035a0238921f260d165cfdbb8e991aca3c99e5c90cc8f9226ecfe2005cf7b3b4

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ceserd\ImagePath = "System32\\DRIVERS\\ceserd.sys"	cfpconfg.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	cfpconfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cis.exe\" --cistrayUI"	cfpconfg.exe

Blocklisted process makes network request 11 IoCs

flow	pid	Process
2	3656	msiexec.exe
3	3656	msiexec.exe
4	3656	msiexec.exe
7	768	MsiExec.exe
8	768	MsiExec.exe
9	768	MsiExec.exe
10	768	MsiExec.exe
11	768	MsiExec.exe
12	768	MsiExec.exe
58	2216	MsiExec.exe
67	2824	msiexec.exe

Checks for any installed AV software in registry 1 TTPs 64 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{6AA9E24E-269F-4675-AE6A-67DF4BEE0E9E} = "1720838242"	cfpconfg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\LmdbSyncMode	cmdagent.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\LicenseKeyChanged	cmdagent.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer\Proxy	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UpdateURLS	cfpconfg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\Proxy\ProxyAuthRequired = "0"	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\MofHash = 6a440d9528c015465fd0b7f08b491e480d5bd385	cmdagent.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Shared Space	cfpconfg.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\LanguageID = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\OS driver ceserd = "12"	cfpconfg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\Silent diag support	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CmdAgent	cfpconfg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\Proxy\AllowSkip = "0"	cfpconfg.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\VolatileData	cmdagent.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CavWp\_Trace_Category_Exclude	cavwp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UrlsUpdateHost = "download.comodo.com"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UserEmail	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CmdAgent\_Trace_Enabled = "1"	cfpconfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Shared Space\link3 = "C:\\Users\\Admin\\Links\\Shared Space.lnk"	cfpconfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UpdateURL = "https://download.comodo.com/"	msiexec.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CavWp\_Trace_Level	cavwp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer\Proxy = "C:\\Program Files\\COMODO\\COMODO Internet Security\\msica.dll"	msiexec.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\cavwp	cavwp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam\ModeEx = "0"	cfpconfg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\Langs.cmdres	cfpconfg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\IsLmdbCorrupted.vcact	cmdagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CIS\_Trace_Enabled_To_WinLog = "1"	cfpconfg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CavWp\_Trace_Level = "2"	cfpconfg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\OS driver ceskbdflt = "12"	cfpconfg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CmdAgent\_Trace_Category_Include	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\VolumeUsns = 652184aa00000000883a180200000000	cmdagent.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\IsLmdbCorrupted.cmdurl	cmdagent.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\IsLmdbCorrupted.ccsautoruns	cmdagent.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\MsiExec	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	msiexec.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UsageStatHost	cfpconfg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\LanguageId	cfpconfg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{0D85521A-A20D-44D9-8380-EFB7C9BE423B} = "1720838243"	cfpconfg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{B4865C2A-9D0E-423B-8DA7-087F623C4B4F} = "1720838245"	cmdagent.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\FlsSettings	cmdagent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{6AA9E24E-269F-4675-AE6A-67DF4BEE0E9E} = "1720838243"	cfpconfg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\Proxy\UseProxy	cmdagent.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\MsiExec	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\AllowedDowngrade = "0"	msiexec.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\EsmPortForEsmSetup	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\CIS\_Trace_Level = "2"	cfpconfg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{67CE8C55-02C1-4517-99F0-282BE2734181} = "1720838242"	cfpconfg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\VDDisclaimerHash	cfpconfg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\BrandName	cmdagent.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\CreatorTrackingExcludePaths	cmdagent.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{0E9B65E7-29F3-4520-A8EC-2DDEF68A1170}	cmdagent.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UsageStatHost	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UsageStatHost = "cmc.comodo.com"	msiexec.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data	cfpconfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\Proxy\ProxyAuthLogin	cfpconfg.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options	cfpconfg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data\Timestamp.{67CE8C55-02C1-4517-99F0-282BE2734181} = "1720838243"	cfpconfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Shared Space\link1 = "C:\\Users\\Public\\Desktop\\Shared Space.lnk"	cfpconfg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer	msiexec.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\VolatileData\AtomicBinUpdatesPendingReboot	cmdagent.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\Proxy\ProxyServer	cmdagent.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\ProgramData\Shared Space\Desktop.ini	cfpconfg.exe
File opened for modification	C:\ProgramData\Shared Space\Desktop.ini	cfpconfg.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

persistence privilege_escalation

description	ioc	Process
File opened (read-only)	\??\X:	cmdagent.exe
File opened (read-only)	\??\G:	MsiExec.exe
File opened (read-only)	\??\R:	MsiExec.exe
File opened (read-only)	\??\X:	MsiExec.exe
File opened (read-only)	\??\A:	MsiExec.exe
File opened (read-only)	\??\H:	MsiExec.exe
File opened (read-only)	\??\W:	MsiExec.exe
File opened (read-only)	\??\T:	cfpconfg.exe
File opened (read-only)	\??\T:	MsiExec.exe
File opened (read-only)	\??\I:	cmdagent.exe
File opened (read-only)	\??\W:	cavwp.exe
File opened (read-only)	\??\Z:	cavwp.exe
File opened (read-only)	\??\Y:	MsiExec.exe
File opened (read-only)	\??\A:	cfpconfg.exe
File opened (read-only)	\??\P:	MsiExec.exe
File opened (read-only)	\??\V:	MsiExec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	MsiExec.exe
File opened (read-only)	\??\U:	MsiExec.exe
File opened (read-only)	\??\V:	MsiExec.exe
File opened (read-only)	\??\S:	cavwp.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	MsiExec.exe
File opened (read-only)	\??\J:	MsiExec.exe
File opened (read-only)	\??\U:	MsiExec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	cavwp.exe
File opened (read-only)	\??\N:	MsiExec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	cfpconfg.exe
File opened (read-only)	\??\I:	MsiExec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	MsiExec.exe
File opened (read-only)	\??\L:	cavwp.exe
File opened (read-only)	\??\X:	MsiExec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	cmdagent.exe
File opened (read-only)	\??\S:	cmdagent.exe
File opened (read-only)	\??\L:	MsiExec.exe
File opened (read-only)	\??\T:	MsiExec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	cavwp.exe
File opened (read-only)	\??\M:	cavwp.exe
File opened (read-only)	\??\E:	MsiExec.exe
File opened (read-only)	\??\V:	MsiExec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	cmdagent.exe
File opened (read-only)	\??\H:	cavwp.exe
File opened (read-only)	\??\K:	cavwp.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	cavwp.exe
File opened (read-only)	\??\Y:	cavwp.exe
File opened (read-only)	\??\O:	MsiExec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	MsiExec.exe
File opened (read-only)	\??\T:	MsiExec.exe
File opened (read-only)	\??\Z:	cfpconfg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{1533c7f2-b221-574f-bee6-53f6d596766d}\SET3487.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ceskbdflt.inf_amd64_aaf1df0a1f017963\ceskbdflt.cat	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FA0E447C3E79584EC91182C66BBD2DB7	cmdagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D03E46CD585BBE111C712E6577BC5F07_A4CA148408B3EE41DBEC65A0880988B6	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{c5e8a040-8fa2-e145-b79d-7006c190afaa}\SET2FD2.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c5e8a040-8fa2-e145-b79d-7006c190afaa}\SET2FE2.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ceskbdflt.inf_amd64_aaf1df0a1f017963\ceskbdflt.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7850C7BAFAC9456B4B92328A61976502_9D6B342BF26404674BD1FDE5CB479C7C	cmdagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8	MsiExec.exe
File created	C:\Windows\system32\cmdvrt64.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\cesguard.inf_amd64_3e3769c667ae9359\cesguard.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1533c7f2-b221-574f-bee6-53f6d596766d}\ceskbdflt.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ceskbdflt.inf_amd64_aaf1df0a1f017963\ceskbdflt.sys	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	MsiExec.exe
File created	C:\Windows\system32\guard64.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1533c7f2-b221-574f-bee6-53f6d596766d}\SET3485.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1533c7f2-b221-574f-bee6-53f6d596766d}\SET3487.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49855FCDFA62840A2838AEF1EFAC3C9B	cmdagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D03E46CD585BBE111C712E6577BC5F07_56B2A1FF8D0F5C5B4060FCF88A1654FE	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c5e8a040-8fa2-e145-b79d-7006c190afaa}	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95	cmdagent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FA0E447C3E79584EC91182C66BBD2DB7	cmdagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c5e8a040-8fa2-e145-b79d-7006c190afaa}\SET2FE3.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_466BAFE78D4077069B6C3828315C7C8D	cmdagent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49855FCDFA62840A2838AEF1EFAC3C9B	cmdagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c5e8a040-8fa2-e145-b79d-7006c190afaa}\ceserd.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\cesguard.inf_amd64_3e3769c667ae9359\cesguard.sys	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c5e8a040-8fa2-e145-b79d-7006c190afaa}\cesguard.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c5e8a040-8fa2-e145-b79d-7006c190afaa}\SET2FE3.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D03E46CD585BBE111C712E6577BC5F07_56B2A1FF8D0F5C5B4060FCF88A1654FE	MsiExec.exe
File created	C:\Windows\System32\cmdIcapCes.log	cmdagent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_466BAFE78D4077069B6C3828315C7C8D	cmdagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c5e8a040-8fa2-e145-b79d-7006c190afaa}\SET2FF4.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c5e8a040-8fa2-e145-b79d-7006c190afaa}\cesguard.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\cesguard.inf_amd64_3e3769c667ae9359\cesguard.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7833C286363AD25C70511661A83D581_8711B75F5BA6E4E1784F77B325FF96CB	cmdagent.exe
File created	C:\Windows\system32\cmdcsr.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c5e8a040-8fa2-e145-b79d-7006c190afaa}\SET2FD2.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\cesguard.inf_amd64_3e3769c667ae9359\ceserd.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1533c7f2-b221-574f-bee6-53f6d596766d}\SET3486.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7833C286363AD25C70511661A83D581_8711B75F5BA6E4E1784F77B325FF96CB	cmdagent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7850C7BAFAC9456B4B92328A61976502_9D6B342BF26404674BD1FDE5CB479C7C	cmdagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D03E46CD585BBE111C712E6577BC5F07_A4CA148408B3EE41DBEC65A0880988B6	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{c5e8a040-8fa2-e145-b79d-7006c190afaa}\SET2FF4.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1533c7f2-b221-574f-bee6-53f6d596766d}\SET3485.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1533c7f2-b221-574f-bee6-53f6d596766d}	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c5e8a040-8fa2-e145-b79d-7006c190afaa}\SET2FE2.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1533c7f2-b221-574f-bee6-53f6d596766d}\ceskbdflt.sys	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	MsiExec.exe
File created	C:\Windows\SysWOW64\guard32.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c5e8a040-8fa2-e145-b79d-7006c190afaa}\cesguard.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1533c7f2-b221-574f-bee6-53f6d596766d}\ceskbdflt.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1533c7f2-b221-574f-bee6-53f6d596766d}\SET3486.tmp	DrvInst.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\COMODO\COMODO Internet Security\tdtfiles\tdt_rsw_g304x_ecore_rfc.model.bin	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\drivers\win10\ceshlp.cat	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\translations\1036.lang	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.dutch.lang	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.koren.lang	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\cavwpps.dll	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\drivers\win10\cesintelTDT.sys	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\translations\1028.lang	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\cisbfps.dll	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\scanners\unpack.cav	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.italian.lang	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.vietnamese.lang	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\tdtfiles\tdt_rsw_g3010.profile	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\tdtfiles\tdt_rsw_g3010_normalizer.model	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\tdtfiles\tdt_rsw_g3010_rfc.model.bin	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\tdtfiles\tdt_rsw_g3020_normalizer.model	msiexec.exe
File created	C:\Program Files (x86)\Insec\InternetGuardian\InternetGuardian.exe.part	MsiExec.exe
File created	C:\Program Files\InternetGuardian\iconfig.enc	tempinstaller.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\translations\1040.lang	msiexec.exe
File created	C:\Program Files (x86)\Insec\tempinstaller.exe.part	MsiExec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\scanners\script.cav	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\virtkiosk.exe	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\translations\1046.lang	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.greek.lang	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.persian.lang	msiexec.exe
File created	C:\Program Files (x86)\Insec\tempinstaller.exe	msiexec.exe
File created	C:\Program Files\InternetGuardian\InternetGuardian.exe	tempinstaller.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\scanners\dosmz.cav	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\scanners\fileid.cav	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.english.lang.template	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\eula.rtf	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\platform.dll	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\drivers\win10\ceserd.sys	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\drivers\win10\ceskbdflt.cat	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\translations\1045.lang	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\translations\ComodoInstaller.english.lang.template	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\AmsiProvider_x86.dll	msiexec.exe
File created	C:\Program Files\InternetGuardian\README.txt	tempinstaller.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\scanners\dunpack.cav	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\translations\1049.lang	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\translations\1065.lang	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.czech.lang	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.japanese.lang	msiexec.exe
File opened for modification	C:\Program Files\COMODO\COMODO Internet Security\drivers\win10\cesboot.sys	cfpconfg.exe
File created	C:\Program Files (x86)\Insec\InternetGuardian\README.txt	msiexec.exe
File opened for modification	C:\Program Files\InternetGuardian\uuid	InternetGuardian.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\framework.dll	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\scanners\mach32.dll	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\scanners\mem.cav	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.hungarian.lang	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.turkish.lang	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\database\signers.tvt	msiexec.exe
File opened for modification	C:\Program Files\COMODO\COMODO Internet Security\drivers\win10\cesguard.sys	cfpconfg.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\scanners\smart.cav	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\cmdhtml.dll	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\drivers\win10\cesboot.inf	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.swedish.lang	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\translations\cmdres.ukrainian.lang	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\cavshell.dll	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\packages.xml	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\tdtfiles\tdt_rsw_g304x.profile	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\scanners\common.cav	msiexec.exe
File created	C:\Program Files\COMODO\COMODO Internet Security\scanners\bases.cav	msiexec.exe

Drops file in Windows directory 50 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e583bfa.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0BD3AA0C38438AD8.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD383AD91D53A3AB4.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF28A194AB3FD80D78.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CE4134F2-43E3-4835-B234-584D063134DB}	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI3E80.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2AF2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4198.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D15.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1E37.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI1F14.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC4361FE60E8DC486.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D45.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3F4D.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI3EDF.tmp	msiexec.exe
File created	C:\Windows\Installer\e583bfd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{CE4134F2-43E3-4835-B234-584D063134DB}\cis.ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DF85DD91EA26425CF4.TMP	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI3E12.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF19502136FFFDBD4A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1EF4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2300.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	cfpconfg.exe
File opened for modification	C:\Windows\Installer\MSI2167.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2812.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI3CA6.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{24FD4F57-704D-4827-BFFB-FA874ADA2AAC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4019.tmp	msiexec.exe
File created	C:\Windows\Installer\e583bfc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI22E0.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\ELAMBKUP\cesboot.sys	cfpconfg.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2271.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2842.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e583bfa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D84.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e583bfd.msi	msiexec.exe
File created	C:\Windows\Installer\{CE4134F2-43E3-4835-B234-584D063134DB}\cis.ico	msiexec.exe

Executes dropped EXE 14 IoCs

pid	Process
4924	Xcitium132.exe
424	offlineinstaller.exe
3636	tempinstaller.exe
1072	InternetGuardian.exe
1840	Xcitium132.exe
4864	offlineinstaller.exe
5044	MSI2300.tmp
3208	MSI2300.tmp
2256	cfpconfg.exe
4552	cisbf.exe
2836	cmdagent.exe
684	cmdicap.exe
3224	cavwp.exe
3112	cavwp.exe

Loads dropped DLL 64 IoCs

pid	Process
2216	MsiExec.exe
2216	MsiExec.exe
3188	MsiExec.exe
3188	MsiExec.exe
3188	MsiExec.exe
3188	MsiExec.exe
3188	MsiExec.exe
3188	MsiExec.exe
3188	MsiExec.exe
3188	MsiExec.exe
3188	MsiExec.exe
3188	MsiExec.exe
1596	MsiExec.exe
1596	MsiExec.exe
1596	MsiExec.exe
1596	MsiExec.exe
1596	MsiExec.exe
1596	MsiExec.exe
1596	MsiExec.exe
768	MsiExec.exe
1684	MsiExec.exe
1684	MsiExec.exe
1684	MsiExec.exe
3856	MsiExec.exe
3856	MsiExec.exe
3856	MsiExec.exe
3856	MsiExec.exe
3856	MsiExec.exe
3856	MsiExec.exe
2256	cfpconfg.exe
2256	cfpconfg.exe
2256	cfpconfg.exe
2836	cmdagent.exe
2836	cmdagent.exe
1308	regsvr32.exe
3224	cavwp.exe
3224	cavwp.exe
3224	cavwp.exe
2836	cmdagent.exe
3224	cavwp.exe
3224	cavwp.exe
3224	cavwp.exe
3224	cavwp.exe
3224	cavwp.exe
3224	cavwp.exe
3224	cavwp.exe
3224	cavwp.exe
3224	cavwp.exe
3224	cavwp.exe
3224	cavwp.exe
3224	cavwp.exe
3224	cavwp.exe
3224	cavwp.exe
3224	cavwp.exe
3224	cavwp.exe
3224	cavwp.exe
3224	cavwp.exe
3224	cavwp.exe
3224	cavwp.exe
3224	cavwp.exe
3112	cavwp.exe
3112	cavwp.exe
3112	cavwp.exe
3856	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs

Installer Packages

T1546.016

pid	Process
3656	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 47 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003e6aa7d03c0b469d0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003e6aa7d00000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003e6aa7d0000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3e6aa7d0000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003e6aa7d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	cmdagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	cmdagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	cmdagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	cmdagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	cmdagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	tempinstaller.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	cmdagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	cmdagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	cmdagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	cmdagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	cmdagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	tempinstaller.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	cmdagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	cmdagent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	cmdagent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\GrpConv	grpconv.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	cfpconfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	cmdagent.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DFA6CCA1-8A26-4298-BE03-252C8B573534}\ProxyStubClsid32\ = "{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{E8718E3A-1985-473C-9196-9A39AFB0028E}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F79BD84B-9279-44B7-A482-434B65811CC5}\NumMethods\ = "8"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E8321CA-014B-466E-ACCB-9DEF4A37726A}\NumMethods\ = "6"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10D82495-7F93-4C84-901A-65A9E1DED8EB}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08E55C52-1F4D-4D91-A6FA-E7444A59D528}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2714805B-8C18-46C0-A7BB-6BFC3D899EC8}\NumMethods	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CavWp.AvSigChecker.1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE82AC8D-7DFB-43E2-BF84-C8E3E52CFB28}\NumMethods	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E003499-1D81-4F6B-A37F-5242C291BAE2}\ProxyStubClsid32\ = "{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0007AEEC-58C3-4461-A605-D2F25EDFAA52}\ProxyStubClsid32\ = "{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8D2A0FA2-4CFF-41B4-8A2F-0668148AF86D}\NumMethods\ = "30"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EF085DFB-E64E-4483-B244-B97AEE78A41B}\NumMethods\ = "5"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CISSVC.CisAmsi\CurVer	cmdagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CIS.CisWmiProvider.1\CLSID\ = "{10F58851-4358-4E4B-8494-DF34393F41A5}"	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A7D8356F-B926-4209-9BB4-2224B7245133}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EE60D0A4-6690-4EF2-B811-6E1CC3271D65}\NumMethods\ = "24"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CavWp.AvBoostHelper\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17FC23A6-8D66-448B-B286-C7B0030A0889}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A8F46273-16B9-4009-AF0F-2EFA988DD75D}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1FE70F59-DA7B-445D-9970-5E6AEEACCE7D}\ = "ICisRmControl18"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{379DE05C-2339-463A-9BC1-BDC1F92C0CCA}\NumMethods\ = "24"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89B4AA46-166E-4206-B027-F380DC7C1A25}\NumMethods\ = "163"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81B0EDF3-1CAB-4B8A-BD36-C4DEFAC1DCF9}\LocalServer32\ = "\"C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdagent.exe\""	cmdagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E58853A5-06B5-4458-B7DD-69AFB65556CD}\ProxyStubClsid32\ = "{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E981C6A7-C5CD-4F19-9657-41DBB6C39614}\ = "IEnumStatConnections"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{52932A2A-24E4-43BE-982B-DC7ED8D40DFA}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BA5CCBBA-DC09-42C1-81CC-41DCCC7D0EE3}\NumMethods	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B9404811-42B6-41B1-AF40-B885ED9D818A}\ProxyStubClsid32\ = "{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C224215-DFEE-48CA-BA21-AB2920219D9F}\NumMethods\ = "13"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\75F4DF42D4077284FBBFAF78A4ADA2CA\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{9F70CAE4-E872-43DA-917C-71C02CCE2035}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CavWp.AvMerger.1\CLSID\ = "{E8718E3A-1985-473C-9196-9A39AFB0028E}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2C8CDF8-F018-4B6F-84D4-64BCD70E2A22}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}\InProcServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DD1CBA7-A94F-42E0-B896-4C8346B8046A}\ProxyStubClsid32\ = "{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D7147F4-5DA8-4B62-8CD5-2AACB9D285DD}\ = "IEnumBlockedFiles"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE4DEE24-6CFC-48DF-89C4-29BD4954B895}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E003499-1D81-4F6B-A37F-5242C291BAE2}\NumMethods\ = "90"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D69AE3A4-3DEF-4031-B711-3D051A47C14D}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C80170AF-0521-45FD-8296-43AA420C40A2}\ = "IViruscopeActivityDnsQuery"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CIS.CisCceIntegration\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0D11E551-B3C7-4E88-97D7-F76E9F716AD6}\ = "ICisRmControl11"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EF0145B8-32F6-4E87-BE4F-A89C51618E5B}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DA91D99-CA00-4FEF-8382-D03729716F44}\ = "IViruscopeActivityDeleteFile"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CIS.CisRmControl	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE4DEE24-6CFC-48DF-89C4-29BD4954B895}\ = "_IAvRtmOnDetect"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{15533C57-941F-44DD-A64D-869868F43471}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8D0E595A-9FE7-47FD-869B-3EA961147EEE}\NumMethods	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DF800BB8-B4FA-47D6-8A70-736C1C0A5E90}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E2CC28CC-68B2-440E-AE74-C93399CF37E2}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E883AD09-244C-4529-B1A8-E629A6D790BD}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A25A1235-5C5D-4B13-96DE-BDF07AA94CED}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D7147F4-5DA8-4B62-8CD5-2AACB9D285DD}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31A70E75-5CD1-44D4-A9E4-10650F15B1C2}\AppID = "{342A9490-7F70-4AE6-B553-9BA04288F8F6}"	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EF0145B8-32F6-4E87-BE4F-A89C51618E5B}\NumMethods	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6686FBD5-734B-44FA-9B3E-02C522299E59}\ProxyStubClsid32\ = "{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5D959EF-3D34-4635-A3C7-51D3659056A6}\ProxyStubClsid32\ = "{9F2D4924-C5F4-43B6-A4AB-C4161C4C2879}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E37FA5BA-9E34-49AE-8C97-2C9E537A5D24}\7.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C8B17C83-72DF-4BEE-9A46-D0F234BDE42E}\ = "ICisRmControl31"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D62F72A3-5E47-4339-8535-E06603FD8EC2}\NumMethods\ = "109"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C224215-DFEE-48CA-BA21-AB2920219D9F}\NumMethods	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ABA12680-8559-43F8-B104-1A19428C61EB}\NumMethods	MsiExec.exe

Modifies system certificate store 2 TTPs 64 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\F89A37FB24B0417D93BFB760B12121F5A358F9D9\Blob = 0f00000001000000140000004af632248aedb7ff558427f06389a5acbf941e7c030000000100000014000000f89a37fb24b0417d93bfb760b12121f5a358f9d920000000010000004e0500003082054a30820432a0030201020210474bf5dfd0395ca926b2f2367e46dce8300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3136303130343030303030305a170d3136313233313233353935395a3081b9310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303117301506035504090c0e313235352042726f61642053742e31223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100b512f8d9138a6e9889f0afac2c1f2402e9fe96acc0b45a85110b39d9d8de6998199750cb863df84a12796591b7f5426bc0f101c0b6afd1bd5e1f14e4c9805e4f6eab19b893342a581e832bcd90776a9eca9ed04acf2776b4e4bcea4f31824e76dd03fd1ad5376c1bfa095b474350ad21c618884680acf98350336c5c21308188bc942bcbdfc456828ea1fa7f1ae3e8b01a4756348120db21f6c32e0b968e65351c1f46db2a0e94fdcfb0e7e0ff8f26c26c1cb649602b0f1a2f5eb3a546f8e713831f6474d9f79c725cb32cfcbc9999520e2b8012fa758548bc909bc1c5adedd904af9ca03de0fbc0a45d7c5ebc571787e1e7d8ff5c8d627368997dce3beffb2b0203010001a382018930820185301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604141221ea3afddda8a617401cf0f7252824021e4559300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010505000382010100067db05f13966dfcef07fa46bc1de610588943d981e2f71f0035cf57df75efed23789498faf85c62ce1ed4f5e8415105ec7febfb50a26ff1c551f7e23ec81f2635b29f444a1db4780623ff96421e2019b125687b083921490d97cf2d281d1e44d114692c61df0da4ff82c7d8820e710879c644fea724977a52be3cb8135e3717d5eb144a07dea4a6a70087ccde43f7f62b8c8cced2887cc7e3b625e02e855840fb585a2066f2bf345a8ecf50a3a443250382cbe9e9177f5f666266a49c68262addcc6cfc25bd66601b5799e459318dcd250b0ddeac26f07e2126794054ff0f97cc84e70741601e7941f0a7a2d62a4ee10723215efcf93d3933517e87b00ef2b5	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E73C45BE88C6FBE7562D8B9D1B7E4FE03E29811D	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\D70D7D00CA12E1B3E20F3BF7534DEB2C2E7C2404	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\31D019FC7AB697D57D9C4AFB340ED7C4D10400DF	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\AAEEC9D4420C8885AB80A78275A504E13DF78F63	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\F5F8EEAC5A0127025E936C01493D1C11D5012BA4\Blob = 0f0000000100000014000000682f39d016e5bbf4cddc31964847e835e2cc777e030000000100000014000000f5f8eeac5a0127025e936c01493d1c11d5012ba4200000000100000089050000308205853082046da0030201020210147a12fd3751e51604ae354c04a6a272300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293130312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303130204341301e170d3133303231383030303030305a170d3134303431393233353935395a3081c8310b3009060355040613025553311330110603550408130a4e6577204a65727365793110300e06035504071307436c6966746f6e31283026060355040a141f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e207632312830260603550403141f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100eb8a277c9120c5993641acf5ab7ba26b4946c7da781f59042bade17eae013d296dd6c6958729cbc17bf9987feac0cd3f05dadbbcf9a5ae6b885985cbbb7b7385d1137388939499b437bf8ed45e001b1d70827842edb1b872025f856fa6c57ed017b5d0df789ae9172c424038cdc408a9dc6615369327c9037f1aebad6f1dc57edb1796ba924f77febf6841ea654595ddb7ae00a7c9dde8489da2d54a3cfd8831ecc8ece15eb0a0725d37c548651cc6f5b17880f4ebab1e5e61f3b21afeb5ebfc1d9be5e44695a6e4b90265ab8f3d85d917e919dd16526fce540e96e2d339b246484384dafcc8dcf8c7b5ecceb22ad0463e5e9b72c37b3bc1c095f9e58a4373b90203010001a382017b3082017730090603551d1304023000300e0603551d0f0101ff04040302078030400603551d1f043930373035a033a031862f687474703a2f2f637363332d323031302d63726c2e766572697369676e2e636f6d2f435343332d323031302e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307106082b0601050507010104653063302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303b06082b06010505073002862f687474703a2f2f637363332d323031302d6169612e766572697369676e2e636f6d2f435343332d323031302e636572301f0603551d23041830168014cf99a9ea7b26f44bc98e8fd7f00526efe3d2a79d301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d0101050500038201010005842bf05f73d4686fb6732dae68e9737fef8ce405f98d81530eb83e337c0d5db63fb8a53046401776bae043f46bb1e3af164a76666265cde608d81b37b049125b7c5fae6c1c952f769da55293b0e63ecf8d783ec86ba5c44feabc1867c1fdb1e032e34e118f0bc33095aed6b52f60b3b694c28faf7ea7d0217810c81fc4c41fb2f1e226c8685963910c4d4bd44237f86e0ae5d1495d28ebc6ab142dbd93ff23bed1cc987a1aaf8dd5d6c0ab8b85986b5790eb6d042815ee3a80e65ce71b9ca3cce6ce330c97ff764f6352d2e79f926554429360df991394fe6268865faabb12ef3f87c9f8079f69aad532ce3ed6a2af09f2a39fa123896ba646b2ca5e3c0173	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\98D9D6CB8497105298536D86E468DD0323DCF318	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E73C45BE88C6FBE7562D8B9D1B7E4FE03E29811D\Blob = 030000000100000014000000e73c45be88c6fbe7562d8b9d1b7e4fe03e29811d200000000100000068050000308205643082044ca003020102021039f51ff05883bd411616bfa62c1c74ef300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3134303430313030303030305a170d3135303430313233353935395a3081b9310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303117301506035504090c0e313235352042726f61642053742e31223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100efe97b1f62481eb08572c14dac7faf5de0544ca4e0b636be10f09f0481ec5f08176888bc5da73ccf1debfba8d16449ad4ca6f017d01cdb3b41ff05b193438132cf6b7c6b90e35289c67281f9cb59d25cf067d17cf3f325384aa1e4f066a193559119faaf864cb6998d5f12109c938c6fe76af32817a3cd004e87fd0d055439886eb41734f78c1e9059dc7de0a2e4839b83441e7b5cd2c2e90628aeb7803567b321950f564557d13ede1519afb734e6bb4d6c1bddf59070342b7f478dd5efc6efb488c1dc1e8acb86fe60fc433070c560e76c30bd74661f1ff91cafb763c8fd32c041752d01fd0df035fb57ef7f4d7117fe4377e9a382540142fdd2441d00f1f70203010001a38201a33082019f301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604147835e6598d5572201de9a55f8a527b1e51ff37b7300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30180603551d110411300f810d636140636f6d6f646f2e636f6d300d06092a864886f70d0101050500038201010039881a7fb87fae796492551ea2dc77b2a01f17e98a2a584ac9f72d0e8f2740f777dba416b35bc88cf30b4b8b05009892ab13e0c4fc7cbe9a177bffea416446d39b6cf91f65967d23f907549ff56a424b307a9a9c48eacd8b9cba65be4ca3d92baf5958dd58c6e41cc35699a17e899a7a8d6df61c2149c629af40638d02613298d112c3597122ae120dec12f2537d585ed9525f4b64926903fba082a7c0f1f04517477a17ab5ed1f9ec2bc7e7154ad0c1822952de2d1cd7ad2cf3929d67a8b491f9401339ca7bcc3d81ee5b93b5a6c5a4bbad53cbae560cfb54fb39ab932d32280a25cbcd9850b68ab6361b04fa2a2ec9b09c5cc8842b832f72e4e919fdcaf5e1	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\8D170F91DE1907BF03CD9F1DEBFEF61E3D3670CC\Blob = 0f0000000100000014000000aa0ce7c3ca656a11aca42410066480cc1cddda610300000001000000140000008d170f91de1907bf03cd9f1debfef61e3d3670cc2000000001000000130500003082050f308203f7a00302010202102c01585522e8fa61138aefa4f627eea8300d06092a864886f70d01010505003081b6310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f7270612028632930393130302e06035504031327566572695369676e20436c617373203320436f6465205369676e696e6720323030392d32204341301e170d3130303330323030303030305a170d3131303330323233353935395a3081cc310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a6572736579204369747931283026060355040a141f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e207632312830260603550403141f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30819f300d06092a864886f70d010101050003818d0030818902818100b78b6ba1d6ad632f49c5b7ad19ac17479b5bb3d66034124eba28c27dc98235f41b4996e53da458d3a5d5b7539f44126b203fbb8a9201b13d7860c645f83f2633f8d9e08e2a424f3ca50e48aae25614645c3fe3fea64764476478569e5e0a617568cb78a79f933cc071fd9a0aa0e74371f184a63bb6e82962416ac3c6263602890203010001a38201833082017f30090603551d1304023000300e0603551d0f0101ff04040302078030440603551d1f043d303b3039a037a0358633687474703a2f2f637363332d323030392d322d63726c2e766572697369676e2e636f6d2f435343332d323030392d322e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307506082b0601050507010104693067302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303f06082b060105050730028633687474703a2f2f637363332d323030392d322d6169612e766572697369676e2e636f6d2f435343332d323030392d322e636572301f0603551d2304183016801497d06ba82670c8a13f941f082dc4359ba4a11ef2301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d0101050500038201010023e7d8b884c4cb85444c8cf519168ad5377a4c6cd1210690ef8ff7e3c1d26395f54eec8be2e3673c46cf0e7dae32818bad45ed786d10d63c968001c35f455b3f828cd7f8cf995c6b7bfb2bd915c802f49ec9c5a74870af2740950fc71d8cb7512bea2ff1ad13e9f3615fc515c8fd35b0df32293ef5be1c660e544682d2b12968d0ea991f1ce83d69127de6e9b90898536f6d2d2e345a5174b970694af8415a9866a64c786047627717e382a445877348cfbcc631c2fba28185efbe4ae5bdfa9b7c682ac66797c80528aa9ec74d05eb6d6c1b376b439fe312329968f466e345f16ff92c7cbcfa6a6116cd1cfba2bf32c066c2c8181028a315914824130b95abb2	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\76FBABF1EADED3B91DD7A76A6678301F1F87AA97\Blob = 03000000010000001400000076fbabf1eaded3b91dd7a76a6678301f1f87aa9720000000010000005a050000308205563082043ea003020102021100c5144cf5e535f748a9afa6fc384c0775300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3138303130343030303030305a170d3139303130343233353935395a3081c4310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100e7cbaab2f00e8651180214f1ed65f1eb65ecd2f22b19bdc1d1d2c868f9e0e39acce5af71db4f0dce385be0a9d9893de4c279fd4d443102a027e15e1d61162a3215dde877f8bf3fe0683ed7c43cd7d43f1f1022739cb1f3753d70025a598b42101c9df0cb4fe5bf88417379322b139c038443b11e5bd176d6a4104ee46e6c977a23b6ebf0b37c581c2eb8175c19847a4515dbc2d1cba91a643b66a1d7ed2693894015fa5e3090c634ab718f91869cc46625e9b82208e5a3f645bc22bf0d30c0192c31af3a41d441f9c5c775b7d4c169d5eb30f6d9cf925db9d7ca6f709cda6ff64fbad2094e83cf5bdcdf7e20b0a26187ee5a54d0e6bd5d438fd45f4213f996f10203010001a382018930820185301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e04160414a4cf9fa30897a5d428ba7d95b4c530d622c8bac4300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010505000382010100753282ba1f92581fd0486a791deea4b862c2ed4b37f7dedba7a971004dae9d87c6ce89cbd3fe730689f3b30c29830b15b45e023a8b2a0f1d7624ec0d1171abb783d9bfbe2f0a5919eac664f584423d302009ec5ebcabed2fdf775ecc36aba13147d6692833f58f630fff673d6154263421e39aa66111e3ba1a5555651f9dea4f35455e1dfb49a15a1c65d648acd94c68c105a345419e8f4dd9dc7a66ad2d5853982bcea59b9735c186703b164e97844fe093deb4af53f097b59a21c77b896b20942183bb34db84ac0d460f5752876c9fe3f39ce9bcd2a14d7a9fc7b8b3d25f721af0de615c4609ad959c212f1baeb561d0108a90b20fb78f56de7c0817209d15	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\D70D7D00CA12E1B3E20F3BF7534DEB2C2E7C2404	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\76FBABF1EADED3B91DD7A76A6678301F1F87AA97\Blob = 0f00000001000000140000001dcb79ef0387b641fad2722ff112e69ccc73389f03000000010000001400000076fbabf1eaded3b91dd7a76a6678301f1f87aa9720000000010000005a050000308205563082043ea003020102021100c5144cf5e535f748a9afa6fc384c0775300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3138303130343030303030305a170d3139303130343233353935395a3081c4310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100e7cbaab2f00e8651180214f1ed65f1eb65ecd2f22b19bdc1d1d2c868f9e0e39acce5af71db4f0dce385be0a9d9893de4c279fd4d443102a027e15e1d61162a3215dde877f8bf3fe0683ed7c43cd7d43f1f1022739cb1f3753d70025a598b42101c9df0cb4fe5bf88417379322b139c038443b11e5bd176d6a4104ee46e6c977a23b6ebf0b37c581c2eb8175c19847a4515dbc2d1cba91a643b66a1d7ed2693894015fa5e3090c634ab718f91869cc46625e9b82208e5a3f645bc22bf0d30c0192c31af3a41d441f9c5c775b7d4c169d5eb30f6d9cf925db9d7ca6f709cda6ff64fbad2094e83cf5bdcdf7e20b0a26187ee5a54d0e6bd5d438fd45f4213f996f10203010001a382018930820185301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e04160414a4cf9fa30897a5d428ba7d95b4c530d622c8bac4300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010505000382010100753282ba1f92581fd0486a791deea4b862c2ed4b37f7dedba7a971004dae9d87c6ce89cbd3fe730689f3b30c29830b15b45e023a8b2a0f1d7624ec0d1171abb783d9bfbe2f0a5919eac664f584423d302009ec5ebcabed2fdf775ecc36aba13147d6692833f58f630fff673d6154263421e39aa66111e3ba1a5555651f9dea4f35455e1dfb49a15a1c65d648acd94c68c105a345419e8f4dd9dc7a66ad2d5853982bcea59b9735c186703b164e97844fe093deb4af53f097b59a21c77b896b20942183bb34db84ac0d460f5752876c9fe3f39ce9bcd2a14d7a9fc7b8b3d25f721af0de615c4609ad959c212f1baeb561d0108a90b20fb78f56de7c0817209d15	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\6CD253D636A7B4D0E0981431BC064061A9853ED9\Blob = 0f00000001000000200000006f962c708f9b1bde348d5d34a63756527055479d67e82040573e57c7f633154d0300000001000000140000006cd253d636a7b4d0e0981431bc064061a9853ed920000000010000001b06000030820617308204ffa003020102021032327facb1bd6f1fa93473ccc515fd82300d06092a864886f70d01010b0500308191310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564313730350603550403132e434f4d4f444f2052534120457874656e6465642056616c69646174696f6e20436f6465205369676e696e67204341301e170d3138303132343030303030305a170d3231303132333233353935395a308201153110300e060355040513073339313038303531133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e311a301806035504090c11313235352042726f61642053747265657431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100b7713778a66667b8cd67f828f378f80a5507c4e8aa143cfd5b9b953ab16d04a965dcd386a35efe8378c1e0e5ceaf124f188102958962014e493cd80f11fc2ba339953a8bb71a9f030ebbe8742b4252ab465a2d41a829508a9eef5d34d171fcf0b5be026fe15e1a70288b2ecd4af1332924d53c0eefe5c7033482769cae8b5c5e8d59033fac40e94d714c5cd05e8db6f0edb71bb26565d52a025f35323203e9a7846d00a235f973d1e43f29a81dcd1bfef625d373f94a51cc8d2be8ee69702a73a694da69d9b0fbae7d1dee353683a2037a2019b9260a1b53f6c89d945b384c275670bdfac333301504af00749373356a1e7a422eb9363bdab713f9ad6b5bb1970203010001a38201e2308201de301f0603551d23041830168014df8ff3200ce9caa604d85b58372a3dab46dc8349301d0603551d0e04160414e18081b3e9396b7109e8b2add6c3d20ebf4b4814300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010601302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f43505330550603551d1f044e304c304aa048a0468644687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e63726c30818606082b06010505070101047a3078305006082b060105050730028644687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33393130383035300d06092a864886f70d01010b050003820101004bc17929ea82f3c4787f7b29b69edb09e169797a9f4cd233f035412d2b9c586e352d2c0d1cd530a946a91ccd8858453573f0b45a0cdc743d662af4761420489adadbd9a84915b697f96ed1e49786c53000eb12555d3b2957eec18279326020737e2e3e4d621856026169ad6f6cf18ee7b59d5b6a7e6d8c252fa1a15363ec89a6efe5efdf4b260ad35c6a0e1db0250d1eb66ea7b91f15e0f57ecc0541e1ad74a2069f717dec0b1f03101b6812c13f64264f8c40a3614ffb8ccabedb974cda14eb50c061d5cd23dc7735cd0bcfdcef3fd178c1f95594a591031d05c8554cb5fe6fd23cb95931bf847f5b525a269aeac0336313e8f6e81ccb1692d86993724f709e	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\31D019FC7AB697D57D9C4AFB340ED7C4D10400DF\Blob = 0f0000000100000020000000c6dcba6192a502eb4e7caebea466be00c8abbf2269740faa6156a5341ba0a2be03000000010000001400000031d019fc7ab697d57d9c4afb340ed7c4d10400df2000000001000000250600003082062130820509a00302010202101b427b060e2866bfb586cc267e1c3eaa300d06092a864886f70d01010b0500308191310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564313730350603550403132e434f4d4f444f2052534120457874656e6465642056616c69646174696f6e20436f6465205369676e696e67204341301e170d3138313230343030303030305a170d3231313230333233353935395a308201093110300e060355040513073339313038303531133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b3009060355040613025553310e300c06035504110c053037303133310b300906035504080c024e4a3110300e06035504070c07436c6966746f6e3116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100ad390c8bc919005d5894a91a9585ef887fbd7c2341ff5ebb3efc6f645a66c55e6da11febce740e53ed9416284dfc7d142e4dc21f99753b5f60ae9aadc764b59efd9ffd33b20ae1c54eba629408a1b095a59cf4af0ad9db9bc494250154dcd0edefcec62e4b248d9a793b703aa15255baf3553fa59d4dc558ba4303af630bb626cd6627e0c4a45764ec3b286c38ab2499f9dc13eefdffa7841297ff533b47061b9aa3ff09ee3f04a7b10ba70894e53f3352b1f60eddfc021a66546e3392795bb6ae49a92f189ec2a7cdd9a935fab33a5ce7fc16c4b7e8ca13b4551d38a6a7c0658298a5adf5f6796675f58e1bb4ce410ff704bc5e845bc1ef83c18a0d50e137370203010001a38201f8308201f4301f0603551d23041830168014df8ff3200ce9caa604d85b58372a3dab46dc8349301d0603551d0e041604142d99b81962209042dc650eb36ec07ad996e48c4d300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010601302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f43505330550603551d1f044e304c304aa048a0468644687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e63726c30818606082b06010505070101047a3078305006082b060105050730028644687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30440603551d11043d303ba02306082b06010505070803a01730150c1355532d44454c41574152452d33393130383035811473636f742e7765697240636f6d6f646f2e636f6d300d06092a864886f70d01010b050003820101007f4d3e6594a3e380fac36b00e97ccacce4786be2ecc13cf37e737aaca0328bb8bfdcd513daff94aba1c7ee00cc8a3bd073157a812f6e31f772781d0bb922a8b86932b296c2312cdf3b239c42bb443b4b1b89b36de34a7fae65ac63eb6ead8812f8d373fa6f1a4e8d9e62eb004caae3639e41e08ed48d640b04725b09b4411dc083587e7fe24b33d90677677960efa6299cc85c4b2bfae4cdfe36581d25e029f6af1a7e77f502882d87597f3cc5bb450a71f9fd57f43b321baa4cbe5213a48a2c5b785a9de4103d5029e4db79403e98784e51379d45a86996b183469e98470731d1a603eaa443a05527aca62f51631722dc0dfe5d74c8298d2aed885d34c9be61	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\03D22C9C66915D58C88912B64C1F984B8344EF09\Blob = 0f000000010000002000000049e1d274c369098b74ade85fdc204a4093683e58a6a4e2d53e386e1d3a3172ac03000000010000001400000003d22c9c66915d58c88912b64c1f984b8344ef092000000001000000220600003082061e30820506a003020102021100909bd8c9e6e31da161991dd98a992433300d06092a864886f70d01010b0500308191310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564313730350603550403132e434f4d4f444f2052534120457874656e6465642056616c69646174696f6e20436f6465205369676e696e67204341301e170d3136303131323030303030305a170d3138303131313233353935395a3082011b3110300e060355040513073339313038303531133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b3009060355040613025553310e300c06035504110c053037303133310b300906035504080c024e4a3110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303116301406035504090c0d313235352042726f616420537431273025060355040a0c1e436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e633127302506035504030c1e436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e6330820122300d06092a864886f70d01010105000382010f003082010a0282010100d9c268a473b03c64865a19f078bd931c10a3f69e1bb034714399f815cc77ddc8bd02154aa978d07f397bbacf382809acbbb80bee3079b1d7337e1590e95090fa820fd775ecbcceb3aa37a5dfaa002e0a11bab6eac483086de41eaa09b76bc84c703a5abb4416d27a9d91a162274264b68a44faeba0676ff317d4976688b0498b4a0fb721e82b66dd4ca0030261f9d50b34b74df3eb8241344a1fe67b8fb74fb9d9ca7a0ab5dfee12c247ac5a971f02a775b5817c7567fa329163bc346070b0c429e678f0cb1789488878a1b934f7820d6e5687da101b3f85faafc631122c7f12131fc472a0a585b40d490ba440cf36f3f289f70fc507788c573bb2cad81185770203010001a38201e2308201de301f0603551d23041830168014df8ff3200ce9caa604d85b58372a3dab46dc8349301d0603551d0e04160414e44bdb3217f4a88a2348bf0c261f3d65858737fd300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010601302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f43505330550603551d1f044e304c304aa048a0468644687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e63726c30818606082b06010505070101047a3078305006082b060105050730028644687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33393130383035300d06092a864886f70d01010b0500038201010058c500c5a67c7a185c5c643fc2185072f2fdbac641b92017efd129efda442175d7e77f53e87a9325cb6c6fdc0aab804bc1248ecc295fa352bdaa214b34496bbafaffcef1c9822242eb0bda7431015bacade8904e7abe4343bf182a2f1a6ba4b10e9ca843001a25787977095918731bfd850e42373e5c0258693090560c5584b95458b82a90d12876474ba1d3cb93cf8eac26b4fd122890fe0f6bdc2631020242d87646d20731b98a4b735bc9240d2f3c4c12e7825ff3fdbb7af84855892fb292a3a0600534710785897d0666c6f2f7a9b7784a020f9f74acaa0cd8d8651af4e6b1c56e000c97d90fbe64e6f49ef2969bd6dc5e4f5841b148d1ca19118c4c6b29	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f1030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\AAEEC9D4420C8885AB80A78275A504E13DF78F63\Blob = 0f0000000100000014000000f5573d215cbfc1f23aa5f10e8cc9b1b56a89c329030000000100000014000000aaeec9d4420c8885ab80a78275a504e13df78f6320000000010000004f0500003082054b30820433a003020102021100b7b845b45da5c6005dcd7eda4d8c2f94300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3135303430323030303030305a170d3135313233313233353935395a3081b9310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303117301506035504090c0e313235352042726f61642053742e31223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100e5f713b0311badd1b9bfba6140900b94304d8b54cbbd334e44af09addb457a07d451677595b5fd58634ba6de15c31a589307b3f06ae03a71faf301a38adc8b4551eb4a0a5f03b879cfe14c83683cdf303e813af00d7580b8c698930b706f2129b22e07896973e536db15bc595ba61064844c778e0c0c1d311543a4cc0cd3f08d03b8e7f83824e545f7166e146958d8fe0ff8ddd5082b0b7d46d001d6522885f1f9984c5c1c128120e870acc31c791d2a62cef6ecdf28f20f5385f96d59b9ad571e980d1ae120263859e1c184d5a072dc6e84d8636fd795163c3f359050f5aaaaef14c77547260547ead00b06ba4c976cac8345d8582044468a67121fa0bb22490203010001a382018930820185301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e04160414a3e91fb45376d935db1e36a801470ea0c52520dd300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d010105050003820101001dece50ca6750a8c01517ce5d8511a13c14fa76fb2d8bf2c9b4f136522ff18271d12ba269c4bad9c3250331a712998c55780d5e66be856233bf4e30557657568e1e2b0955580a2a14d5cd153df7751e0251d5616a6855a3f1d087b7d1c1dab0ed79aff614d7316fca143eeb791e5e8c48fb4574f1805210704e3957c5802f654b94177bfe5e36353d80125335e7d870cbf0c87d3809f9203a1120e5f196ee5c6fe81128ce392a9d5b0126b2b38447e587c51ab2fb95bd97d3d2621409f074b584f013ba552aba2de6d8a3afa63e164ba9ffc3b19980e36855885a0f66c17315e0302ac4556e283aa970dacffc004f342a9f408c5886bb41e70a1b8a636c24cb1	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\872CD334B7E7B3C3D1C6114CD6B221026D505EAB\Blob = 0f00000001000000140000005595481af6538298bd0e35edb6d7de5ceee313f6030000000100000014000000872cd334b7e7b3c3d1c6114cd6b221026d505eab200000000100000059050000308205553082043da003020102021024be55999e338f74f91f0f4570845e51300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3137303130363030303030305a170d3138303130363233353935395a3081c4310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100ed95073c8ec3d17a4c21362d65d31f6835641be6a0d9a9d5072d3a6e00883eea41fca3f5a0b1d74693f49a26b99d2d601292be9cfda68fdaba56544fd75cbf1123626a2890d27cc8de2fbd504f6ac74255481483fcf45458f1887e8d5a3767c1fdb427ea7021ca9709451de51c1fa529f920e478de2d1c19e5e09d0168326d9257f5d4dda80112835171a125a8d34125f1237a2100fe79eff05d78d8a52113510c01f74d43f8884b559a5c1bd70b36c599594bd567fe3a533eadc6450a74e4922d4ccc525ba35a1844c190a6f3a4d34a48e7b852a26ea446cdaf4b8de433dd10efca232a605d88617116c1b632f37a87c3b1de4a317fec53ee9aa87cc9f07e790203010001a382018930820185301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604145cfe6910a18681d46ca19cb26662da9ed10a524b300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d0101050500038201010086d177654176251a873d7a8023bcb603de50958307f4f54da2988e652be3005cf46516fcdbd42e3d933bfc05b7f0f87d4410c12f58f4ec0f1926e9b1a2f525a59575266afac8493dab23ccb9fd4f4fd26dba1db7491789c96c9e2ecf609e6c71d6cd868b9c34be32f99f1f6315656df7b3c10e18e3074bb8da6b8e22a55cebb7b3c79e251a8a53d0d4b7d044fa3d00db8e674f163d60f24d2ab87719c4fef1ea2eb87814e6efe2390dfa9c19f2b57287e048496b7ce9c8b990fe54b58d901bb722cccab45b3cea1322108a15f33392a612de66f646a5b4cf51b3d12d481b86b2a32f59ee94abdc13889480d47c1479930733f69b2391ff1a8455385326054fa5	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\AAEEC9D4420C8885AB80A78275A504E13DF78F63	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E73C45BE88C6FBE7562D8B9D1B7E4FE03E29811D	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\6CD253D636A7B4D0E0981431BC064061A9853ED9	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F8DB7E1C16F1FFD4AAAD4AAD8DFF0F2445184AEB	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\16232A798863E5950F9F44977A033CF91793D8F1	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf50f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\39488FE6BE0D00E76D475BD2902442A541A0E1A3	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E35E6F46A1A9A4D18A4DAA298BDA4D1E8879236E	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F14CDC50FA95DFA78F9488E6A96FF0B4011F460	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\8D170F91DE1907BF03CD9F1DEBFEF61E3D3670CC\Blob = 0300000001000000140000008d170f91de1907bf03cd9f1debfef61e3d3670cc2000000001000000130500003082050f308203f7a00302010202102c01585522e8fa61138aefa4f627eea8300d06092a864886f70d01010505003081b6310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f7270612028632930393130302e06035504031327566572695369676e20436c617373203320436f6465205369676e696e6720323030392d32204341301e170d3130303330323030303030305a170d3131303330323233353935395a3081cc310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a6572736579204369747931283026060355040a141f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e207632312830260603550403141f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30819f300d06092a864886f70d010101050003818d0030818902818100b78b6ba1d6ad632f49c5b7ad19ac17479b5bb3d66034124eba28c27dc98235f41b4996e53da458d3a5d5b7539f44126b203fbb8a9201b13d7860c645f83f2633f8d9e08e2a424f3ca50e48aae25614645c3fe3fea64764476478569e5e0a617568cb78a79f933cc071fd9a0aa0e74371f184a63bb6e82962416ac3c6263602890203010001a38201833082017f30090603551d1304023000300e0603551d0f0101ff04040302078030440603551d1f043d303b3039a037a0358633687474703a2f2f637363332d323030392d322d63726c2e766572697369676e2e636f6d2f435343332d323030392d322e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307506082b0601050507010104693067302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303f06082b060105050730028633687474703a2f2f637363332d323030392d322d6169612e766572697369676e2e636f6d2f435343332d323030392d322e636572301f0603551d2304183016801497d06ba82670c8a13f941f082dc4359ba4a11ef2301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d0101050500038201010023e7d8b884c4cb85444c8cf519168ad5377a4c6cd1210690ef8ff7e3c1d26395f54eec8be2e3673c46cf0e7dae32818bad45ed786d10d63c968001c35f455b3f828cd7f8cf995c6b7bfb2bd915c802f49ec9c5a74870af2740950fc71d8cb7512bea2ff1ad13e9f3615fc515c8fd35b0df32293ef5be1c660e544682d2b12968d0ea991f1ce83d69127de6e9b90898536f6d2d2e345a5174b970694af8415a9866a64c786047627717e382a445877348cfbcc631c2fba28185efbe4ae5bdfa9b7c682ac66797c80528aa9ec74d05eb6d6c1b376b439fe312329968f466e345f16ff92c7cbcfa6a6116cd1cfba2bf32c066c2c8181028a315914824130b95abb2	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\F5F8EEAC5A0127025E936C01493D1C11D5012BA4	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\AAEEC9D4420C8885AB80A78275A504E13DF78F63\Blob = 030000000100000014000000aaeec9d4420c8885ab80a78275a504e13df78f6320000000010000004f0500003082054b30820433a003020102021100b7b845b45da5c6005dcd7eda4d8c2f94300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3135303430323030303030305a170d3135313233313233353935395a3081b9310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303117301506035504090c0e313235352042726f61642053742e31223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100e5f713b0311badd1b9bfba6140900b94304d8b54cbbd334e44af09addb457a07d451677595b5fd58634ba6de15c31a589307b3f06ae03a71faf301a38adc8b4551eb4a0a5f03b879cfe14c83683cdf303e813af00d7580b8c698930b706f2129b22e07896973e536db15bc595ba61064844c778e0c0c1d311543a4cc0cd3f08d03b8e7f83824e545f7166e146958d8fe0ff8ddd5082b0b7d46d001d6522885f1f9984c5c1c128120e870acc31c791d2a62cef6ecdf28f20f5385f96d59b9ad571e980d1ae120263859e1c184d5a072dc6e84d8636fd795163c3f359050f5aaaaef14c77547260547ead00b06ba4c976cac8345d8582044468a67121fa0bb22490203010001a382018930820185301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e04160414a3e91fb45376d935db1e36a801470ea0c52520dd300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d010105050003820101001dece50ca6750a8c01517ce5d8511a13c14fa76fb2d8bf2c9b4f136522ff18271d12ba269c4bad9c3250331a712998c55780d5e66be856233bf4e30557657568e1e2b0955580a2a14d5cd153df7751e0251d5616a6855a3f1d087b7d1c1dab0ed79aff614d7316fca143eeb791e5e8c48fb4574f1805210704e3957c5802f654b94177bfe5e36353d80125335e7d870cbf0c87d3809f9203a1120e5f196ee5c6fe81128ce392a9d5b0126b2b38447e587c51ab2fb95bd97d3d2621409f074b584f013ba552aba2de6d8a3afa63e164ba9ffc3b19980e36855885a0f66c17315e0302ac4556e283aa970dacffc004f342a9f408c5886bb41e70a1b8a636c24cb1	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\31D019FC7AB697D57D9C4AFB340ED7C4D10400DF\Blob = 03000000010000001400000031d019fc7ab697d57d9c4afb340ed7c4d10400df2000000001000000250600003082062130820509a00302010202101b427b060e2866bfb586cc267e1c3eaa300d06092a864886f70d01010b0500308191310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564313730350603550403132e434f4d4f444f2052534120457874656e6465642056616c69646174696f6e20436f6465205369676e696e67204341301e170d3138313230343030303030305a170d3231313230333233353935395a308201093110300e060355040513073339313038303531133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b3009060355040613025553310e300c06035504110c053037303133310b300906035504080c024e4a3110300e06035504070c07436c6966746f6e3116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100ad390c8bc919005d5894a91a9585ef887fbd7c2341ff5ebb3efc6f645a66c55e6da11febce740e53ed9416284dfc7d142e4dc21f99753b5f60ae9aadc764b59efd9ffd33b20ae1c54eba629408a1b095a59cf4af0ad9db9bc494250154dcd0edefcec62e4b248d9a793b703aa15255baf3553fa59d4dc558ba4303af630bb626cd6627e0c4a45764ec3b286c38ab2499f9dc13eefdffa7841297ff533b47061b9aa3ff09ee3f04a7b10ba70894e53f3352b1f60eddfc021a66546e3392795bb6ae49a92f189ec2a7cdd9a935fab33a5ce7fc16c4b7e8ca13b4551d38a6a7c0658298a5adf5f6796675f58e1bb4ce410ff704bc5e845bc1ef83c18a0d50e137370203010001a38201f8308201f4301f0603551d23041830168014df8ff3200ce9caa604d85b58372a3dab46dc8349301d0603551d0e041604142d99b81962209042dc650eb36ec07ad996e48c4d300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010601302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f43505330550603551d1f044e304c304aa048a0468644687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e63726c30818606082b06010505070101047a3078305006082b060105050730028644687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341457874656e64656456616c69646174696f6e436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30440603551d11043d303ba02306082b06010505070803a01730150c1355532d44454c41574152452d33393130383035811473636f742e7765697240636f6d6f646f2e636f6d300d06092a864886f70d01010b050003820101007f4d3e6594a3e380fac36b00e97ccacce4786be2ecc13cf37e737aaca0328bb8bfdcd513daff94aba1c7ee00cc8a3bd073157a812f6e31f772781d0bb922a8b86932b296c2312cdf3b239c42bb443b4b1b89b36de34a7fae65ac63eb6ead8812f8d373fa6f1a4e8d9e62eb004caae3639e41e08ed48d640b04725b09b4411dc083587e7fe24b33d90677677960efa6299cc85c4b2bfae4cdfe36581d25e029f6af1a7e77f502882d87597f3cc5bb450a71f9fd57f43b321baa4cbe5213a48a2c5b785a9de4103d5029e4db79403e98784e51379d45a86996b183469e98470731d1a603eaa443a05527aca62f51631722dc0dfe5d74c8298d2aed885d34c9be61	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\16232A798863E5950F9F44977A033CF91793D8F1	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\98D9D6CB8497105298536D86E468DD0323DCF318\Blob = 03000000010000001400000098d9d6cb8497105298536d86e468dd0323dcf318200000000100000001050000308204fd308203e5a003020102021015f007bd5f4ef8079892414f2c01d1d1300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293034312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303034204341301e170d3039303333313030303030305a170d3130303333313233353935395a3081c0310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a6572736579204369747931223020060355040a1419436f6d6f646f20536563757269747920536f6c7574696f6e73313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e2076323122302006035504031419436f6d6f646f20536563757269747920536f6c7574696f6e7330819f300d06092a864886f70d010101050003818d0030818902818100c98a30777f1383df7fd5858ac100e27deaaae1b334d290c2f5c80caf0da0fe0d867093e41a8306582d1645f3227c76e9dd517915d9d934df581873f4e8eb1707eef36402f320aba6fd4a31baecafa515473ea7d7b18275b9527cae10747f2468640e050a260064328393b7ba7a6372af443b24d461e4465c80ab1f720a4936890203010001a382017f3082017b30090603551d1304023000300e0603551d0f0101ff04040302078030400603551d1f043930373035a033a031862f687474703a2f2f435343332d323030342d63726c2e766572697369676e2e636f6d2f435343332d323030342e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307506082b0601050507010104693067302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303f06082b060105050730028633687474703a2f2f435343332d323030342d6169612e766572697369676e2e636f6d2f435343332d323030342d6169612e636572301f0603551d2304183016801408f551e8fbfe3d3d64367c68cf5b78a8dfb9c537301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d0101050500038201010010da5f375376fdc6aef5a9771878d640588ecb4348af3ce8d157fcc3bd313d17d24f3f0cd56417b74cdccd93fefc71f5391c3851ecda633dfb854a4426927cf1cabf5b0577c0e435588889cffa768ee31961b70b287fabcc46d8cd97fcbc6ccb05ebf4bb866693936cfc04e39da95a03002b85ef6136029cf1abd2a645daf6fcaf8f656f52ce020a9c7cb50efd0c7a8870064e739588be196d11a51009ddd1b14ebfa77674f5a83a6fcc3e4944de515fc63bb1f09d4af60412df166dac76f6ffce977a3672c75d234bb6720b86a0e8d7e34070af8ce063ec686463596c71f3eb61bed40332a588f7e2a3a99da776af16bc94e218fdc5af008a304a716c73f624	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\76FBABF1EADED3B91DD7A76A6678301F1F87AA97	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F14CDC50FA95DFA78F9488E6A96FF0B4011F460\Blob = 0300000001000000140000003f14cdc50fa95dfa78f9488e6a96ff0b4011f46020000000010000005f0500003082055b30820443a0030201020210124ee46d5e92cc4dbd6ebf3acd2e7fd0300d06092a864886f70d01010b0500307d310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312330210603550403131a434f4d4f444f2052534120436f6465205369676e696e67204341301e170d3137313231333030303030305a170d3138313231333233353935395a3081c4310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a7f0a04410f74dd9a1c24a14699f977551af2f528fe1a83b461da7a6d4e3099d5853b065396e990d9fa3c4ad1232128868cbebfc1aa5edf788f6d8aedb9ab5a82e923276061bb0d6980237f6dcdf8876f8bac93bc05edcaa0b8f93d0d03c132c8bf0a11bbaa16106732d636fab5f2710acd3711181454cf419d27f3078cda5c96ed284c2102ef8723e1e7510fbaa7fb3025a00d72f226fbcb69ea8192e7862f422fd83c221b77eb4953f1ad779765b2f8292004a11fd266bbcbbe0448fd199ce6a70e990ffdc11105bc4b92b1b90b82010ff56eb8daa434bd6405b519552649c4e136ae8c381171fe2d1a4e0522dbd2feecddc2cb40a01accc49b5bc55d59fb50203010001a382018d30820189301f0603551d23041830168014299160ff8a4dfaebf9a66ab8cff9e64bbd49ce12301d0603551d0e0416041470cfd4fe3684b3c7eb2a7f08aae10493a839344d300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e63726c307406082b0601050507010104683066303e06082b060105050730028632687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010b0500038201010020d13cee9ecf43b51c1a9ef12f4ff2f85516a21fd1c4df41ef814d29d3113647e46e39dda693e0548c31f714e64b8176e537f6191407bb7f422a9bcc941f4a4703b0a508e29adb32b527f50b68e0294971778d1ccde7126f5536d488267cf7a0cdd83fb1e93af6b43fa6cbf4a2f01d6c8cf4a253c2c94f7518bf38efa43239155ef7b7bb4c139540d49af1ca750469f06f01c82d11b0f2fdfbdf3d9c778c8d23d2d40a66ce10d6e07a74955907a2937a6ba6a5dcd7071fb61e3ce34b610e03ca8e6c5a003da76d492fc19ee8666d237499f486b6b8d8a1da4f3052abee516491d09f9d687129f44ba62151e2656710b8dd9a7e9a19d1d4a91e9b6a642d5996b3	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\D70D7D00CA12E1B3E20F3BF7534DEB2C2E7C2404\Blob = 0f00000001000000200000008f4390d93853f6a1a1b71fdc231e030586f8213a5846c95d90b527f5c6dbd80f030000000100000014000000d70d7d00ca12e1b3e20f3bf7534deb2c2e7c24042000000001000000530500003082054f30820437a00302010202102f9f0a1d6764b5a6378747247087ba73300d06092a864886f70d01010b0500307d310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312330210603550403131a434f4d4f444f2052534120436f6465205369676e696e67204341301e170d3138313231313030303030305a170d3139313231313233353935395a3081b8310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303116301406035504090c0d313235352042726f616420537431223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100c1b2eafc6255d7a7780082967ba911a65b8160e697a9c81ae0816002356644b714895808a67b22551d87b879e80d0c1bff7bd847e1486bad3c3caa8c6f3258a7311f8b03c68c9ec5947950e57a1f99f4b47b8faaf46e282f68155ae6e8f13c9c125b5eb83ae4e63ee6081d0e8aae4f090175a538422b38e0600bd94b21b313567934ee959ddd6ab7ef62bce25dada05d7de6a75cefeffdcba6a1fc8e1ef7aa6d3e5ab328732c3d31759a20d7e69cef60ac9d152041dbd85167a78329f3a80fee19ea9edb102448aa9f5774794ecb560de2faa348f278b846a2a5d8238d5e4e4cd2a82f0e37415af2dc63f34f3e179aa1cae7290b411aaf5aa6acf5404ebe98130203010001a382018d30820189301f0603551d23041830168014299160ff8a4dfaebf9a66ab8cff9e64bbd49ce12301d0603551d0e041604146c5f99825f4ba8d4c19bae5169bab32fae7816ca300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e63726c307406082b0601050507010104683066303e06082b060105050730028632687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010b050003820101000f718c2aa40e9c44a95e1eca3844097ddb7fba896b5f5c73a6b9aede1d29f0e432f41c8a45ce38b1f52df73f45e67907a03ac58d407b3077b1cae246a54544ee365bcee4bf0f4cecc47b01e98d0478d8f4c93e2c582aa472577de9c67a0a8c2e37635e626258675e0e6669babee331594abed516679e8f1b14d7a65dc1b76ab33412689b135cf855335748e2d1998759e5b95f68d418d5486d385d0db7a8fa30e58e84f57bb7ec3f45efa549fab71775c822ec846545b6fc0ef1d3c2dad34940657088fc5f773a1cbe24f9228f9dd7e9611d5d682998c6041ba580a789f5571da01d6723784bbcec4fded61d0ba31e37fbc10c3dfe06169df4670c8d454019f7	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\98D9D6CB8497105298536D86E468DD0323DCF318\Blob = 0f000000010000001400000090a2410adcf68db8c38f4069ff4c49d5eb93731803000000010000001400000098d9d6cb8497105298536d86e468dd0323dcf318200000000100000001050000308204fd308203e5a003020102021015f007bd5f4ef8079892414f2c01d1d1300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293034312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303034204341301e170d3039303333313030303030305a170d3130303333313233353935395a3081c0310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a6572736579204369747931223020060355040a1419436f6d6f646f20536563757269747920536f6c7574696f6e73313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e2076323122302006035504031419436f6d6f646f20536563757269747920536f6c7574696f6e7330819f300d06092a864886f70d010101050003818d0030818902818100c98a30777f1383df7fd5858ac100e27deaaae1b334d290c2f5c80caf0da0fe0d867093e41a8306582d1645f3227c76e9dd517915d9d934df581873f4e8eb1707eef36402f320aba6fd4a31baecafa515473ea7d7b18275b9527cae10747f2468640e050a260064328393b7ba7a6372af443b24d461e4465c80ab1f720a4936890203010001a382017f3082017b30090603551d1304023000300e0603551d0f0101ff04040302078030400603551d1f043930373035a033a031862f687474703a2f2f435343332d323030342d63726c2e766572697369676e2e636f6d2f435343332d323030342e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307506082b0601050507010104693067302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303f06082b060105050730028633687474703a2f2f435343332d323030342d6169612e766572697369676e2e636f6d2f435343332d323030342d6169612e636572301f0603551d2304183016801408f551e8fbfe3d3d64367c68cf5b78a8dfb9c537301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d0101050500038201010010da5f375376fdc6aef5a9771878d640588ecb4348af3ce8d157fcc3bd313d17d24f3f0cd56417b74cdccd93fefc71f5391c3851ecda633dfb854a4426927cf1cabf5b0577c0e435588889cffa768ee31961b70b287fabcc46d8cd97fcbc6ccb05ebf4bb866693936cfc04e39da95a03002b85ef6136029cf1abd2a645daf6fcaf8f656f52ce020a9c7cb50efd0c7a8870064e739588be196d11a51009ddd1b14ebfa77674f5a83a6fcc3e4944de515fc63bb1f09d4af60412df166dac76f6ffce977a3672c75d234bb6720b86a0e8d7e34070af8ce063ec686463596c71f3eb61bed40332a588f7e2a3a99da776af16bc94e218fdc5af008a304a716c73f624	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\872CD334B7E7B3C3D1C6114CD6B221026D505EAB	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\577DB581A72DAC211A2E3E547077529D54671825	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\16232A798863E5950F9F44977A033CF91793D8F1\Blob = 0f0000000100000020000000a5af38f4b93abb455f8bbf1ef06af2b653c973f452b7051e08e3d62ee210ead403000000010000001400000016232a798863e5950f9f44977a033cf91793d8f1200000000100000016070000308207123082057aa00302010202101f734d111b4b5c879bbd5a8c49ab2a90300d06092a864886f70d01010b05003057310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312e302c060355040313255365637469676f205075626c696320436f6465205369676e696e6720434120455620523336301e170d3231313230373030303030305a170d3234313230363233353935395a3081da311330110603550405130a3034303037353135383831133011060b2b0601040182373c02010313025553311b3019060b2b0601040182373c020102130a4e6577204a6572736579311d301b060355040f131450726976617465204f7267616e697a6174696f6e310b30090603550406130255533113301106035504080c0a4e6577204a657273657931273025060355040a0c1e436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e633127302506035504030c1e436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e6330820222300d06092a864886f70d01010105000382020f003082020a0282020100bf278efbb1f070dd512156b387a02946060750ffadb5b00c8a316c6254ccf52787727318f46a676cc12035adfb89cef7c4c4bbefa84627362f58e1b96b6b281fc01535419a7715dd92995ecf8deb4c8291427657bdcbee99fc260f482b91478a76bcf1c50b114be347a43c8a35091d8371e562b1c16f68370f851e037373ff9c00177845d2d5b6da2aaaf808cf9ff1a3a6eda561286e25fa2c0d7e9ae0c7f0c04e1df0baf6f5b6ac0f01940f2a14e467f77505d14c84f45121d45d5c4552ac5eb24fef6bc520ace00bac3aeab817f8fa995b3111a202397031bf4b25dd89e2ba5cf8b9b6b5a521deee25a4e6529c869873414796bbc28f6d3ed733d339b26dd10a3a0e2d43eb9815e1b33fb6a48f0ad3fe196ecb20207862249a5456601c09f1e344453cad88350bb392a74a899f716e018c40cac5fd3f9b691261e3528f51ae70a28b00271c5a540ec387e778f75a4ceabfd34f9b17d6a76481240727ba17973f3746e175ab4cae3f9b28dfad2a842a220491f66956ae90f8b44c343ccbb8cd6ae46eb19aa6f6ae55687129eb473a3111d1db67d708955afacc070e048b5aab7587a732bc77c9a66c72c604a4ae96ee00d38d492af000d6099cce5bd9b7c42554e74ad2091f79baea8cd4b92d092f89a294ebf5ddb785a39b21c1befd7faecc58a6e99022139f7120753a4cdb4b98e700a08dd850224d67c8aa811cd61d63950203010001a38201d4308201d0301f0603551d23041830168014813292412b28cd46c8c4a2c62a3912ec48a93f14301d0603551d0e041604145d9262d74ec55663e2d856b3702cca554d2809fd300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030490603551d20044230403035060c2b06010401b23101020106013025302306082b06010505070201161768747470733a2f2f7365637469676f2e636f6d2f4350533007060567810c0103304b0603551d1f044430423040a03ea03c863a687474703a2f2f63726c2e7365637469676f2e636f6d2f5365637469676f5075626c6963436f64655369676e696e67434145565233362e63726c307b06082b06010505070101046f306d304606082b06010505073002863a687474703a2f2f6372742e7365637469676f2e636f6d2f5365637469676f5075626c6963436f64655369676e696e67434145565233362e637274302306082b060105050730018617687474703a2f2f6f6373702e7365637469676f2e636f6d30330603551d11042c302aa02806082b06010505070803a01c301a0c1855532d4e4557204a45525345592d30343030373531353838300d06092a864886f70d01010b0500038201810000b6abcb859749fe5bea2213f31cfe6db00bb221447b7f781d40982487806bdb7b711b08b210fec553172e5492ed62cd4eb3c63f4352c33d87e3aaf9265287438c0cfa8183b68cdf6a52df3094b4fb4fc01a82e39292fc5c2525f30f5da0077e8b37879c9c33a46b34cda70fdd89e87cec6f9b320aa3ec145b2843af9ff9cdf5d7030b3b34b5e1436b06ed64f2358de7e894dc929e7d218a2c362c4b2a78f0852e9bc55fcb805c86b407879bd4d1cc8d24b3a647ad85cdbd19fd29f030e1976a5369e550b780dc853824d4f031f69afd1a4967ec5f3871443f8b55d40c6ce0049d5af7c2d6f3f1df0471e0d47daa19a010cc08489dd330c8aa036c63ec148a37b855e6e2cbe7993d3bc17459ba47251c568c80468c8c8eeef2b561903a64c54472284333302f8e957906f9fa7af48afd60d63886595389b305e9b2cae6547efc2e85a5a382e7abef4d5efcfc3e8a0320a1c7e6bd5b8b68f5a4931b5bdb6e0200e502becdd39258d1df1b7f0ead70b94c06e329ea1d9e52f32104c7c0b3a26d5b	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\577DB581A72DAC211A2E3E547077529D54671825\Blob = 030000000100000014000000577db581a72dac211a2e3e547077529d546718252000000001000000620500003082055e30820446a00302010202105eb0a7021a06c5b10c21eb8b1716c6b0300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3132303631343030303030305a170d3133303631343233353935395a3081b3310b3009060355040613025553310e300c06035504110c0530373331303113301106035504080c0a4e6577204a65727365793114301206035504070c0b4a657273657920436974793121301f06035504090c183532352057617368696e67746f6e20426f756c657661726431223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100b955ac4b449fee58fa6314876ead56819f17569e8d4fad77698ce21a7c28bfd3d50eb1b77023e54d202eca50e13f4b23eb336fbff44bc2537045bc50687f524781a5a47057dc2761e531664acd1167f8f62c60a49cf4473093b3a12a975d70f60d7d9fbac2336f534bdfae2fff191321ae2f794998ab4f71ffc28537a7a820dbacdaa03ae83b8fe264825baab754a460ecdb41f1e1eac9f3c07492520bdffeee31b2ccbb79f9ac3151569e506665437d470c977082490dd030d0fc6c0e6480470f95b41e47ef7933677fa03e67493d7e855002755a41338060853cc34249fab73c233515b179384b7198bb91d33d8294664d329f251f6510828aba15f4311fef0203010001a38201a33082019f301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604142e10c21ad189ebcb079c83f277d898c9144ade08300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30180603551d110411300f810d636140636f6d6f646f2e636f6d300d06092a864886f70d01010505000382010100ac5ef51daeb71d81e2741745d8959c9a87d731ec7883d97033d6c2d2907b6a47c20bb79300888a341d66a43e7dd399cc52e7fa6695e8aa9a933f8bcb76dee802e1def8c6ac4153514d3793188130b1388baa405f4c8d3710c1a1333f666a0a9eed5844fef4e266a15f8785fff19f6c1e6f1304a7b9dfbd518477e39bf4ce32ebc5931519123198e35b754a77f0e6776046004e9d1b4b55f7bb0580583a605934affb7416f499a1a1fdc31b30cd9ec46e04764b5fb45a19257d971d7120f28bf81ee6e1a82720653d58a45694b395f7ae64a7d7712d9b127d0051903d96462314fc35e9091e08736f9e25be120d3b4bc28a443c5315c06cef5522a4d2c97d3d04	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\872CD334B7E7B3C3D1C6114CD6B221026D505EAB	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\D70D7D00CA12E1B3E20F3BF7534DEB2C2E7C2404\Blob = 030000000100000014000000d70d7d00ca12e1b3e20f3bf7534deb2c2e7c24042000000001000000530500003082054f30820437a00302010202102f9f0a1d6764b5a6378747247087ba73300d06092a864886f70d01010b0500307d310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312330210603550403131a434f4d4f444f2052534120436f6465205369676e696e67204341301e170d3138313231313030303030305a170d3139313231313233353935395a3081b8310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303116301406035504090c0d313235352042726f616420537431223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100c1b2eafc6255d7a7780082967ba911a65b8160e697a9c81ae0816002356644b714895808a67b22551d87b879e80d0c1bff7bd847e1486bad3c3caa8c6f3258a7311f8b03c68c9ec5947950e57a1f99f4b47b8faaf46e282f68155ae6e8f13c9c125b5eb83ae4e63ee6081d0e8aae4f090175a538422b38e0600bd94b21b313567934ee959ddd6ab7ef62bce25dada05d7de6a75cefeffdcba6a1fc8e1ef7aa6d3e5ab328732c3d31759a20d7e69cef60ac9d152041dbd85167a78329f3a80fee19ea9edb102448aa9f5774794ecb560de2faa348f278b846a2a5d8238d5e4e4cd2a82f0e37415af2dc63f34f3e179aa1cae7290b411aaf5aa6acf5404ebe98130203010001a382018d30820189301f0603551d23041830168014299160ff8a4dfaebf9a66ab8cff9e64bbd49ce12301d0603551d0e041604146c5f99825f4ba8d4c19bae5169bab32fae7816ca300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e63726c307406082b0601050507010104683066303e06082b060105050730028632687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010b050003820101000f718c2aa40e9c44a95e1eca3844097ddb7fba896b5f5c73a6b9aede1d29f0e432f41c8a45ce38b1f52df73f45e67907a03ac58d407b3077b1cae246a54544ee365bcee4bf0f4cecc47b01e98d0478d8f4c93e2c582aa472577de9c67a0a8c2e37635e626258675e0e6669babee331594abed516679e8f1b14d7a65dc1b76ab33412689b135cf855335748e2d1998759e5b95f68d418d5486d385d0db7a8fa30e58e84f57bb7ec3f45efa549fab71775c822ec846545b6fc0ef1d3c2dad34940657088fc5f773a1cbe24f9228f9dd7e9611d5d682998c6041ba580a789f5571da01d6723784bbcec4fded61d0ba31e37fbc10c3dfe06169df4670c8d454019f7	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E73C45BE88C6FBE7562D8B9D1B7E4FE03E29811D\Blob = 0f000000010000001400000059ca050be20779c74b6dd1634db95e0d7ac8e6d5030000000100000014000000e73c45be88c6fbe7562d8b9d1b7e4fe03e29811d200000000100000068050000308205643082044ca003020102021039f51ff05883bd411616bfa62c1c74ef300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3134303430313030303030305a170d3135303430313233353935395a3081b9310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303117301506035504090c0e313235352042726f61642053742e31223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100efe97b1f62481eb08572c14dac7faf5de0544ca4e0b636be10f09f0481ec5f08176888bc5da73ccf1debfba8d16449ad4ca6f017d01cdb3b41ff05b193438132cf6b7c6b90e35289c67281f9cb59d25cf067d17cf3f325384aa1e4f066a193559119faaf864cb6998d5f12109c938c6fe76af32817a3cd004e87fd0d055439886eb41734f78c1e9059dc7de0a2e4839b83441e7b5cd2c2e90628aeb7803567b321950f564557d13ede1519afb734e6bb4d6c1bddf59070342b7f478dd5efc6efb488c1dc1e8acb86fe60fc433070c560e76c30bd74661f1ff91cafb763c8fd32c041752d01fd0df035fb57ef7f4d7117fe4377e9a382540142fdd2441d00f1f70203010001a38201a33082019f301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604147835e6598d5572201de9a55f8a527b1e51ff37b7300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30180603551d110411300f810d636140636f6d6f646f2e636f6d300d06092a864886f70d0101050500038201010039881a7fb87fae796492551ea2dc77b2a01f17e98a2a584ac9f72d0e8f2740f777dba416b35bc88cf30b4b8b05009892ab13e0c4fc7cbe9a177bffea416446d39b6cf91f65967d23f907549ff56a424b307a9a9c48eacd8b9cba65be4ca3d92baf5958dd58c6e41cc35699a17e899a7a8d6df61c2149c629af40638d02613298d112c3597122ae120dec12f2537d585ed9525f4b64926903fba082a7c0f1f04517477a17ab5ed1f9ec2bc7e7154ad0c1822952de2d1cd7ad2cf3929d67a8b491f9401339ca7bcc3d81ee5b93b5a6c5a4bbad53cbae560cfb54fb39ab932d32280a25cbcd9850b68ab6361b04fa2a2ec9b09c5cc8842b832f72e4e919fdcaf5e1	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3F14CDC50FA95DFA78F9488E6A96FF0B4011F460\Blob = 0f00000001000000200000001705f30c1efa865484eda67d661a2ab216476c3a8ffba79e46b502660e8191cc0300000001000000140000003f14cdc50fa95dfa78f9488e6a96ff0b4011f46020000000010000005f0500003082055b30820443a0030201020210124ee46d5e92cc4dbd6ebf3acd2e7fd0300d06092a864886f70d01010b0500307d310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312330210603550403131a434f4d4f444f2052534120436f6465205369676e696e67204341301e170d3137313231333030303030305a170d3138313231333233353935395a3081c4310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a7f0a04410f74dd9a1c24a14699f977551af2f528fe1a83b461da7a6d4e3099d5853b065396e990d9fa3c4ad1232128868cbebfc1aa5edf788f6d8aedb9ab5a82e923276061bb0d6980237f6dcdf8876f8bac93bc05edcaa0b8f93d0d03c132c8bf0a11bbaa16106732d636fab5f2710acd3711181454cf419d27f3078cda5c96ed284c2102ef8723e1e7510fbaa7fb3025a00d72f226fbcb69ea8192e7862f422fd83c221b77eb4953f1ad779765b2f8292004a11fd266bbcbbe0448fd199ce6a70e990ffdc11105bc4b92b1b90b82010ff56eb8daa434bd6405b519552649c4e136ae8c381171fe2d1a4e0522dbd2feecddc2cb40a01accc49b5bc55d59fb50203010001a382018d30820189301f0603551d23041830168014299160ff8a4dfaebf9a66ab8cff9e64bbd49ce12301d0603551d0e0416041470cfd4fe3684b3c7eb2a7f08aae10493a839344d300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e63726c307406082b0601050507010104683066303e06082b060105050730028632687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f525341436f64655369676e696e6743412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010b0500038201010020d13cee9ecf43b51c1a9ef12f4ff2f85516a21fd1c4df41ef814d29d3113647e46e39dda693e0548c31f714e64b8176e537f6191407bb7f422a9bcc941f4a4703b0a508e29adb32b527f50b68e0294971778d1ccde7126f5536d488267cf7a0cdd83fb1e93af6b43fa6cbf4a2f01d6c8cf4a253c2c94f7518bf38efa43239155ef7b7bb4c139540d49af1ca750469f06f01c82d11b0f2fdfbdf3d9c778c8d23d2d40a66ce10d6e07a74955907a2937a6ba6a5dcd7071fb61e3ce34b610e03ca8e6c5a003da76d492fc19ee8666d237499f486b6b8d8a1da4f3052abee516491d09f9d687129f44ba62151e2656710b8dd9a7e9a19d1d4a91e9b6a642d5996b3	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\39488FE6BE0D00E76D475BD2902442A541A0E1A3\Blob = 0f0000000100000014000000ec90220b9fc81a6e1bbb4c4523e5adfeb4c56a6e03000000010000001400000039488fe6be0d00e76d475bd2902442a541a0e1a3200000000100000068050000308205643082044ca0030201020210071ae4a2402bb0ad40f3fbd4402b9290300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3133303430383030303030305a170d3134303430383233353935395a3081b9310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303117301506035504090c0e313235352042726f61642053742e31223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100d16dbef9f9b66b60cd10d445259a1340e176ea68a389e786588ea50ddede49f026ee9fadcdfaf92a4d5759e4157f166827acef7aaec040e4ec816905e85396416ae568b0f57672069ab644792bef047fcbb11ec708f7e6e8c06f484b328cfbf769aaaad4aafb9f6c4f4c22e552bbd41b367ad3a5130f06f71bdfce3f295a2eb35c6863496588a6a018ef0205d950bb2aa130263f0e4dcc3976de1c04a41d6f825e47e6d0da838b1454fe7bc35449984bc83e906f76ddc59e70fd00f8393b377dd459a3ed394db48a66dc4b6411d7d65dddbc1a964022d77bb4fe6bbc1a6d39f4832c15dbee8183f2fe46aa57bca4e2df4a3f7843f3bf677abf63c363d39c1b410203010001a38201a33082019f301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604145e313f971a8d01f8288f3edaef539b06c99d97fa300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30180603551d110411300f810d636140636f6d6f646f2e636f6d300d06092a864886f70d0101050500038201010044a773cdd6d5f08fc0a6d76d84ca14d5cb7ff98f2c9b2a9d28902d5d24282fd9fe6e3cad24fa31199ee0f2ef48e973ccb133e9007791b76362a14839b97b80bfefce0accfb9dedaa51e2c3a213114442009d1479088e2beca664c6ade7ba8e3913bdfa8589fc8ac59177ca3705e58585f1887685b89bdbf1b7bc6efa82a2b4ae273eebd53dea3651cb0e77e016b69ca726f759106338c242f1596225f235854d612ffaf7e9a8756403d802a071dbafab7cd14a44005bb3bd1ba21235816372cf32775985b2a09248f8f52065cb58b9c09cbf50e7e3bbbc78e69118e67e882a52385d456ee824e1f4d631d87b394cc1d19eda889b4933ddecb183548df778759b	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\03D22C9C66915D58C88912B64C1F984B8344EF09	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C6C9520866B57431E708BB81342E072205CB5BE0\Blob = 030000000100000014000000c6c9520866b57431e708bb81342e072205cb5be020000000010000008d0500003082058930820471a00302010202100c078e1d0f486bf4325e09f8bedf2446300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293130312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303130204341301e170d3131303330323030303030305a170d3132303330333233353935395a3081cc310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a6572736579204369747931283026060355040a141f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e207632312830260603550403141f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100d259e2895bd9e9403944235673728dc6536175a5dd87ae799971db72df0530cd9e1bbca1b2d8a1dcb7daf112ef085cd6799d1f1dcb10c0e2947121be232c205edbc670b140e3d991ac6721c371c9ca2e32056c1d71e1cfe57382bc7d70944ca90a3f7b9ecdbcb78c141341ea0f144d4293fd83cdac3ff598618042df6c9d604d21c4c68b3e2a542b1a6a49c0f267aeab4ca6f65ba4767a961c7133688f52f9d292a345ef4c40e0fa13b07a1f76b82f0fad48abdc8b14e24b1b5cc00eca542db1fc579843c204db6b4ba18037be05efa09659c08e896fa293eb9f1629c21a0c86b7d867fc9fcfee94f70aec86196b714639a156e41e9bf1e630710485158e7a1f0203010001a382017b3082017730090603551d1304023000300e0603551d0f0101ff04040302078030400603551d1f043930373035a033a031862f687474703a2f2f637363332d323031302d63726c2e766572697369676e2e636f6d2f435343332d323031302e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307106082b0601050507010104653063302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303b06082b06010505073002862f687474703a2f2f637363332d323031302d6169612e766572697369676e2e636f6d2f435343332d323031302e636572301f0603551d23041830168014cf99a9ea7b26f44bc98e8fd7f00526efe3d2a79d301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d010105050003820101008ac92cc8145ce639e61c121954f20a835339bb47f44c9544579918ab8530315d491146e8e536ab85f3b9e96f4ed30bbc8b01d7f40b8078a8ee210c088952c6bc1063a05ea02924704b7c9e1e2f2910a6443f29b7d1a06943952d09c99242ecba6fae43a8752f313b4cfb05aea18329163218a4e9c8884fc42f7cdcacb7535f56a1a82ebc38ae19c01ff72bd0ff347453f604d4188d75abf602799400788715be414c6e1911b737ad0e07bf049711b9460fe933665551beed9b17679c9c7ed1d81ad4509f706e38398b89159be6c97ad2d68ee540816a30e0657d65f49207812420831f9cc54190ddbd0b86d610f2f0f7f1bf583bf4fffb1744ffc83289a24552	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C6C9520866B57431E708BB81342E072205CB5BE0\Blob = 0f000000010000001400000071016038dc9322758f4f45cf1f4876c88226aa84030000000100000014000000c6c9520866b57431e708bb81342e072205cb5be020000000010000008d0500003082058930820471a00302010202100c078e1d0f486bf4325e09f8bedf2446300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293130312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303130204341301e170d3131303330323030303030305a170d3132303330333233353935395a3081cc310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a6572736579204369747931283026060355040a141f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e207632312830260603550403141f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100d259e2895bd9e9403944235673728dc6536175a5dd87ae799971db72df0530cd9e1bbca1b2d8a1dcb7daf112ef085cd6799d1f1dcb10c0e2947121be232c205edbc670b140e3d991ac6721c371c9ca2e32056c1d71e1cfe57382bc7d70944ca90a3f7b9ecdbcb78c141341ea0f144d4293fd83cdac3ff598618042df6c9d604d21c4c68b3e2a542b1a6a49c0f267aeab4ca6f65ba4767a961c7133688f52f9d292a345ef4c40e0fa13b07a1f76b82f0fad48abdc8b14e24b1b5cc00eca542db1fc579843c204db6b4ba18037be05efa09659c08e896fa293eb9f1629c21a0c86b7d867fc9fcfee94f70aec86196b714639a156e41e9bf1e630710485158e7a1f0203010001a382017b3082017730090603551d1304023000300e0603551d0f0101ff04040302078030400603551d1f043930373035a033a031862f687474703a2f2f637363332d323031302d63726c2e766572697369676e2e636f6d2f435343332d323031302e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307106082b0601050507010104653063302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303b06082b06010505073002862f687474703a2f2f637363332d323031302d6169612e766572697369676e2e636f6d2f435343332d323031302e636572301f0603551d23041830168014cf99a9ea7b26f44bc98e8fd7f00526efe3d2a79d301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d010105050003820101008ac92cc8145ce639e61c121954f20a835339bb47f44c9544579918ab8530315d491146e8e536ab85f3b9e96f4ed30bbc8b01d7f40b8078a8ee210c088952c6bc1063a05ea02924704b7c9e1e2f2910a6443f29b7d1a06943952d09c99242ecba6fae43a8752f313b4cfb05aea18329163218a4e9c8884fc42f7cdcacb7535f56a1a82ebc38ae19c01ff72bd0ff347453f604d4188d75abf602799400788715be414c6e1911b737ad0e07bf049711b9460fe933665551beed9b17679c9c7ed1d81ad4509f706e38398b89159be6c97ad2d68ee540816a30e0657d65f49207812420831f9cc54190ddbd0b86d610f2f0f7f1bf583bf4fffb1744ffc83289a24552	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C6C9520866B57431E708BB81342E072205CB5BE0	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\F5F8EEAC5A0127025E936C01493D1C11D5012BA4	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F8DB7E1C16F1FFD4AAAD4AAD8DFF0F2445184AEB\Blob = 030000000100000014000000f8db7e1c16f1ffd4aaad4aad8dff0f2445184aeb20000000010000000906000030820605308203eda0030201020210078f0a9d03df119e434e4fec1bf0235a300d06092a864886f70d01010b0500308194310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313e303c060355040313354d6963726f736f667420446576656c6f706d656e7420526f6f7420436572746966696361746520417574686f726974792032303134301e170d3134303532383136343334365a170d3339303532383136353134385a308194310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313e303c060355040313354d6963726f736f667420446576656c6f706d656e7420526f6f7420436572746966696361746520417574686f72697479203230313430820222300d06092a864886f70d01010105000382020f003082020a0282020100c20f7f6d49bb39f04d943fe8fb4dc5eb3be1285ab9892a467ea5c333271d82893feb33a1876aeae882b9dac39d77d135c0cb833672a6571912bc15e2c83c7b83623414d5abb6de368ba15a71a65196a70633b3221d146253c2a5af9a40cabe2c485499e72a9368a769190b99693bc1b2acae94dc5fab7e02cade3ca774a68c10a0e5aeb69c35ef838b10e5972aba916b9a6a4595d9d054718e653fc48a53ca1e38470ae9d04184a5da1e66016504e6505b7735f5b42e29320cc6bf5f61ee3220b77c39f911faff605efec669f46f1e1ded1d06e7651e9a112e6344065f31431733e9a32682d44b83124fd2a126032548e13abd84f58ad5b46e1ae871200e45530167ade31e6be8b2e4abfdf53b8eba67af5984cc5c75d09daa5c72c42636a2ac324c6ab1f8331744d2a77d70eeeb70949abceaba1c104b635b38ddd2254504b2f0b35a7c0b0a8e21406437114d96694533e493839ef9b3b51c2b0571ea6dcce748b6b6de805010ca4938b35905704ebd9e880222586489eb40dab12d2d6a40885d23c33ed0f5d5b7908a28543962a2c5c6b1bf74cd8695f9456bccf207eaac5cd336f7a27ab5b472532a063ec337945858b14a71bb5ccd9cb2af109ad943363e528519e7422891118c8ce7bbdfe6c855087375f3960d86b7d2e506b2c08a54a86177207d6cd1feba68f3454aaf1184eb867d2f04f354ea20ffd5db3d250270870203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604148570009f77591e8cac3c9f77262819cc9ac18f32301006092b06010401823715010403020100300d06092a864886f70d01010b050003820201004f2574bd1f624f5f0ff74222d7d1d65304232ec5d5d7072b6b793b5f6d90ed1355d382f1f5028f3ef996267e0d421876fc6055825a86bd113339690fcee0b02bf15d19dfd8d2fa86a4cccdacf0d0ae9a8b2b248f03c1350d20b3dfc742ea77292e0a12fc0b1a458dd931840d8d02c0acfad212bf1e6a343eea8300a348754e72662da1a5129f37a85d4a7759cfd63afc30c5a609a5bfb108e3fb2c9f76c4fb4e611d6d23f3766985eb49bb0df73dd0aa05bcdd3d6e80445ed99a68ecc989c7e61a18f860a0e78cf6e6516f0ee025b863f9f9c20b8c3c9cb2f042cdbec3f5fe4929559c5e8696fba1ed6d2686e8b8208b5cc6e72d31c5aaca7d4b7da059a41efb5071e9afcfd6aa0d99de8e95269731a5f47f6df46815b8e3f7add8efd13875025ffd6d4efcb6fc2f451ba9cad11e7aff75181536c120e45f483a95eb7be4f5f6f4fec94b21a2a9ea8a9925cbe8444090d539b46b239b52bcc0c17e17666e650bf5741596a866ed856854b224e87588644589853c7a656b96e0f259ea4725660f6a1b0c3fd44ae64b26174709fed4d7b8e0cee72f94ad808b6770ccb77bcf1b2bb9d15bbdb8035cb1f01b412ce6535516e74a0e41089937e2a9d76d0e6a45e5ece388a9fdb69bc32820ceabc2936b516553bfa05e7b9d26349a514c8ca638d5865b3c55ee50ec000bcaacdcca10abdf189bd2ac0c8d084515af8535355ae526bc	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E35E6F46A1A9A4D18A4DAA298BDA4D1E8879236E\Blob = 0f0000000100000014000000e3b244cda88b1ab5a7dc09039d0c3142ae6361e7030000000100000014000000e35e6f46a1a9a4d18a4daa298bda4d1e8879236e20000000010000005f0500003082055b30820443a003020102021100d9218e2757ec45d84ec08b3e6700c85e300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3138313231313030303030305a170d3139303730373233353935395a3081a8310b3009060355040613025553310e300c06035504110c053037303133310b300906035504080c024e4a3110300e06035504070c07436c6966746f6e3116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100b73a668ff7984c8d990d7c6e51df5176c7842cc1bf351c27286c6139f4831fc718a35b0fa9145f0887de8bce335e8e3e12fce763cab5deeae08e0bf325cd79a4fbb328d7c7f7d53de51bd3c05c5966b634a9b1fc4362afd0267f927dd90a52b6a5f5f0e29c8e94dfe4199b2cf31142bb480e95ecb92b6ca20ecd71ff210df9655e9e9ac856ad7aab929b843052d4a21c27ea4054a9f4e8c4cd88943b1a4d3a58b3e06eb654c6c09cef472d6fb0d05a841ce229b53a5d36bd08cbfdc552f7c758efaa7824c1d27e30a83d7a9cecaab4bd91b2cbd60d1335fc4ac0f0294dd2eeb3f65139467761f091840246ff644edbfacb9ffd7ef2823fd9eea312dd299a39af0203010001a38201aa308201a6301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604147c4f2b645af103043ca7675e8c129c16dee7164c300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d301f0603551d1104183016811473636f742e7765697240636f6d6f646f2e636f6d300d06092a864886f70d01010505000382010100b33c0fee4668b9e86cd777fa94eb47dcaee7fb5b9b897b9458b12e511a194b6ad495ea4b6b820d1c7cd26badf92cfc13aaa9e66157a55545c7ea71460a4fa4e30e46b9ac16a36e94a1fcbc62b2abe402d2a58773344c4b23a0d907a9760029595421e478da67167f80876012443cd22573dc3806cdedbc6c8c4ed255bd926cecc7796ec36fb225d084f31afb5e5a2e86d26149212dda8aed2058ef0d7e7e677b463a7722431a0b5c0b9dc385b7d2e73bd781ee111c8f7e36d76e1db1f6ac98784227ed97cde3762d079741984d146a8ff96e411c1b1e4e711cd00a6150532ffaa13702a81f4514eae48ca0b98d8642a6cfe7711dc67d1b857bfecb4e863bc1f9	cmdagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\577DB581A72DAC211A2E3E547077529D54671825\Blob = 0f000000010000001400000062168746c03287ebf06481fd267a4ae824ab4448030000000100000014000000577db581a72dac211a2e3e547077529d546718252000000001000000620500003082055e30820446a00302010202105eb0a7021a06c5b10c21eb8b1716c6b0300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3132303631343030303030305a170d3133303631343233353935395a3081b3310b3009060355040613025553310e300c06035504110c0530373331303113301106035504080c0a4e6577204a65727365793114301206035504070c0b4a657273657920436974793121301f06035504090c183532352057617368696e67746f6e20426f756c657661726431223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100b955ac4b449fee58fa6314876ead56819f17569e8d4fad77698ce21a7c28bfd3d50eb1b77023e54d202eca50e13f4b23eb336fbff44bc2537045bc50687f524781a5a47057dc2761e531664acd1167f8f62c60a49cf4473093b3a12a975d70f60d7d9fbac2336f534bdfae2fff191321ae2f794998ab4f71ffc28537a7a820dbacdaa03ae83b8fe264825baab754a460ecdb41f1e1eac9f3c07492520bdffeee31b2ccbb79f9ac3151569e506665437d470c977082490dd030d0fc6c0e6480470f95b41e47ef7933677fa03e67493d7e855002755a41338060853cc34249fab73c233515b179384b7198bb91d33d8294664d329f251f6510828aba15f4311fef0203010001a38201a33082019f301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604142e10c21ad189ebcb079c83f277d898c9144ade08300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d30180603551d110411300f810d636140636f6d6f646f2e636f6d300d06092a864886f70d01010505000382010100ac5ef51daeb71d81e2741745d8959c9a87d731ec7883d97033d6c2d2907b6a47c20bb79300888a341d66a43e7dd399cc52e7fa6695e8aa9a933f8bcb76dee802e1def8c6ac4153514d3793188130b1388baa405f4c8d3710c1a1333f666a0a9eed5844fef4e266a15f8785fff19f6c1e6f1304a7b9dfbd518477e39bf4ce32ebc5931519123198e35b754a77f0e6776046004e9d1b4b55f7bb0580583a605934affb7416f499a1a1fdc31b30cd9ec46e04764b5fb45a19257d971d7120f28bf81ee6e1a82720653d58a45694b395f7ae64a7d7712d9b127d0051903d96462314fc35e9091e08736f9e25be120d3b4bc28a443c5315c06cef5522a4d2c97d3d04	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\03D22C9C66915D58C88912B64C1F984B8344EF09	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\272CCBC264497707D8DBAEF39868F500CD26BCF4\Blob = 030000000100000014000000272ccbc264497707d8dbaef39868f500cd26bcf420000000010000008d0500003082058930820471a00302010202104a708f805e46e4a95ec561404df11189300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293130312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303130204341301e170d3132303232393030303030305a170d3133303330333233353935395a3081cc310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a6572736579204369747931283026060355040a141f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e207632312830260603550403141f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cb75d6a03819b826e841a62bf9dfb81997d8710b4dd05ee4419b27ed8ae5c09796c84801e7eb3af986e43d8bee487d2f0b2a1c86c01564615ede2a366975407e3c6c86fdc460a3c0f130f583888911df7e529d15e2040897cc3c50fca0efccbcb91c8a59b704f7fa48aea6f3cf0726201a65ebe2bfe5dda03ab947bafc82d8318752bdb09b29fec492a876e511c352a44935b7499c99f384d2672496884c42ddc0230354f1040df837f5e1dc3d7a510a3e1a6ad33546a9e655268ad6df7087b987dd8111798110a7080461fb031e3716e383beee54a0d182fa004e982b11e18a56b2d93f5577c69574105af141981e0466a75996ecc44705dc254ff0bb4fe9b50203010001a382017b3082017730090603551d1304023000300e0603551d0f0101ff04040302078030400603551d1f043930373035a033a031862f687474703a2f2f637363332d323031302d63726c2e766572697369676e2e636f6d2f435343332d323031302e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307106082b0601050507010104653063302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303b06082b06010505073002862f687474703a2f2f637363332d323031302d6169612e766572697369676e2e636f6d2f435343332d323031302e636572301f0603551d23041830168014cf99a9ea7b26f44bc98e8fd7f00526efe3d2a79d301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d01010505000382010100606a05f3b174504f923fcc5b4d89643109a2202ec9cd8f1dd8facc1b092b4edcc997e3ec03f8e50eee82b92ebf3e4a2b934dc8c0250307e6cba460ef0b9d57067fea51542488289c721a6031cf4b9a71c65bf200ecb2409ebca5be1f1cc2bf4956f94f6d0614a0ffc076c8f7919807eecbdafa6400d41c45b28c2c72afc86e8a522b5a2c8adfd0a38abdadb8d08b4bec6c25d64540d39caebb6b68716bbe1c2570e92ecab27cc670ce025b7cc21f12a8c1645183710ae2dc2fe385f24ba1a79e122571a64de3afa4c3e8bd9071151d74e0305d4f4e12f86041be1df530d21a00ecad9be7968e99c5f4d4079dc2092375810ebebd5e54e2191ed42a142384951f	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\F89A37FB24B0417D93BFB760B12121F5A358F9D9\Blob = 030000000100000014000000f89a37fb24b0417d93bfb760b12121f5a358f9d920000000010000004e0500003082054a30820432a0030201020210474bf5dfd0395ca926b2f2367e46dce8300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3136303130343030303030305a170d3136313233313233353935395a3081b9310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303117301506035504090c0e313235352042726f61642053742e31223020060355040a0c19436f6d6f646f20536563757269747920536f6c7574696f6e733122302006035504030c19436f6d6f646f20536563757269747920536f6c7574696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100b512f8d9138a6e9889f0afac2c1f2402e9fe96acc0b45a85110b39d9d8de6998199750cb863df84a12796591b7f5426bc0f101c0b6afd1bd5e1f14e4c9805e4f6eab19b893342a581e832bcd90776a9eca9ed04acf2776b4e4bcea4f31824e76dd03fd1ad5376c1bfa095b474350ad21c618884680acf98350336c5c21308188bc942bcbdfc456828ea1fa7f1ae3e8b01a4756348120db21f6c32e0b968e65351c1f46db2a0e94fdcfb0e7e0ff8f26c26c1cb649602b0f1a2f5eb3a546f8e713831f6474d9f79c725cb32cfcbc9999520e2b8012fa758548bc909bc1c5adedd904af9ca03de0fbc0a45d7c5ebc571787e1e7d8ff5c8d627368997dce3beffb2b0203010001a382018930820185301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604141221ea3afddda8a617401cf0f7252824021e4559300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010505000382010100067db05f13966dfcef07fa46bc1de610588943d981e2f71f0035cf57df75efed23789498faf85c62ce1ed4f5e8415105ec7febfb50a26ff1c551f7e23ec81f2635b29f444a1db4780623ff96421e2019b125687b083921490d97cf2d281d1e44d114692c61df0da4ff82c7d8820e710879c644fea724977a52be3cb8135e3717d5eb144a07dea4a6a70087ccde43f7f62b8c8cced2887cc7e3b625e02e855840fb585a2066f2bf345a8ecf50a3a443250382cbe9e9177f5f666266a49c68262addcc6cfc25bd66601b5799e459318dcd250b0ddeac26f07e2126794054ff0f97cc84e70741601e7941f0a7a2d62a4ee10723215efcf93d3933517e87b00ef2b5	cfpconfg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\872CD334B7E7B3C3D1C6114CD6B221026D505EAB\Blob = 030000000100000014000000872cd334b7e7b3c3d1c6114cd6b221026d505eab200000000100000059050000308205553082043da003020102021024be55999e338f74f91f0f4570845e51300d06092a864886f70d0101050500307b310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d697465643121301f06035504031318434f4d4f444f20436f6465205369676e696e672043412032301e170d3137303130363030303030305a170d3138303130363233353935395a3081c4310b3009060355040613025553310e300c06035504110c0530373031333113301106035504080c0a4e6577204a65727365793110300e06035504070c07436c6966746f6e3112301006035504090c095375697465203130303116301406035504090c0d313235352042726f616420537431283026060355040a0c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e3128302606035504030c1f436f6d6f646f20536563757269747920536f6c7574696f6e732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100ed95073c8ec3d17a4c21362d65d31f6835641be6a0d9a9d5072d3a6e00883eea41fca3f5a0b1d74693f49a26b99d2d601292be9cfda68fdaba56544fd75cbf1123626a2890d27cc8de2fbd504f6ac74255481483fcf45458f1887e8d5a3767c1fdb427ea7021ca9709451de51c1fa529f920e478de2d1c19e5e09d0168326d9257f5d4dda80112835171a125a8d34125f1237a2100fe79eff05d78d8a52113510c01f74d43f8884b559a5c1bd70b36c599594bd567fe3a533eadc6450a74e4922d4ccc525ba35a1844c190a6f3a4d34a48e7b852a26ea446cdaf4b8de433dd10efca232a605d88617116c1b632f37a87c3b1de4a317fec53ee9aa87cc9f07e790203010001a382018930820185301f0603551d230418301680141ec5b12c7d87da02687c25bc0c07843fb6cfdef1301d0603551d0e041604145cfe6910a18681d46ca19cb26662da9ed10a524b300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303301106096086480186f842010104040302041030460603551d20043f303d303b060c2b06010401b2310102010302302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e6e65742f43505330410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e63726c307206082b0601050507010104663064303c06082b060105050730028630687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f436f64655369676e696e674341322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d0101050500038201010086d177654176251a873d7a8023bcb603de50958307f4f54da2988e652be3005cf46516fcdbd42e3d933bfc05b7f0f87d4410c12f58f4ec0f1926e9b1a2f525a59575266afac8493dab23ccb9fd4f4fd26dba1db7491789c96c9e2ecf609e6c71d6cd868b9c34be32f99f1f6315656df7b3c10e18e3074bb8da6b8e22a55cebb7b3c79e251a8a53d0d4b7d044fa3d00db8e674f163d60f24d2ab87719c4fef1ea2eb87814e6efe2390dfa9c19f2b57287e048496b7ce9c8b990fe54b58d901bb722cccab45b3cea1322108a15f33392a612de66f646a5b4cf51b3d12d481b86b2a32f59ee94abdc13889480d47c1479930733f69b2391ff1a8455385326054fa5	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\8D170F91DE1907BF03CD9F1DEBFEF61E3D3670CC	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\6CD253D636A7B4D0E0981431BC064061A9853ED9	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\39488FE6BE0D00E76D475BD2902442A541A0E1A3	cmdagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C6C9520866B57431E708BB81342E072205CB5BE0	cfpconfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\F89A37FB24B0417D93BFB760B12121F5A358F9D9	cfpconfg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Xcitium132.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
3188	MsiExec.exe
3188	MsiExec.exe
2824	msiexec.exe
2824	msiexec.exe
408	chrome.exe
408	chrome.exe
424	offlineinstaller.exe
424	offlineinstaller.exe
424	offlineinstaller.exe
424	offlineinstaller.exe
1072	InternetGuardian.exe
4864	offlineinstaller.exe
4864	offlineinstaller.exe
4864	offlineinstaller.exe
4864	offlineinstaller.exe
2824	msiexec.exe
2824	msiexec.exe
2836	cmdagent.exe
2836	cmdagent.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3656	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3656	msiexec.exe
Token: SeSecurityPrivilege	2824	msiexec.exe
Token: SeCreateTokenPrivilege	3656	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3656	msiexec.exe
Token: SeLockMemoryPrivilege	3656	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3656	msiexec.exe
Token: SeMachineAccountPrivilege	3656	msiexec.exe
Token: SeTcbPrivilege	3656	msiexec.exe
Token: SeSecurityPrivilege	3656	msiexec.exe
Token: SeTakeOwnershipPrivilege	3656	msiexec.exe
Token: SeLoadDriverPrivilege	3656	msiexec.exe
Token: SeSystemProfilePrivilege	3656	msiexec.exe
Token: SeSystemtimePrivilege	3656	msiexec.exe
Token: SeProfSingleProcessPrivilege	3656	msiexec.exe
Token: SeIncBasePriorityPrivilege	3656	msiexec.exe
Token: SeCreatePagefilePrivilege	3656	msiexec.exe
Token: SeCreatePermanentPrivilege	3656	msiexec.exe
Token: SeBackupPrivilege	3656	msiexec.exe
Token: SeRestorePrivilege	3656	msiexec.exe
Token: SeShutdownPrivilege	3656	msiexec.exe
Token: SeDebugPrivilege	3656	msiexec.exe
Token: SeAuditPrivilege	3656	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3656	msiexec.exe
Token: SeChangeNotifyPrivilege	3656	msiexec.exe
Token: SeRemoteShutdownPrivilege	3656	msiexec.exe
Token: SeUndockPrivilege	3656	msiexec.exe
Token: SeSyncAgentPrivilege	3656	msiexec.exe
Token: SeEnableDelegationPrivilege	3656	msiexec.exe
Token: SeManageVolumePrivilege	3656	msiexec.exe
Token: SeImpersonatePrivilege	3656	msiexec.exe
Token: SeCreateGlobalPrivilege	3656	msiexec.exe
Token: SeCreateTokenPrivilege	3656	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3656	msiexec.exe
Token: SeLockMemoryPrivilege	3656	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3656	msiexec.exe
Token: SeMachineAccountPrivilege	3656	msiexec.exe
Token: SeTcbPrivilege	3656	msiexec.exe
Token: SeSecurityPrivilege	3656	msiexec.exe
Token: SeTakeOwnershipPrivilege	3656	msiexec.exe
Token: SeLoadDriverPrivilege	3656	msiexec.exe
Token: SeSystemProfilePrivilege	3656	msiexec.exe
Token: SeSystemtimePrivilege	3656	msiexec.exe
Token: SeProfSingleProcessPrivilege	3656	msiexec.exe
Token: SeIncBasePriorityPrivilege	3656	msiexec.exe
Token: SeCreatePagefilePrivilege	3656	msiexec.exe
Token: SeCreatePermanentPrivilege	3656	msiexec.exe
Token: SeBackupPrivilege	3656	msiexec.exe
Token: SeRestorePrivilege	3656	msiexec.exe
Token: SeShutdownPrivilege	3656	msiexec.exe
Token: SeDebugPrivilege	3656	msiexec.exe
Token: SeAuditPrivilege	3656	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3656	msiexec.exe
Token: SeChangeNotifyPrivilege	3656	msiexec.exe
Token: SeRemoteShutdownPrivilege	3656	msiexec.exe
Token: SeUndockPrivilege	3656	msiexec.exe
Token: SeSyncAgentPrivilege	3656	msiexec.exe
Token: SeEnableDelegationPrivilege	3656	msiexec.exe
Token: SeManageVolumePrivilege	3656	msiexec.exe
Token: SeImpersonatePrivilege	3656	msiexec.exe
Token: SeCreateGlobalPrivilege	3656	msiexec.exe
Token: SeCreateTokenPrivilege	3656	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3656	msiexec.exe
Token: SeLockMemoryPrivilege	3656	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3656	msiexec.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4924	Xcitium132.exe
424	offlineinstaller.exe
1840	Xcitium132.exe
4864	offlineinstaller.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2216	2824	msiexec.exe	83
PID 2824 wrote to memory of 2216	2824	msiexec.exe	83
PID 2824 wrote to memory of 2216	2824	msiexec.exe	83
PID 2824 wrote to memory of 3188	2824	msiexec.exe	86
PID 2824 wrote to memory of 3188	2824	msiexec.exe	86
PID 2824 wrote to memory of 3188	2824	msiexec.exe	86
PID 2824 wrote to memory of 4804	2824	msiexec.exe	92
PID 2824 wrote to memory of 4804	2824	msiexec.exe	92
PID 2824 wrote to memory of 1596	2824	msiexec.exe	94
PID 2824 wrote to memory of 1596	2824	msiexec.exe	94
PID 2824 wrote to memory of 1596	2824	msiexec.exe	94
PID 2824 wrote to memory of 768	2824	msiexec.exe	95
PID 2824 wrote to memory of 768	2824	msiexec.exe	95
PID 2824 wrote to memory of 768	2824	msiexec.exe	95
PID 408 wrote to memory of 4112	408	chrome.exe	97
PID 408 wrote to memory of 4112	408	chrome.exe	97
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 1440	408	chrome.exe	98
PID 408 wrote to memory of 3540	408	chrome.exe	99
PID 408 wrote to memory of 3540	408	chrome.exe	99
PID 408 wrote to memory of 1928	408	chrome.exe	100
PID 408 wrote to memory of 1928	408	chrome.exe	100
PID 408 wrote to memory of 1928	408	chrome.exe	100
PID 408 wrote to memory of 1928	408	chrome.exe	100
PID 408 wrote to memory of 1928	408	chrome.exe	100
PID 408 wrote to memory of 1928	408	chrome.exe	100
PID 408 wrote to memory of 1928	408	chrome.exe	100
PID 408 wrote to memory of 1928	408	chrome.exe	100
PID 408 wrote to memory of 1928	408	chrome.exe	100
PID 408 wrote to memory of 1928	408	chrome.exe	100
PID 408 wrote to memory of 1928	408	chrome.exe	100
PID 408 wrote to memory of 1928	408	chrome.exe	100
PID 408 wrote to memory of 1928	408	chrome.exe	100
PID 408 wrote to memory of 1928	408	chrome.exe	100
PID 408 wrote to memory of 1928	408	chrome.exe	100
PID 408 wrote to memory of 1928	408	chrome.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3656

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Drops file in Drivers directory
- Blocklisted process makes network request
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9C51139651822B3468E79977D8D92CE1 U
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:2216
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 79DED2F9B259B15DE850F846A6E0C2DD C
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3188
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4804
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E9AFCA8F558FA464D04126365D7F42F7
  2⤵
  - Loads dropped DLL
  PID:1596
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A7EF7BEBDEF4C9838AD4EF0C482FCF0A E Global\MSI0000
  2⤵
  - Blocklisted process makes network request
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:768
- C:\Program Files (x86)\Insec\tempinstaller.exe
  "C:\Program Files (x86)\Insec\tempinstaller.exe" Command Line
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:3636
- - C:\Program Files\InternetGuardian\InternetGuardian.exe
    "C:\Program Files\InternetGuardian\InternetGuardian.exe" install
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1072
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F66A86C643C8B8371405EDA9B5BA20FB
  2⤵
  - Checks for any installed AV software in registry
  - Enumerates connected drives
  - Loads dropped DLL
  PID:1684
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 199F76CD05E8252C6CD88EBB31CA0A2D E Global\MSI0000
  2⤵
  - Checks for any installed AV software in registry
  - Enumerates connected drives
  - Loads dropped DLL
  PID:3856
- - C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
    "C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --langID 1033 --msiinstall --installCertificates --osver 1000 --av --productguid=CE4134F2-43E3-4835-B234-584D063134DB --upgradeBackuped= --createConfig "active=endpt;dplus=opt;esm=1;av=1;fw=0;cesav=1;cesfw=0;cessandbox=1;free=0;noalerts=0;cloud=1;sendstats=1;configfile=;fwstate=0;dfstate=0;avstate=0;bbstate=0;avservers=0;standalone=0;useblob=0;trustnewnets=0;"
    3⤵
    - Drops file in Drivers directory
    - Manipulates Digital Signatures
    - Sets service image path in registry
    - Adds Run key to start application
    - Checks for any installed AV software in registry
    - Drops desktop.ini file(s)
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies data under HKEY_USERS
    - Modifies system certificate store
    PID:2256
  - - C:\Program Files\COMODO\COMODO Internet Security\cisbf.exe
      "C:\Program Files\COMODO\COMODO Internet Security\cisbf.exe" /Regserver
      4⤵
      Executes dropped EXE
      PID:4552
  - - C:\Windows\system32\runonce.exe
      "C:\Windows\system32\runonce.exe" -r
      4⤵
      Checks processor information in registry
      Modifies data under HKEY_USERS
      PID:2700
    - - C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        5⤵
        Modifies data under HKEY_USERS
        
        PID:4136
  - - C:\Windows\system32\runonce.exe
      "C:\Windows\system32\runonce.exe" -r
      4⤵
      Checks processor information in registry
      Modifies data under HKEY_USERS
      PID:3928
    - - C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        5⤵
        
        PID:2328
- C:\Windows\Installer\MSI2300.tmp
  "C:\Windows\Installer\MSI2300.tmp" -rptype 0 -descr "Installing COMODO Client - Security " -logfile "C:\Users\Admin\AppData\Local\Temp\COMODO Internet Security dbgout.log"
  2⤵
  - Executes dropped EXE
  PID:5044
- - C:\Windows\Installer\MSI2300.tmp
    "C:\Windows\Installer\MSI2300.tmp" -rptype 0 -descr "Installing COMODO Client - Security " -logfile "C:\Users\Admin\AppData\Local\Temp\COMODO Internet Security dbgout.log" -working
    3⤵
    - Executes dropped EXE
    PID:3208
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\COMODO\COMODO Internet Security\cmdcom32.dll"
  2⤵
  - Modifies registry class
  PID:2936
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\COMODO\COMODO Internet Security\AmsiProvider_x64.dll"
  2⤵
  - Enumerates connected drives
  PID:3656
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\COMODO\COMODO Internet Security\AmsiProvider_x86.dll"
  2⤵
  - Enumerates connected drives
  PID:2804
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\COMODO\COMODO Internet Security\cavshell.dll"
  2⤵
  PID:3536
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\COMODO\COMODO Internet Security\cisresc.dll"
  2⤵
  PID:3988
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\COMODO\COMODO Internet Security\cisbfps.dll"
  2⤵
  PID:1616
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\COMODO\COMODO Internet Security\cmdcomps.dll"
  2⤵
  PID:840
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\COMODO\COMODO Internet Security\cavwpps.dll"
  2⤵
  PID:4768
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6FD50A1E9031AF77708202A81E220841
  2⤵
  PID:1920
- - C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
    "C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --selfProtectionDisable
    3⤵
    PID:2548
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 39EB655D7FAB0C4B325B06FD1EA3A8BB E Global\MSI0000
  2⤵
  PID:1044
- - C:\Program Files\COMODO\EdrAgentV2\edrsvc.exe
    "C:\Program Files\COMODO\EdrAgentV2\edrsvc.exe" install
    3⤵
    PID:2584
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 59D908AEACA5651AC7BA7217A8FE6F37
  2⤵
  PID:4056
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 11391ACFECECA0C12990E6726D47CE36 E Global\MSI0000
  2⤵
  PID:420
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\COMODO\Endpoint Manager\" && "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe" "
    3⤵
    PID:3312
  - - C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe
      "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe"
      4⤵
      PID:5020
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
        5⤵
        
        PID:788

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb7ed3cc40,0x7ffb7ed3cc4c,0x7ffb7ed3cc58
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1848,i,15164176077196534759,17507926589550977370,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2132,i,15164176077196534759,17507926589550977370,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2200,i,15164176077196534759,17507926589550977370,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2208 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,15164176077196534759,17507926589550977370,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3192,i,15164176077196534759,17507926589550977370,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4500,i,15164176077196534759,17507926589550977370,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4824,i,15164176077196534759,17507926589550977370,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4676,i,15164176077196534759,17507926589550977370,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5084,i,15164176077196534759,17507926589550977370,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4732,i,15164176077196534759,17507926589550977370,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5348,i,15164176077196534759,17507926589550977370,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5360,i,15164176077196534759,17507926589550977370,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4636 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3596,i,15164176077196534759,17507926589550977370,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  - NTFS ADS
  PID:432
- C:\Users\Admin\Downloads\Xcitium132.exe
  "C:\Users\Admin\Downloads\Xcitium132.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4924
- - C:\Users\Admin\AppData\Local\Temp\tmp_a11d5e11c6ab830a484cc397588e32ce33557ef2\offlineinstaller.exe
    /q /ra warn /rm "NFR Version Installed" /rt 300 /sm "NFR Version Installed" /7orhigher /8orhigher /brand c
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:424

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:3296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2052

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3292

C:\Users\Admin\Downloads\Xcitium132.exe
"C:\Users\Admin\Downloads\Xcitium132.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1840
- C:\Users\Admin\AppData\Local\Temp\tmp_a11d5e11c6ab830a484cc397588e32ce33557ef2\offlineinstaller.exe
  /q /ra warn /rm "NFR Version Installed" /rt 300 /sm "NFR Version Installed" /7orhigher /8orhigher /brand c
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4864
- - C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
    "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe" reboot "NFR Version Installed"
    3⤵
    PID:4328

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:1052
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{dedf0463-f53e-b547-b3e4-f0b73e182d16}\cesguard.inf" "9" "4ca5bc957" "0000000000000150" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files\COMODO\COMODO Internet Security\drivers\win10"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2580
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\cesguard.inf_amd64_3e3769c667ae9359\cesguard.inf" "0" "4ca5bc957" "0000000000000160" "WinSta0\Default"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  PID:3720
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{0d7a073b-7fd6-c042-a521-b7daa2753c81}\ceskbdflt.inf" "9" "4b12ed323" "0000000000000164" "WinSta0\Default" "0000000000000184" "208" "C:\Program Files\COMODO\COMODO Internet Security\drivers\win10"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:1008
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\ceskbdflt.inf_amd64_aaf1df0a1f017963\ceskbdflt.inf" "0" "4b12ed323" "0000000000000184" "WinSta0\Default"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  PID:2024
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{569770ad-4979-8f40-912a-61f072c1caf5}\ceshlp.inf" "9" "423ba8ab7" "0000000000000150" "Service-0x0-3e7$\Default" "000000000000016C" "208" "C:\Program Files\COMODO\COMODO Internet Security\drivers\win10"
  2⤵
  PID:1984
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\ceshlp.inf_amd64_21b8e6f00848db32\ceshlp.inf" "0" "423ba8ab7" "000000000000017C" "Service-0x0-3e7$\Default"
  2⤵
  PID:2844
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "9" "C:\Program Files\COMODO\COMODO Internet Security\drivers\win10\cesfw.inf" "9" "497f7008b" "0000000000000168" "Service-0x0-3e7$\Default" "0000000000000184" "208" "C:\Program Files\COMODO\COMODO Internet Security\drivers\win10"
  2⤵
  PID:2980

C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
"C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe"
1⤵
- Manipulates Digital Signatures
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2836
- C:\Windows\system32\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\COMODO\COMODO Internet Security\cavwpps.dll"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:1308
- C:\Program Files\COMODO\COMODO Internet Security\cis.exe
  "C:\Program Files\COMODO\COMODO Internet Security\cis.exe" --cistrayUI
  2⤵
  PID:3096

C:\Program Files\COMODO\COMODO Internet Security\cmdicap.exe
"C:\Program Files\COMODO\COMODO Internet Security\cmdicap.exe"
1⤵
- Executes dropped EXE
PID:684

C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
"C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe" /ModeAvMonitor -Embedding
1⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
PID:3224

C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
"C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe" /ModeTdtHost -Embedding
1⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
PID:3112

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe"
1⤵
PID:5380
- C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"
  2⤵
  PID:3152
- C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe" noui
  2⤵
  PID:4920
- C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --start
  2⤵
  PID:5964
- C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
  "C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --installBrandSet "C:\ProgramData\COMODO\Endpoint Manager\brand.zip"
  2⤵
  PID:900

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5516

C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe"
1⤵
PID:5940

C:\Program Files\COMODO\COMODO Internet Security\cis.exe
"C:\Program Files\COMODO\COMODO Internet Security\cis.exe" --cistrayUI
1⤵
PID:3408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery