775b7d4c169d5eb30f6d9cf925db9d7ca6f709cda6ff64fbad2094e83cf5bdcdf7e20b0a26187ee5a54d0e6bd5d438fd45f4213f996f10203010001a382018930820185301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e04160414a4cf9fa30897a5d428ba7d95b4c530d622c8bac4300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010505000382010100753282ba1f92581fd0486a791deea4b862c2ed4b37f7dedba7a971004dae9d87c6ce89cbd3fe730689f3b30c29830b15b45e023a8b2a0f1d7624ec0d1171abb783d9bfbe2f0a5919eac664f584423d302009ec5ebcabed2fdf775ecc36aba13147d6692833f58f630fff673d6154263421e39aa66111e3ba1a5555651f9dea4f35455e1dfb49a15a1c65d648acd94c68c105a345419e8f4dd9dc7a66ad2d5853982bcea59b9735c186703b164e97844fe093deb4af53f097b59a21c77b896b20942183bb34db84ac0d460f5752876c9fe3f39ce9bcd2a14d7a9fc7b8b3d25f721af0de615c4609ad959c212f1baeb561d0108a90b20fb78f56de7c0817209d15	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\6CD253D636A7B4D0E0981431BC064061A9853ED9\Blob = 0f00000001000000200000006f962c708f9b1bde348d5d34a63756527055479d67e82040573e57c7f633154d0300000001000000140000006cd253d636a7b4d0e0981431bc064061a9853ed920000000010000001b06000030820617308204ffa003020102021032327facb1bd6f1fa93473ccc515fd82300d06092a864886f70d01010b0500308191310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564313730350603550403132e434f4d4f444f2052534120457874656e6465642056616c69646174696f6e20436f6465205369676e696e67204341301e170d3138303132343030303030305a170d3231303132333233353935395a308201153110300e060355040513073339313038303531133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e311a301806035504090c11313235352042726f61642053747265657431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100b7713778a66667b8cd67f828f378f80a5507c4e8aa143cfd5b9b953ab16d04a965dcd386a35efe8378c1e0e5ceaf124f188102958962014e493cd80f11fc2ba339953a8bb71a9f030ebbe8742b4252ab465a2d41a829508a9eef5d34d171fcf0b5be026fe15e1a70288b2ecd4af1332924d53c0eefe5c7033482769cae8b5c5e8d59033fac40e94d714c5cd05e8db6f0edb71bb26565d52a025f35323203e9a7846d00a235f973d1e43f29a81dcd1bfef625d373f94a51cc8d2be8ee69702a73a694da69d9b0fbae7d1dee353683a2037a2019b9260a1b53f6c89d945b384c275670bdfac333301504af00749373356a1e7a422eb9363bdab713f9ad6b5bb1970203010001a38201e2308201de301f0603551d23041830168014df8ff3200ce9caa604d85b58372a3dab46dc8349301d0603551d0e04160414e18081b3e9396b7109e8b2add6c3d20ebf4b4814300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010601302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f43505330550603551d1f044e304c304aa048a0468644687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e63726c30818606082b06010505070101047a3078305006082b060105050730028644687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33393130383035300d06092a864886f70d01010b050003820101004bc17929ea82f3c4787f7b29b69edb09e169797a9f4cd233f035412d2b9c586e352d2c0d1cd530a946a91ccd8858453573f0b45a0cdc743d662af4761420489adadbd9a84915b697f96ed1e49786c53000eb12555d3b2957eec18279326020737e2e3e4d621856026169ad6f6cf18ee7b59d5b6a7e6d8c252fa1a15363ec89a6efe5efdf4b260ad35c6a0e1db0250d1eb66ea7b91f15e0f57ecc0541e1ad74a2069f717dec0b1f03101b6812c13f64264f8c40a3614ffb8ccabedb974cda14eb50c061d5cd23dc7735cd0bcfdcef3fd178c1f95594a591031d05c8554cb5fe6fd23cb95931bf847f5b525a269aeac0336313e8f6e81ccb1692d86993724f709e	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\F89A37FB24B0417D93BFB760B12121F5A358F9D9	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E35E6F46A1A9A4D18A4DAA298BDA4D1E8879236E\Blob = 0f0000000100000014000000e3b244cda88b1ab5a7dc09039d0c3142ae6361e7030000000100000014000000e35e6f46a1a9a4d18a4daa298bda4d1e8879236e20000000010000005f0500003082055b30820443a003020102021100d9218e2757ec45d84ec08b3e6700c85e300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3138313231313030303030305a170d3139303730373233353935395a3081a8310b3009060355040613025553310e300c06035504110c053037303133310b300906035504080c024e4a3110300e06035504070c07436c6966746f6e3116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100b73a668ff7984c8d990d7c6e51df5176c7842cc1bf351c27286c6139f4831fc718a35b0fa9145f0887de8bce335e8e3e12fce763cab5deeae08e0bf325cd79a4fbb328d7c7f7d53de51bd3c05c5966b634a9b1fc4362afd0267f927dd90a52b6a5f5f0e29c8e94dfe4199b2cf31142bb480e95ecb92b6ca20ecd71ff210df9655e9e9ac856ad7aab929b843052d4a21c27ea4054a9f4e8c4cd88943b1a4d3a58b3e06eb654c6c09cef472d6fb0d05a841ce229b53a5d36bd08cbfdc552f7c758efaa7824c1d27e30a83d7a9cecaab4bd91b2cbd60d1335fc4ac0f0294dd2eeb3f65139467761f091840246ff644edbfacb9ffd7ef2823fd9eea312dd299a39af0203010001a38201aa308201a6301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604147c4f2b645af103043ca7675e8c129c16dee7164c300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d301f0603551d1104183016811473636f742e7765697240636f6d6f646f2e636f6d300d06092a864886f70d01010505000382010100b33c0fee4668b9e86cd777fa94eb47dcaee7fb5b9b897b9458b12e511a194b6ad495ea4b6b820d1c7cd26badf92cfc13aaa9e66157a55545c7ea71460a4fa4e30e46b9ac16a36e94a1fcbc62b2abe402d2a58773344c4b23a0d907a9760029595421e478da67167f80876012443cd22573dc3806cdedbc6c8c4ed255bd926cecc7796ec36fb225d084f31afb5e5a2e86d26149212dda8aed2058ef0d7e7e677b463a7722431a0b5c0b9dc385b7d2e73bd781ee111c8f7e36d76e1db1f6ac98784227ed97cde3762d079741984d146a8ff96e411c1b1e4e711cd00a6150532ffaa13702a81f4514eae48ca0b98d8642a6cfe7711dc67d1b857bfecb4e863bc1f9	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\872CD334B7E7B3C3D1C6114CD6B221026D505EAB	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\31D019FC7AB697D57D9C4AFB340ED7C4D10400DF\Blob = 03000000010000001400000031d019fc7ab697d57d9c4afb340ed7c4d10400df2000000001000000250600003082062130820509a00302010202101b427b060e2866bfb586cc267e1c3eaa300d06092a864886f70d01010b0500308191310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564313730350603550403132e434f4d4f444f2052534120457874656e6465642056616c69646174696f6e20436f6465205369676e696e67204341301e170d3138313230343030303030305a170d3231313230333233353935395a308201093110300e060355040513073339313038303531133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b3009060355040613025553310e300c06035504110c053037303133310b300906035504080c024e4a3110300e06035504070c07436c6966746f6e3116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100ad390c8bc919005d5894a91a9585ef887fbd7c2341ff5ebb3efc6f645a66c55e6da11febce740e53ed9416284dfc7d142e4dc21f99753b5f60ae9aadc764b59efd9ffd33b20ae1c54eba629408a1b095a59cf4af0ad9db9bc494250154dcd0edefcec62e4b248d9a793b703aa15255baf3553fa59d4dc558ba4303af630bb626cd6627e0c4a45764ec3b286c38ab2499f9dc13eefdffa7841297ff533b47061b9aa3ff09ee3f04a7b10ba70894e53f3352b1f60eddfc021a66546e3392795bb6ae49a92f189ec2a7cdd9a935fab33a5ce7fc16c4b7e8ca13b4551d38a6a7c0658298a5adf5f6796675f58e1bb4ce410ff704bc5e845bc1ef83c18a0d50e137370203010001a38201f8308201f4301f0603551d23041830168014df8ff3200ce9caa604d85b58372a3dab46dc8349301d0603551d0e041604142d99b81962209042dc650eb36ec07ad996e48c4d300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010601302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f43505330550603551d1f044e304c304aa048a0468644687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e63726c30818606082b06010505070101047a3078305006082b060105050730028644687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30440603551d11043d303ba02306082b06010505070803a01730150c1355532d44454c41574152452d33393130383035811473636f742e7765697240636f6d6f646f2e636f6d300d06092a864886f70d01010b050003820101007f4d3e6594a3e380fac36b00e97ccacce4786be2ecc13cf37e737aaca0328bb8bfdcd513daff94aba1c7ee00cc8a3bd073157a812f6e31f772781d0bb922a8b86932b296c2312cdf3b239c42bb443b4b1b89b36de34a7fae65ac63eb6ead8812f8d373fa6f1a4e8d9e62eb004caae3639e41e08ed48d640b04725b09b4411dc083587e7fe24b33d90677677960efa6299cc85c4b2bfae4cdfe36581d25e029f6af1a7e77f502882d87597f3cc5bb450a71f9fd57f43b321baa4cbe5213a48a2c5b785a9de4103d5029e4db79403e98784e51379d45a86996b183469e98470731d1a603eaa443a05527aca62f51631722dc0dfe5d74c8298d2aed885d34c9be61	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\D70D7D00CA12E1B3E20F3BF7534DEB2C2E7C2404\Blob = 0f00000001000000200000008f4390d93853f6a1a1b71fdc231e030586f8213a5846c95d90b527f5c6dbd80f030000000100000014000000d70d7d00ca12e1b3e20f3bf7534deb2c2e7c24042000000001000000530500003082054f30820437a00302010202102f9f0a1d6764b5a6378747247087ba73300d06092a864886f70d01010b0500307d310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312330210603550403131a434f4d4f444f2052534120436f6465205369676e696e67204341301e170d3138313231313030303030305a170d3139313231313233353935395a3081b8310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303116301406035504090c0d313235352042726f616420537431223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100c1b2eafc6255d7a7780082967ba911a65b8160e697a9c81ae0816002356644b714895808a67b22551d87b879e80d0c1bff7bd847e1486bad3c3caa8c6f3258a7311f8b03c68c9ec5947950e57a1f99f4b47b8faaf46e282f68155ae6e8f13c9c125b5eb83ae4e63ee6081d0e8aae4f090175a538422b38e0600bd94b21b313567934ee959ddd6ab7ef62bce25dada05d7de6a75cefeffdcba6a1fc8e1ef7aa6d3e5ab328732c3d31759a20d7e69cef60ac9d152041dbd85167a78329f3a80fee19ea9edb102448aa9f5774794ecb560de2faa348f278b846a2a5d8238d5e4e4cd2a82f0e37415af2dc63f34f3e179aa1cae7290b411aaf5aa6acf5404ebe98130203010001a382018d30820189301f0603551d23041830168014299160ff8a4dfaebf9a66ab8cff9e64bbd49ce12301d0603551d0e041604146c5f99825f4ba8d4c19bae5169bab32fae7816ca300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e63726c307406082b0601050507010104683066303e06082b060105050730028632687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010b050003820101000f718c2aa40e9c44a95e1eca3844097ddb7fba896b5f5c73a6b9aede1d29f0e432f41c8a45ce38b1f52df73f45e67907a03ac58d407b3077b1cae246a54544ee365bcee4bf0f4cecc47b01e98d0478d8f4c93e2c582aa472577de9c67a0a8c2e37635e626258675e0e6669babee331594abed516679e8f1b14d7a65dc1b76ab33412689b135cf855335748e2d1998759e5b95f68d418d5486d385d0db7a8fa30e58e84f57bb7ec3f45efa549fab71775c822ec846545b6fc0ef1d3c2dad34940657088fc5f773a1cbe24f9228f9dd7e9611d5d682998c6041ba580a789f5571da01d6723784bbcec4fded61d0ba31e37fbc10c3dfe06169df4670c8d454019f7	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\577DB581A72DAC211A2E3E547077529D54671825\Blob = 0f000000010000001400000062168746c03287ebf06481fd267a4ae824ab4448030000000100000014000000577db581a72dac211a2e3e547077529d546718252000000001000000620500003082055e30820446a00302010202105eb0a7021a06c5b10c21eb8b1716c6b0300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3132303631343030303030305a170d3133303631343233353935395a3081b3310b3009060355040613025553310e300c06035504110c0530373331303113301106035504080c0a4e6577204a65727365793114301206035504070c0b4a657273657920436974793121301f06035504090c183532352057617368696e67746f6e20426f756c657661726431223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100b955ac4b449fee58fa6314876ead56819f17569e8d4fad77698ce21a7c28bfd3d50eb1b77023e54d202eca50e13f4b23eb336fbff44bc2537045bc50687f524781a5a47057dc2761e531664acd1167f8f62c60a49cf4473093b3a12a975d70f60d7d9fbac2336f534bdfae2fff191321ae2f794998ab4f71ffc28537a7a820dbacdaa03ae83b8fe264825baab754a460ecdb41f1e1eac9f3c07492520bdffeee31b2ccbb79f9ac3151569e506665437d470c977082490dd030d0fc6c0e6480470f95b41e47ef7933677fa03e67493d7e855002755a41338060853cc34249fab73c233515b179384b7198bb91d33d8294664d329f251f6510828aba15f4311fef0203010001a38201a33082019f301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604142e10c21ad189ebcb079c83f277d898c9144ade08300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30180603551d110411300f810d636140636f6d6f646f2e636f6d300d06092a864886f70d01010505000382010100ac5ef51daeb71d81e2741745d8959c9a87d731ec7883d97033d6c2d2907b6a47c20bb79300888a341d66a43e7dd399cc52e7fa6695e8aa9a933f8bcb76dee802e1def8c6ac4153514d3793188130b1388baa405f4c8d3710c1a1333f666a0a9eed5844fef4e266a15f8785fff19f6c1e6f1304a7b9dfbd518477e39bf4ce32ebc5931519123198e35b754a77f0e6776046004e9d1b4b55f7bb0580583a605934affb7416f499a1a1fdc31b30cd9ec46e04764b5fb45a19257d971d7120f28bf81ee6e1a82720653d58a45694b395f7ae64a7d7712d9b127d0051903d96462314fc35e9091e08736f9e25be120d3b4bc28a443c5315c06cef5522a4d2c97d3d04	cmdagent.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 546936.crdownload:SmartScreen msedge.exe
Suspicious behavior: AddClipboardFormatListener 3 IoCs

Processes:

ITSMAgent.exeITSMAgent.exeITSMAgent.exe

pid process

5196 ITSMAgent.exe
564 ITSMAgent.exe
3372 ITSMAgent.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 546936.crdownload:SmartScreen	msedge.exe

pid	process
5196	ITSMAgent.exe
564	ITSMAgent.exe
3372	ITSMAgent.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Google Root.exe

pid	process
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe
4040	Google Root.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

Google Root.exeITSMAgent.exe

pid process

4040 Google Root.exe
5196 ITSMAgent.exe
Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

656
656

pid	process
656
656

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Google Root.exeofflineinstaller.exemsiexec.exeMsiExec.exeMsiExec.exevssvc.exeMSI4B21.tmp

description	pid	process
Token: SeDebugPrivilege	4040	Google Root.exe
Token: SeShutdownPrivilege	2840	offlineinstaller.exe
Token: SeIncreaseQuotaPrivilege	2840	offlineinstaller.exe
Token: SeSecurityPrivilege	4516	msiexec.exe
Token: SeCreateTokenPrivilege	2840	offlineinstaller.exe
Token: SeAssignPrimaryTokenPrivilege	2840	offlineinstaller.exe
Token: SeLockMemoryPrivilege	2840	offlineinstaller.exe
Token: SeIncreaseQuotaPrivilege	2840	offlineinstaller.exe
Token: SeMachineAccountPrivilege	2840	offlineinstaller.exe
Token: SeTcbPrivilege	2840	offlineinstaller.exe
Token: SeSecurityPrivilege	2840	offlineinstaller.exe
Token: SeTakeOwnershipPrivilege	2840	offlineinstaller.exe
Token: SeLoadDriverPrivilege	2840	offlineinstaller.exe
Token: SeSystemProfilePrivilege	2840	offlineinstaller.exe
Token: SeSystemtimePrivilege	2840	offlineinstaller.exe
Token: SeProfSingleProcessPrivilege	2840	offlineinstaller.exe
Token: SeIncBasePriorityPrivilege	2840	offlineinstaller.exe
Token: SeCreatePagefilePrivilege	2840	offlineinstaller.exe
Token: SeCreatePermanentPrivilege	2840	offlineinstaller.exe
Token: SeBackupPrivilege	2840	offlineinstaller.exe
Token: SeRestorePrivilege	2840	offlineinstaller.exe
Token: SeShutdownPrivilege	2840	offlineinstaller.exe
Token: SeDebugPrivilege	2840	offlineinstaller.exe
Token: SeAuditPrivilege	2840	offlineinstaller.exe
Token: SeSystemEnvironmentPrivilege	2840	offlineinstaller.exe
Token: SeChangeNotifyPrivilege	2840	offlineinstaller.exe
Token: SeRemoteShutdownPrivilege	2840	offlineinstaller.exe
Token: SeUndockPrivilege	2840	offlineinstaller.exe
Token: SeSyncAgentPrivilege	2840	offlineinstaller.exe
Token: SeEnableDelegationPrivilege	2840	offlineinstaller.exe
Token: SeManageVolumePrivilege	2840	offlineinstaller.exe
Token: SeImpersonatePrivilege	2840	offlineinstaller.exe
Token: SeCreateGlobalPrivilege	2840	offlineinstaller.exe
Token: SeRestorePrivilege	4516	msiexec.exe
Token: SeTakeOwnershipPrivilege	4516	msiexec.exe
Token: SeRestorePrivilege	4516	msiexec.exe
Token: SeTakeOwnershipPrivilege	4516	msiexec.exe
Token: SeTcbPrivilege	2040	MsiExec.exe
Token: SeRestorePrivilege	4516	msiexec.exe
Token: SeTakeOwnershipPrivilege	4516	msiexec.exe
Token: SeTcbPrivilege	2040	MsiExec.exe
Token: SeRestorePrivilege	4516	msiexec.exe
Token: SeTakeOwnershipPrivilege	4516	msiexec.exe
Token: SeTcbPrivilege	2040	MsiExec.exe
Token: SeRestorePrivilege	4516	msiexec.exe
Token: SeTakeOwnershipPrivilege	4516	msiexec.exe
Token: SeRestorePrivilege	4516	msiexec.exe
Token: SeTakeOwnershipPrivilege	4516	msiexec.exe
Token: SeTcbPrivilege	4788	MsiExec.exe
Token: SeRestorePrivilege	4516	msiexec.exe
Token: SeTakeOwnershipPrivilege	4516	msiexec.exe
Token: SeTcbPrivilege	4788	MsiExec.exe
Token: SeRestorePrivilege	4516	msiexec.exe
Token: SeTakeOwnershipPrivilege	4516	msiexec.exe
Token: SeBackupPrivilege	4728	vssvc.exe
Token: SeRestorePrivilege	4728	vssvc.exe
Token: SeAuditPrivilege	4728	vssvc.exe
Token: SeBackupPrivilege	3592	MSI4B21.tmp
Token: SeRestorePrivilege	3592	MSI4B21.tmp
Token: SeRestorePrivilege	4516	msiexec.exe
Token: SeTakeOwnershipPrivilege	4516	msiexec.exe
Token: SeTcbPrivilege	4788	MsiExec.exe
Token: SeRestorePrivilege	4516	msiexec.exe
Token: SeTakeOwnershipPrivilege	4516	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exeITSMAgent.execis.exe

pid	process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
3920	cis.exe
3920	cis.exe
3920	cis.exe
5196	ITSMAgent.exe
3920	cis.exe
3920	cis.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe
5196	ITSMAgent.exe

Suspicious use of SetWindowsHookEx 30 IoCs

Processes:

ITSMService.exeITSMAgent.exeITSMAgent.exeITSMAgent.execis.execis.exe

pid	process
5436	ITSMService.exe
5436	ITSMService.exe
5436	ITSMService.exe
5436	ITSMService.exe
5436	ITSMService.exe
5436	ITSMService.exe
5436	ITSMService.exe
5436	ITSMService.exe
5436	ITSMService.exe
5196	ITSMAgent.exe
564	ITSMAgent.exe
3372	ITSMAgent.exe
5436	ITSMService.exe
5436	ITSMService.exe
5436	ITSMService.exe
5436	ITSMService.exe
5436	ITSMService.exe
2460	cis.exe
5436	ITSMService.exe
2460	cis.exe
5044	cis.exe
2460	cis.exe
2460	cis.exe
5044	cis.exe
5044	cis.exe
5044	cis.exe
5044	cis.exe
5044	cis.exe
5044	cis.exe
5044	cis.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

90b0dacdb9974cb1f970960e3c082167_JaffaCakes118.exeGoogle Root.exemsedge.exe

description	pid	process	target process
PID 4928 wrote to memory of 4040	4928	90b0dacdb9974cb1f970960e3c082167_JaffaCakes118.exe	Google Root.exe
PID 4928 wrote to memory of 4040	4928	90b0dacdb9974cb1f970960e3c082167_JaffaCakes118.exe	Google Root.exe
PID 4040 wrote to memory of 3288	4040	Google Root.exe	netsh.exe
PID 4040 wrote to memory of 3288	4040	Google Root.exe	netsh.exe
PID 4592 wrote to memory of 4324	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 4324	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 668	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 4988	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 4988	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 1452	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 1452	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 1452	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 1452	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 1452	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 1452	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 1452	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 1452	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 1452	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 1452	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 1452	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 1452	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 1452	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 1452	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 1452	4592	msedge.exe	msedge.exe
PID 4592 wrote to memory of 1452	4592	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\90b0dacdb9974cb1f970960e3c082167_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\90b0dacdb9974cb1f970960e3c082167_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4928

C:\Users\Admin\AppData\Local\Temp\Google Root.exe
"C:\Users\Admin\AppData\Local\Temp\Google Root.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4040

C:\Windows\SYSTEM32\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Google Root.exe" "Google Root.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:3288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9f27e46f8,0x7ff9f27e4708,0x7ff9f27e4718
2⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,14750786143134982384,1342549959130371297,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
2⤵
PID:668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,14750786143134982384,1342549959130371297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
2⤵
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,14750786143134982384,1342549959130371297,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
2⤵
PID:1452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,14750786143134982384,1342549959130371297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
2⤵
PID:2528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,14750786143134982384,1342549959130371297,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
2⤵
PID:3656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,14750786143134982384,1342549959130371297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
2⤵
PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,14750786143134982384,1342549959130371297,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
2⤵
PID:2140

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,14750786143134982384,1342549959130371297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
2⤵
PID:1556

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,14750786143134982384,1342549959130371297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
2⤵
PID:2320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,14750786143134982384,1342549959130371297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
2⤵
PID:228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,14750786143134982384,1342549959130371297,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
2⤵
PID:1928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,14750786143134982384,1342549959130371297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
2⤵
PID:3444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,14750786143134982384,1342549959130371297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
2⤵
PID:2168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,14750786143134982384,1342549959130371297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
2⤵
PID:1528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,14750786143134982384,1342549959130371297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
2⤵
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1996,14750786143134982384,1342549959130371297,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6024 /prefetch:8
2⤵
PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1996,14750786143134982384,1342549959130371297,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5072 /prefetch:8
2⤵
PID:624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,14750786143134982384,1342549959130371297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
2⤵
PID:3656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1996,14750786143134982384,1342549959130371297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 /prefetch:8
2⤵
PID:4172

C:\Users\Admin\Downloads\Xcitium131.exe
"C:\Users\Admin\Downloads\Xcitium131.exe"
2⤵
- Executes dropped EXE
PID:944

C:\Users\Admin\AppData\Local\Temp\tmp_069774d5e7e16156f22864e975acb27a85467aae\offlineinstaller.exe
/ra warn /rm "Xcitium ZeroThreat Installed. NFR VERSION" /rt 300 /sm "Xcitium ZeroThreat Installed. NFR VERSION" /7orhigher /8orhigher /brand c
3⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2840

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe" reboot "Xcitium ZeroThreat Installed. NFR VERSION"
4⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3372

C:\Users\Admin\Downloads\Xcitium131.exe
"C:\Users\Admin\Downloads\Xcitium131.exe"
2⤵
- Executes dropped EXE
PID:5076

C:\Users\Admin\Downloads\Xcitium131.exe
"C:\Users\Admin\Downloads\Xcitium131.exe"
2⤵
- Executes dropped EXE
PID:516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3428

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Drops file in Drivers directory
- Registers COM server for autorun
- Adds Run key to start application
- Blocklisted process makes network request
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 0DCDD5CCF0E1195B833F853C0E54A196
2⤵
- Loads dropped DLL
- Checks for any installed AV software in registry
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 53C1A3548840C616AAD67AA949EF57D1 E Global\MSI0000
2⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4788

C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --langID 1033 --msiinstall --installCertificates --osver 1000 --av --productguid=1EC1BE12-7F79-4002-99F8-CF951EE9D8EE --upgradeBackuped= --createConfig "active=endpt;dplus=opt;esm=1;av=1;fw=0;cesav=1;cesfw=0;cessandbox=1;free=0;noalerts=0;cloud=1;sendstats=1;configfile=;fwstate=0;dfstate=0;avstate=0;bbstate=0;avservers=0;standalone=0;useblob=0;trustnewnets=0;"
3⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks for any installed AV software in registry
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:924

C:\Program Files\COMODO\COMODO Internet Security\cisbf.exe
"C:\Program Files\COMODO\COMODO Internet Security\cisbf.exe" /Regserver
4⤵
- Executes dropped EXE
- Registers COM server for autorun
PID:1076

C:\Windows\system32\runonce.exe
"C:\Windows\system32\runonce.exe" -r
4⤵
- Checks processor information in registry
PID:1152

C:\Windows\System32\grpconv.exe
"C:\Windows\System32\grpconv.exe" -o
5⤵
PID:4836

C:\Windows\system32\runonce.exe
"C:\Windows\system32\runonce.exe" -r
4⤵
- Checks processor information in registry
PID:4396

C:\Windows\System32\grpconv.exe
"C:\Windows\System32\grpconv.exe" -o
5⤵
PID:1868

C:\Windows\Installer\MSI4B21.tmp
"C:\Windows\Installer\MSI4B21.tmp" -rptype 0 -descr "Installing COMODO Client - Security " -logfile "C:\Users\Admin\AppData\Local\Temp\COMODO Internet Security dbgout.log"
2⤵
- Executes dropped EXE
PID:3832

C:\Windows\Installer\MSI4B21.tmp
"C:\Windows\Installer\MSI4B21.tmp" -rptype 0 -descr "Installing COMODO Client - Security " -logfile "C:\Users\Admin\AppData\Local\Temp\COMODO Internet Security dbgout.log" -working
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3592

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
4⤵
PID:3768

C:\Windows\syswow64\MsiExec.exe
"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\COMODO\COMODO Internet Security\cmdcom32.dll"
2⤵
- Loads dropped DLL
- Modifies registry class
PID:4952

C:\Windows\System32\MsiExec.exe
"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\COMODO\COMODO Internet Security\AmsiProvider_x64.dll"
2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Enumerates connected drives
PID:664

C:\Windows\syswow64\MsiExec.exe
"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\COMODO\COMODO Internet Security\AmsiProvider_x86.dll"
2⤵
- Loads dropped DLL
- Enumerates connected drives
PID:1876

C:\Windows\System32\MsiExec.exe
"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\COMODO\COMODO Internet Security\cavshell.dll"
2⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Registers COM server for autorun
- Enumerates connected drives
- Modifies registry class
PID:1200

C:\Windows\System32\MsiExec.exe
"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\COMODO\COMODO Internet Security\cisresc.dll"
2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:1384

C:\Windows\System32\MsiExec.exe
"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\COMODO\COMODO Internet Security\cisbfps.dll"
2⤵
- Loads dropped DLL
- Registers COM server for autorun
PID:5060

C:\Windows\System32\MsiExec.exe
"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\COMODO\COMODO Internet Security\cmdcomps.dll"
2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:3364

C:\Windows\System32\MsiExec.exe
"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\COMODO\COMODO Internet Security\cavwpps.dll"
2⤵
- Loads dropped DLL
- Registers COM server for autorun
PID:2712

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 8D28AFD4732D4E2622A7258B3E3B2BBB
2⤵
- Loads dropped DLL
PID:2204

C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --selfProtectionDisable
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Enumerates connected drives
PID:4784

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 9A44F079232AA76B1CA6E2B77A560FA1 E Global\MSI0000
2⤵
PID:324

C:\Program Files\COMODO\EdrAgentV2\edrsvc.exe
"C:\Program Files\COMODO\EdrAgentV2\edrsvc.exe" install
3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
PID:1252

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 40B2F70EBEDA61653C096117EEF1D7FA
2⤵
PID:2532

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 1738AC3D2CCCD75C71A90234DBDE56C6 E Global\MSI0000
2⤵
- Drops file in Windows directory
PID:2140

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\COMODO\Endpoint Manager\" && "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe" "
3⤵
PID:1784

C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe"
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3372

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
5⤵
PID:1240

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:3524

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{2cb07e0b-e9a9-7746-afe9-c077f5812ee9}\cesguard.inf" "9" "4ca5bc957" "000000000000014C" "WinSta0\Default" "0000000000000164" "208" "C:\Program Files\COMODO\COMODO Internet Security\drivers\win10"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4624

C:\Windows\system32\DrvInst.exe
DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\cesguard.inf_amd64_7eb972e4be959e6b\cesguard.inf" "0" "4ca5bc957" "0000000000000164" "WinSta0\Default"
2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
PID:5092

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{c34a78f6-0774-364d-864b-cfc03427477b}\ceskbdflt.inf" "9" "4b12ed323" "0000000000000158" "WinSta0\Default" "000000000000014C" "208" "C:\Program Files\COMODO\COMODO Internet Security\drivers\win10"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2372

C:\Windows\system32\DrvInst.exe
DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\ceskbdflt.inf_amd64_ea937b232aea382e\ceskbdflt.inf" "0" "4b12ed323" "000000000000014C" "WinSta0\Default"
2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
PID:3368

C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
"C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe"
1⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
PID:3640

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\COMODO\COMODO Internet Security\cavwpps.dll"
2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:652

C:\Program Files\COMODO\COMODO Internet Security\cis.exe
"C:\Program Files\COMODO\COMODO Internet Security\cis.exe" --cistrayUI
2⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
- Suspicious use of SendNotifyMessage
PID:3920

C:\Program Files\COMODO\COMODO Internet Security\cis.exe
"C:\Program Files\COMODO\COMODO Internet Security\cis.exe" --mainUI
3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:2460

C:\Program Files\COMODO\COMODO Internet Security\cis.exe
"C:\Program Files\COMODO\COMODO Internet Security\cis.exe" --ratingScanUI={0C999A1C-D192-4BD5-A219-55428C447B71}
4⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:5044

C:\Program Files\COMODO\COMODO Internet Security\cis.exe
"C:\Program Files\COMODO\COMODO Internet Security\cis.exe" --updateUI={9A65C575-9AD3-4DF2-9520-4D764743133F}
3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
PID:64

C:\Program Files\COMODO\COMODO Internet Security\cmdinstall.exe
"C:\Program Files\COMODO\COMODO Internet Security\cmdinstall.exe" -type local -check 5
2⤵
- Executes dropped EXE
- Enumerates connected drives
PID:5808

C:\Program Files\COMODO\COMODO Internet Security\cmdinstall.exe
"C:\Program Files\COMODO\COMODO Internet Security\cmdinstall.exe" -type "local" -check "5"
3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
PID:5876

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\COMODO\COMODO Internet Security\cavwpps.dll"
2⤵
- Registers COM server for autorun
- Modifies registry class
PID:4948

C:\Program Files\COMODO\COMODO Internet Security\cmdicap.exe
"C:\Program Files\COMODO\COMODO Internet Security\cmdicap.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2708

C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
"C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe" /ModeAvMonitor -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
PID:1348

C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
"C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe" /ModeTdtHost -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Enumerates connected drives
PID:1896

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4836

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5936

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe"
1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5436

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5196

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe" noui
2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:564

C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --start
2⤵
- Executes dropped EXE
PID:5708

C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --installBrandSet "C:\ProgramData\COMODO\Endpoint Manager\brand.zip"
2⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:1452

C:\Program Files\COMODO\EdrAgentV2\edrsvc.exe
"C:\Program Files\COMODO\EdrAgentV2\edrsvc.exe" enroll --rootUrl https://api.dragonplatform.net/endpoint --clientId 63e17b432cd65d0009748ba2 --endpointId 106 --start
2⤵
- Executes dropped EXE
PID:6036

C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --stop
2⤵
- Executes dropped EXE
PID:2624

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe /x {1EC1BE12-7F79-4002-99F8-CF951EE9D8EE} /q
2⤵
PID:5276

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe" noui
2⤵
PID:5004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:1200

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Enumerates connected drives
PID:5416

C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe"
1⤵
- Executes dropped EXE
PID:5860

C:\Program Files\COMODO\COMODO Internet Security\cis.exe
"C:\Program Files\COMODO\COMODO Internet Security\cis.exe" --cistrayUI
1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
PID:4900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Enumerates connected drives
- Modifies data under HKEY_USERS
PID:376

C:\Program Files\COMODO\EdrAgentV2\edrsvc.exe
"C:\Program Files\COMODO\EdrAgentV2\edrsvc.exe"
1⤵
- Executes dropped EXE
PID:4784

C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
"C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe" /ModeAvMerger -Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
PID:1132

C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
"C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe" /ModeAvMonitor -Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
PID:4288

C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
"C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe" /ModeAvScanner -Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
PID:4344

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:6092

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 299758E00880E49B12B0280A0E136F29 E Global\MSI0000
2⤵
PID:5808

C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --checkPassword
3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
- Modifies data under HKEY_USERS
PID:6112

C:\Windows\System32\cwwwvr.exe
"C:\Windows\System32\cwwwvr.exe"
1⤵
PID:1064

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3820055 /state1:0x41c64e6d
1⤵
PID:5700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery