640b41fd6e2b9d33490ecc0943abf950127803bdca344999702e6714d1afd9c6

Analysis

max time kernel
170s
max time network
212s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

640b41fd6e2b9d33490ecc0943abf950127803bdca344999702e6714d1afd9c6.exe
Size

2.3MB
MD5

9b0a133907d375fe9660fe1096c16e25
SHA1

483be8832a4d7e5215485869857d4e55a6f02536
SHA256

640b41fd6e2b9d33490ecc0943abf950127803bdca344999702e6714d1afd9c6
SHA512

5e6c71c667af4f8e13868379f30027a18536cdb0ca4353bc7125dd55775210b5a03cdb25cda18c97ba456b75cfe26ed8467e48bb47e44f2347ab671279950bc0
SSDEEP

49152:hc//////ZTIuA0Vt5yEslK/3/fKWFbZXgmp8xm4pvo1irlR/nF/T7DZ4:hc//////jt5yDI/3ntZJ8sKw1ol1F/TW

Score

8^/10

discovery upx vmprotect

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

tj1.exeCFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exegamedmon.exe

pid process

688 tj1.exe
520 CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
1408 gamedmon.exe

pid	process
688	tj1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
1408	gamedmon.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\tj1.exe	upx
C:\Users\Admin\AppData\Local\Temp\tj1.exe	upx
C:\Users\Admin\AppData\Local\Temp\tj1.exe	upx
behavioral1/memory/688-69-0x00000000008D0000-0x0000000000953000-memory.dmp	upx
behavioral1/memory/688-78-0x00000000008D0000-0x0000000000953000-memory.dmp	upx

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe	vmprotect
\Users\Admin\AppData\Local\Temp\CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe	vmprotect
behavioral1/memory/520-71-0x0000000000400000-0x0000000000906000-memory.dmp	vmprotect
behavioral1/memory/520-81-0x0000000000400000-0x0000000000906000-memory.dmp	vmprotect

Loads dropped DLL 5 IoCs

Processes:

cmd.execmd.exetj1.exe

pid process

1772 cmd.exe
1456 cmd.exe
1456 cmd.exe
688 tj1.exe
688 tj1.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops file in Program Files directory 2 IoCs

Processes:

tj1.exe

description ioc process

File created C:\Program Files (x86)\Æô¶¯\Æô¶¯.exe tj1.exe
File created C:\Program Files (x86)\Æô¶¯\Uninstall.exe tj1.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1772	cmd.exe
1456	cmd.exe
1456	cmd.exe
688	tj1.exe
688	tj1.exe

description	ioc	process
File created	C:\Program Files (x86)\Æô¶¯\Æô¶¯.exe	tj1.exe
File created	C:\Program Files (x86)\Æô¶¯\Uninstall.exe	tj1.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXECFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exeiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\75yoyo.com\Total = "411"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "496"	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\cstv2.bar\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376327927"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\75yoyo.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.75yoyo.com\ = "337"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\75yoyo.com\Total = "252"	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\75yoyo.com\Total = "189"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.75yoyo.com\ = "485"	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da0000000002000000000010660000000100002000000070ed4806eb752ecf87d175ec106d5e134644d20fdcdfdba5faad15cfcc572a8f000000000e8000000002000020000000c8dbd6ae1f0bb925c9d39749b56a46d4ed00fb14bffa33b94d776726166db82520000000f0fc8379c562a0420651291f33f7e5fe5ae7b363e47514afbf3c5a5dee4d93aa40000000be13267d782472713f4c544af4fd71efb5d3b66a89348102f688b12758c100b1e9a701bf0cc898bfadf08ec81e98aaeb9ff5d91c3a0b6726988c7adca0230802	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "263"	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\cstv2.bar\Total = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "559"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ad79427502d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da00000000020000000000106600000001000020000000222b7f2308912f5bf4040a29a26df935fcd44154d0be763819f09e4ee9ddd608000000000e8000000002000020000000bb237649b84a5bd119af178e924f82b6251aef56c4527e38c93671e8b366b75690000000d0852c24ed5e302b4e59f900c4af61a53a9f35d13d168fbed2d48529f9a0e6fcdf55487b0312c561a73649a0d5ef1bf7b5e3b446f0292a4a39cc7ef89ae5d998990cc5b786c42bf365c687d643538a28a588b90c5aba977fe6e6db57cd5829843e14d698cb3bfaae15c55c3a14e3df1e637c161dcd00892cd67bcfc09d0c1e32a313a92f750f617a25ec6aaaa13266ce4000000031012657efd296991b8bd49823b58bbd6d98a18f8a5cd6bd623254da2d117223e595af2538a088766a9132669c64a00cd58835266cb1005ae9607591f41a441e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\75yoyo.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\75yoyo.com\Total = "263"	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.75yoyo.com\ = "348"	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "485"	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.75yoyo.com	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\75yoyo.com	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\cstv2.bar\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\75yoyo.com\Total = "348"	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.75yoyo.com\ = "496"	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.75yoyo.com\ = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "189"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\cstv2.bar	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\75yoyo.com\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "252"	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.75yoyo.com\ = "263"	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "337"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Modifies system certificate store 2 TTPs 31 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob = 1900000001000000100000000b6cd9778e41ad67fd6be0a6903710440f00000001000000140000001e427a3639cce4c27e94b1777964ca289a722cad09000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703091400000001000000140000006daa9b0987c4d0d422ed4007374d19f191ffded31d000000010000001000000096f98b6e79a74810ce7d398a82f977780b000000010000000e000000430065007200740075006d0000000300000001000000140000006252dc40f71143a22fde9ef7348e064251b181180400000001000000100000002c8f9f661d1890b147269d8e86828ca92000000001000000100300003082030c308201f4a0030201020203010020300d06092a864886f70d0101050500303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d204341301e170d3032303631313130343633395a170d3237303631313130343633395a303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ceb1c12ed34f7ccd25ce183e4fc48c6f806a73c85b51f89bd2dcbb005cb1a0fc7503ee81f088ee2352e9e615338dac2d09c576f92b398089e4974b90a5a878f873437ba461b0d858cce16c667e9cf3095e556384d5a8eff3b12e3068b3c43cd8ac6e8d995a904e34dc369a8f818850b76d964209f3d795830d414bb06a6bf8fc0f7e629f67c4ed265f10260f084ff0a45728ce8fb8ed45f66eee255daa6e39bee4932fd947a072ebfaa65bafca533fe20ec69656116ef7e966a926d87f9553ed0a8588ba4f29a5428c5eb6fc852000aa680ba11a85019cc446638288b622b1eefeaa46597ecf352cd5b6da5df748331454b6ebd96fcecd88d6ab1bda963b1d590203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100b88dceefe714bacfeeb044926cb4393ea2846eadb82177d2d4778287e6204181eee2f811b763d11737be1976241c041a4ceb3daa676f2dd4cdfe653170c51ba6020aba607b6d58c29a49fe63320b6be33ac0acab3bb0e8d309518c1083c634e0c52be01ab66014276c32778cbcb27298cfcdcc3fb9c8244214d657fce62643a91de58090ce0354283ef73fd3f84ded6a0a3a93139b3b142313639c3fd1872779e54c51e301ad855d1a3bb1d57310a4d3f2bc6e64f55a5690a8c70e4c740f2e713bf7c847f4696f15f2115e831e9c7c52aefd02da12a8596718dbbc70dd9bb169ed80ce8940486a0e35ca29661521942ce8602a9b854a40f36b8a24ec06162c73	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6190000000100000010000000f044424c506513d62804c04f719403f9040000000100000010000000e829e65d7c4307d6fbc13c179e037a36030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a4050f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce1800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c61800000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405040000000100000010000000e829e65d7c4307d6fbc13c179e037a36190000000100000010000000f044424c506513d62804c04f719403f920000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 0f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f9030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a4051800000001000000100000002fe1f70bb05d7c92335bc5e05b984da6140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a3620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 190000000100000010000000f044424c506513d62804c04f719403f9040000000100000010000000e829e65d7c4307d6fbc13c179e037a36140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c61800000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a4050f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce20000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 190000000100000010000000f044424c506513d62804c04f719403f9040000000100000010000000e829e65d7c4307d6fbc13c179e037a36030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a4051800000001000000100000002fe1f70bb05d7c92335bc5e05b984da6140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c60f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce20000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 040000000100000010000000e829e65d7c4307d6fbc13c179e037a361800000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405190000000100000010000000f044424c506513d62804c04f719403f9140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 0f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6190000000100000010000000f044424c506513d62804c04f719403f9030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a4051800000001000000100000002fe1f70bb05d7c92335bc5e05b984da6040000000100000010000000e829e65d7c4307d6fbc13c179e037a3620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 040000000100000010000000e829e65d7c4307d6fbc13c179e037a36140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6190000000100000010000000f044424c506513d62804c04f719403f9030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a4050f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce1800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 190000000100000010000000f044424c506513d62804c04f719403f91800000001000000100000002fe1f70bb05d7c92335bc5e05b984da6140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce20000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob = 0f00000001000000140000001e427a3639cce4c27e94b1777964ca289a722cad09000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703091400000001000000140000006daa9b0987c4d0d422ed4007374d19f191ffded31d000000010000001000000096f98b6e79a74810ce7d398a82f977780b000000010000000e000000430065007200740075006d0000000300000001000000140000006252dc40f71143a22fde9ef7348e064251b181182000000001000000100300003082030c308201f4a0030201020203010020300d06092a864886f70d0101050500303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d204341301e170d3032303631313130343633395a170d3237303631313130343633395a303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ceb1c12ed34f7ccd25ce183e4fc48c6f806a73c85b51f89bd2dcbb005cb1a0fc7503ee81f088ee2352e9e615338dac2d09c576f92b398089e4974b90a5a878f873437ba461b0d858cce16c667e9cf3095e556384d5a8eff3b12e3068b3c43cd8ac6e8d995a904e34dc369a8f818850b76d964209f3d795830d414bb06a6bf8fc0f7e629f67c4ed265f10260f084ff0a45728ce8fb8ed45f66eee255daa6e39bee4932fd947a072ebfaa65bafca533fe20ec69656116ef7e966a926d87f9553ed0a8588ba4f29a5428c5eb6fc852000aa680ba11a85019cc446638288b622b1eefeaa46597ecf352cd5b6da5df748331454b6ebd96fcecd88d6ab1bda963b1d590203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100b88dceefe714bacfeeb044926cb4393ea2846eadb82177d2d4778287e6204181eee2f811b763d11737be1976241c041a4ceb3daa676f2dd4cdfe653170c51ba6020aba607b6d58c29a49fe63320b6be33ac0acab3bb0e8d309518c1083c634e0c52be01ab66014276c32778cbcb27298cfcdcc3fb9c8244214d657fce62643a91de58090ce0354283ef73fd3f84ded6a0a3a93139b3b142313639c3fd1872779e54c51e301ad855d1a3bb1d57310a4d3f2bc6e64f55a5690a8c70e4c740f2e713bf7c847f4696f15f2115e831e9c7c52aefd02da12a8596718dbbc70dd9bb169ed80ce8940486a0e35ca29661521942ce8602a9b854a40f36b8a24ec06162c73	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob = 0400000001000000100000002c8f9f661d1890b147269d8e86828ca90300000001000000140000006252dc40f71143a22fde9ef7348e064251b181180b000000010000000e000000430065007200740075006d0000001d000000010000001000000096f98b6e79a74810ce7d398a82f977781400000001000000140000006daa9b0987c4d0d422ed4007374d19f191ffded309000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090f00000001000000140000001e427a3639cce4c27e94b1777964ca289a722cad2000000001000000100300003082030c308201f4a0030201020203010020300d06092a864886f70d0101050500303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d204341301e170d3032303631313130343633395a170d3237303631313130343633395a303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ceb1c12ed34f7ccd25ce183e4fc48c6f806a73c85b51f89bd2dcbb005cb1a0fc7503ee81f088ee2352e9e615338dac2d09c576f92b398089e4974b90a5a878f873437ba461b0d858cce16c667e9cf3095e556384d5a8eff3b12e3068b3c43cd8ac6e8d995a904e34dc369a8f818850b76d964209f3d795830d414bb06a6bf8fc0f7e629f67c4ed265f10260f084ff0a45728ce8fb8ed45f66eee255daa6e39bee4932fd947a072ebfaa65bafca533fe20ec69656116ef7e966a926d87f9553ed0a8588ba4f29a5428c5eb6fc852000aa680ba11a85019cc446638288b622b1eefeaa46597ecf352cd5b6da5df748331454b6ebd96fcecd88d6ab1bda963b1d590203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100b88dceefe714bacfeeb044926cb4393ea2846eadb82177d2d4778287e6204181eee2f811b763d11737be1976241c041a4ceb3daa676f2dd4cdfe653170c51ba6020aba607b6d58c29a49fe63320b6be33ac0acab3bb0e8d309518c1083c634e0c52be01ab66014276c32778cbcb27298cfcdcc3fb9c8244214d657fce62643a91de58090ce0354283ef73fd3f84ded6a0a3a93139b3b142313639c3fd1872779e54c51e301ad855d1a3bb1d57310a4d3f2bc6e64f55a5690a8c70e4c740f2e713bf7c847f4696f15f2115e831e9c7c52aefd02da12a8596718dbbc70dd9bb169ed80ce8940486a0e35ca29661521942ce8602a9b854a40f36b8a24ec06162c73	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 0f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c61800000001000000100000002fe1f70bb05d7c92335bc5e05b984da6190000000100000010000000f044424c506513d62804c04f719403f9030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405040000000100000010000000e829e65d7c4307d6fbc13c179e037a3620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 040000000100000010000000e829e65d7c4307d6fbc13c179e037a36030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a4050f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f91800000001000000100000002fe1f70bb05d7c92335bc5e05b984da6140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 190000000100000010000000f044424c506513d62804c04f719403f9040000000100000010000000e829e65d7c4307d6fbc13c179e037a361800000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c60f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce20000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 1800000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f9030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a3620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 1800000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce040000000100000010000000e829e65d7c4307d6fbc13c179e037a36030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6190000000100000010000000f044424c506513d62804c04f719403f920000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c61800000001000000100000002fe1f70bb05d7c92335bc5e05b984da6190000000100000010000000f044424c506513d62804c04f719403f90f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce040000000100000010000000e829e65d7c4307d6fbc13c179e037a36030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a40520000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 1800000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a36190000000100000010000000f044424c506513d62804c04f719403f920000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 040000000100000010000000e829e65d7c4307d6fbc13c179e037a36140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c61800000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405190000000100000010000000f044424c506513d62804c04f719403f90f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce20000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f91800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 0f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f9040000000100000010000000e829e65d7c4307d6fbc13c179e037a36030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a4051800000001000000100000002fe1f70bb05d7c92335bc5e05b984da6140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 0f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f9040000000100000010000000e829e65d7c4307d6fbc13c179e037a36030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c61800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 1800000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405040000000100000010000000e829e65d7c4307d6fbc13c179e037a36190000000100000010000000f044424c506513d62804c04f719403f920000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 190000000100000010000000f044424c506513d62804c04f719403f9140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c61800000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce20000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exetj1.exegamedmon.exe

pid	process
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
688	tj1.exe
1408	gamedmon.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
1408	gamedmon.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

tj1.exe

description pid process

Token: SeIncBasePriorityPrivilege 688 tj1.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

956 iexplore.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	688	tj1.exe

pid	process
956	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exeiexplore.exeIEXPLORE.EXE

pid	process
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
956	iexplore.exe
956	iexplore.exe
240	IEXPLORE.EXE
240	IEXPLORE.EXE
240	IEXPLORE.EXE
240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

640b41fd6e2b9d33490ecc0943abf950127803bdca344999702e6714d1afd9c6.execmd.execmd.exetj1.exeCFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exeiexplore.exe

description	pid	process	target process
PID 848 wrote to memory of 1456	848	640b41fd6e2b9d33490ecc0943abf950127803bdca344999702e6714d1afd9c6.exe	cmd.exe
PID 848 wrote to memory of 1456	848	640b41fd6e2b9d33490ecc0943abf950127803bdca344999702e6714d1afd9c6.exe	cmd.exe
PID 848 wrote to memory of 1456	848	640b41fd6e2b9d33490ecc0943abf950127803bdca344999702e6714d1afd9c6.exe	cmd.exe
PID 848 wrote to memory of 1456	848	640b41fd6e2b9d33490ecc0943abf950127803bdca344999702e6714d1afd9c6.exe	cmd.exe
PID 848 wrote to memory of 1772	848	640b41fd6e2b9d33490ecc0943abf950127803bdca344999702e6714d1afd9c6.exe	cmd.exe
PID 848 wrote to memory of 1772	848	640b41fd6e2b9d33490ecc0943abf950127803bdca344999702e6714d1afd9c6.exe	cmd.exe
PID 848 wrote to memory of 1772	848	640b41fd6e2b9d33490ecc0943abf950127803bdca344999702e6714d1afd9c6.exe	cmd.exe
PID 848 wrote to memory of 1772	848	640b41fd6e2b9d33490ecc0943abf950127803bdca344999702e6714d1afd9c6.exe	cmd.exe
PID 1772 wrote to memory of 688	1772	cmd.exe	tj1.exe
PID 1772 wrote to memory of 688	1772	cmd.exe	tj1.exe
PID 1772 wrote to memory of 688	1772	cmd.exe	tj1.exe
PID 1772 wrote to memory of 688	1772	cmd.exe	tj1.exe
PID 1772 wrote to memory of 688	1772	cmd.exe	tj1.exe
PID 1772 wrote to memory of 688	1772	cmd.exe	tj1.exe
PID 1772 wrote to memory of 688	1772	cmd.exe	tj1.exe
PID 1456 wrote to memory of 520	1456	cmd.exe	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
PID 1456 wrote to memory of 520	1456	cmd.exe	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
PID 1456 wrote to memory of 520	1456	cmd.exe	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
PID 1456 wrote to memory of 520	1456	cmd.exe	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
PID 688 wrote to memory of 1408	688	tj1.exe	gamedmon.exe
PID 688 wrote to memory of 1408	688	tj1.exe	gamedmon.exe
PID 688 wrote to memory of 1408	688	tj1.exe	gamedmon.exe
PID 688 wrote to memory of 1408	688	tj1.exe	gamedmon.exe
PID 688 wrote to memory of 360	688	tj1.exe	cmd.exe
PID 688 wrote to memory of 360	688	tj1.exe	cmd.exe
PID 688 wrote to memory of 360	688	tj1.exe	cmd.exe
PID 688 wrote to memory of 360	688	tj1.exe	cmd.exe
PID 520 wrote to memory of 956	520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe	iexplore.exe
PID 520 wrote to memory of 956	520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe	iexplore.exe
PID 520 wrote to memory of 956	520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe	iexplore.exe
PID 520 wrote to memory of 956	520	CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe	iexplore.exe
PID 956 wrote to memory of 240	956	iexplore.exe	IEXPLORE.EXE
PID 956 wrote to memory of 240	956	iexplore.exe	IEXPLORE.EXE
PID 956 wrote to memory of 240	956	iexplore.exe	IEXPLORE.EXE
PID 956 wrote to memory of 240	956	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\640b41fd6e2b9d33490ecc0943abf950127803bdca344999702e6714d1afd9c6.exe
"C:\Users\Admin\AppData\Local\Temp\640b41fd6e2b9d33490ecc0943abf950127803bdca344999702e6714d1afd9c6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1456

C:\Users\Admin\AppData\Local\Temp\CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
C:\Users\Admin\AppData\Local\Temp\CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
3⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:520

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.75yoyo.com/
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:956 CREDAT:275457 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:240

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\tj1.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1772

C:\Users\Admin\AppData\Local\Temp\tj1.exe
C:\Users\Admin\AppData\Local\Temp\tj1.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:688

C:\Users\Admin\AppData\Local\Temp\gamedmon.exe
C:\Users\Admin\AppData\Local\Temp\gamedmon.exe -startgame
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1408

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\tj1.exe > nul
4⤵
PID:360

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Filesize
1KB

MD5
b4d8d34716c9521098f5b061b0e5de0d

SHA1
991b753cb6db62e4ac4708649317a3a884702ce5

SHA256
a92b54ae0d7251ab98f8d93caac20d860156e014c0b74c6e9bd58a3ff5cf4be1

SHA512
bdd956780f40fb6758cb376768bedac65cfe289007c6f2179927bafcf41c7df60ad1a7456b4cb4d3b353c03cf1b9049e90fb0b7913e36b10d84b35e6aabe5847

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Filesize
1KB

MD5
e13c50f3013d0fcc1c3752a9be768007

SHA1
d7a1eb2db7b47e111b09441fbccc3812ceceb46f

SHA256
ac3d7cce922550605b623dba5820809adaa392737966add9a230d12793e2e1f5

SHA512
e159cb3d1348a81fa228387f24875af0d79a40fa6a017c2df70399611ea935808731939f65b6e23803f6f5e16c7ba584243a00a181e95f812552dbb4dc997c60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Filesize
1KB

MD5
cbddcb12e7cf20a60a76e32de83ea699

SHA1
5902df517b2d5c702bec654b512db986ff742592

SHA256
02f2b04db0acd5a79eb9d99aca50747da114719a8a8e753a54ac0e8d340e85c0

SHA512
8ed3acff98de9fe3bbe6a7d8893a0d058752eee29e37b5154926d6bd80dec6674fc1c8f08dc3ae701cf13f868342f107e19ab4df921fc79800b17fe7345d7b7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\20B08EBC7FEA7A579D61CF34D4900D4F
Filesize
503B

MD5
fc181f64ed2ad6437023880818d4eb43

SHA1
bf620a710565a0c652e7e30b00733f861498593d

SHA256
beb7a09c17180f9685e05e5b7a018fc490be18b0a1fa6757166aeae3363ae6e2

SHA512
478b46dd013a28fb52bb6c45c847798ba2413c48d6229f7847a2ac1b800d8094798d4e2bfacec6ea37975d4ca42db657fb9be77782d32df1a5bfd7149fa1380f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_97A2CB43E01F27293633B7B57353C80B
Filesize
1KB

MD5
578270132ec59aacc30b1377719c2b21

SHA1
c288592616b733fb47840c6f59671ab2e67eaf2a

SHA256
cc16fa12be1ae10207c51d492bb7763d35eb27baf2cd1c53e6010e3a367bcb87

SHA512
dbcabc32aaa2bb131bc486b6a1f18f6d3d520ec87ce82734d1f85137c1d5cdfd392a71e4fcc74240d3746c4c4e5b10e6224fa8a05cb3a2190f5684ce1c7cdfbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C41BDF449DB6018BBDE16213249B7F5
Filesize
503B

MD5
3ceaf53df6026a0a4486e4c32b5d5422

SHA1
d7e57f393710282eecf4d9504fd41bca0d69ffb6

SHA256
0dd9cb68310f02731baa4316ba77c77e781eeb77e485c31bbc41ca578d4e33f2

SHA512
60b81dc794aeddfad363b966b71fd220e2598d13d9d032e49a429a10bdd8987bed99ef7f458dc649ef56fe2c6b0c8d25561ac8232e6a695f47c2ff6abf94a4ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2
Filesize
471B

MD5
9f1d466852f67ad2eedec1fc8b7cfd50

SHA1
cce9b2d5086f373c6c1c49f726591b09e936813a

SHA256
350b2c3dd036422b43c24b1d264a3a04c0da80a1c3febf1977fcf5f35f745018

SHA512
12070f42b32281e427a7eb48534eefce4bb0b8d8e9377acd191db0ccf7e90bf92d4f84e486d4be66401d065a99ed585c26246e7a743045a60e22edfc267a75bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7229E30BCFD0992128433D951137A421_25EBFEC9C14E42B04A7785CD49B3BAA4
Filesize
471B

MD5
f9071cd6eee7c9eadbc5193b2a6475bb

SHA1
2f536dccefcc98963350ac191e69540005f9c458

SHA256
6632c38ce7a95be301e53e5990562a5da2788895f51bac0e4de9f33ff21ee447

SHA512
e961c0cec55a19b34a31df1903ecacc663af9bf5cbbd5a08fecc72e29b9ada8ec9696ae23069117a45fd13a516d5a7b6b57e979e851693059ac2436af9a7c817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
Filesize
1KB

MD5
f03113482a029101ba10c444ad038fb1

SHA1
b9171412d6eb289bda0fc4be494f4cc62e2ac7e8

SHA256
3f842de22ec95aba92cb1ae29ecce22c06044c62bcdf8f62436439d1b773c110

SHA512
d3867c5a35c89076224295e5c9867b717dde23da26695aff55bc14812460981d8c73bfc645eb106e9f5da3fe60b697b868fd7496d197cc6e7507b24c5b4e8b9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8408FE5CA4467EE4DA84A76EF238FE3
Filesize
1KB

MD5
e829e65d7c4307d6fbc13c179e037a36

SHA1
a053375bfe84e8b748782c7cee15827a6af5a405

SHA256
67add1166b020ae61b8f5fc96813c04c2aa589960796865572a3c7e737613dfd

SHA512
96c5793b2b57d8df5891c94015720960e0da4c2cf8ce1fc5707a0b46e5db8ce3761fb5fdb430f619d1579f13e80fbdd973ef6a024129ed039aa193273158fcad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1
Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1
Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Filesize
508B

MD5
dacddea6f5a7064726a435b24bd9dff5

SHA1
bbc4c4183d624ad0094e88c97a667c08170265eb

SHA256
dbc2126aa227cad6a017675d98aeb222b23ca0c54f8d0c726928a971946f1364

SHA512
ad5ef13a6f04d5ee828264128914a284fbf8b4209fd9938b30ca53840f80c5829ba2dd5c7023a23757b4294a4cbad57f42577ff549de0c3a6d00dfa6221bc6c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Filesize
508B

MD5
f91b0ca23c8c5843ebd389c3e8af9e06

SHA1
dcf86a74d67e0ae7311fdfbe81242f6c1e556681

SHA256
c8b29b2eb7962dfa8e83abffe124f11cdc10d54caa7b49c37ff2f42f41f1fac1

SHA512
41c21b78677bc63236d0c184bde975bf565b852f7003f30c1d848720b0bf07f6d11ad43618604a626b19f16a599da3eb993accabb66c5dfb85b9ba12163d443d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Filesize
508B

MD5
c806e9d9fd8781ef3cd95d4bff361fe7

SHA1
27ef82cf242a896c59a4ae02a24fbcdf5873251d

SHA256
d0f652e71700a610bd648c64b1a39ee505a577276681b7ec41c3e73c2a6dce3d

SHA512
06210c460b6a98549f38ade4335aa62553eb35a7261d7833ce956b9f159d6c5b92fcb0dc2d8ba593015267bb8a8ed53956073d3399b935de20e4b2460a2724ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Filesize
508B

MD5
dacddea6f5a7064726a435b24bd9dff5

SHA1
bbc4c4183d624ad0094e88c97a667c08170265eb

SHA256
dbc2126aa227cad6a017675d98aeb222b23ca0c54f8d0c726928a971946f1364

SHA512
ad5ef13a6f04d5ee828264128914a284fbf8b4209fd9938b30ca53840f80c5829ba2dd5c7023a23757b4294a4cbad57f42577ff549de0c3a6d00dfa6221bc6c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Filesize
508B

MD5
dacddea6f5a7064726a435b24bd9dff5

SHA1
bbc4c4183d624ad0094e88c97a667c08170265eb

SHA256
dbc2126aa227cad6a017675d98aeb222b23ca0c54f8d0c726928a971946f1364

SHA512
ad5ef13a6f04d5ee828264128914a284fbf8b4209fd9938b30ca53840f80c5829ba2dd5c7023a23757b4294a4cbad57f42577ff549de0c3a6d00dfa6221bc6c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
7dfa22d05658a82c6a7c5c7a88665d0c

SHA1
22a4a60f75164076b2f21f5d7d5cc9b9dad3c45a

SHA256
74ef21e0ac6e204c652470331cbb2a4aa7f4f2a7c750b80aa4faf654fc9ec931

SHA512
ab87075e65e16b97df6346a189563a6cc1ffe443a13f00f715f6c64922d078ac5b8bf215f1605bf903e4940ab8211328a6d4500b4de5974851bac0069ce49be3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B80997DC778A262FB76CE2E1F8A6F9F
Filesize
552B

MD5
7b514f09c6e8ffe547b589998f2a49e7

SHA1
0359090332ff26558b68217f5ff9da4161cadfa4

SHA256
ed89ee9420731289300462052389b1ab516a0f33fd11bf8c72ff7b4b67bf6c70

SHA512
dd5c794373dab9abfc0e23cf71aa935ba845aa963e1a5f9996faa8d65bda3739629835b6f8a05ad65a157c8efb1a9cbfb6d932cc8d43f2f1886799f8c01250d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\20B08EBC7FEA7A579D61CF34D4900D4F
Filesize
548B

MD5
0e758a098a6fb38d9648818d1ef5f2b4

SHA1
b7da66028daa13d2d03de9e941e3b9146599326d

SHA256
218a2d1b386ef3cd5b46eeeaf1b8f9470ff086b49dc14ef47ac2c52cf48d7f85

SHA512
89a78083154bd15bb92227009c38e8996fd2941ee1d33aaeb3e6a64442637e90eb0ab909c490bf4e4acde1733333ec7ea424aab2cdb072daeb61fe506ac3485f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_97A2CB43E01F27293633B7B57353C80B
Filesize
532B

MD5
00be360f394ce5ffa223cb88a8425fa5

SHA1
0c1222cb6938152fc55ae180981dd1501926a27d

SHA256
beae455c8cdf614b35f54bed4b13f770cbc0aaae9070a9bdae7ac449fd434834

SHA512
c3a4ae8e8ab6ccef4f1e5efb2a7b8a889837872713a1b26a4d48800ec82557ece4aeddee18728e5fc5f21d122b90c4f2c281b169ccac4420dc2a9712b30a5b9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C41BDF449DB6018BBDE16213249B7F5
Filesize
552B

MD5
3a0b51db854301678c4e2a18166d752f

SHA1
1705526e1b9382ec1b2cb2d3db20fd211a03e475

SHA256
fe44bdc434c83982555a239d6fe92315a0ee7e2215e736f4152aed26be349c1a

SHA512
ae40cdd39178501f27e39d128f853e70063561b66c1b58ff30c2f9e31731e4cefa762a3b2708c4687f49824c1ab8e10449fb425e4048e81922a17c10d896e8eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2
Filesize
432B

MD5
f304db2ba30cb1538ffdbc8406e70c65

SHA1
5b8682c6a8e43d8878c60383c90d4a8e6d49d3ff

SHA256
6f012124ea781b0e4957f2e12cb8d118baef2a2ec245630ff97eb052e668044a

SHA512
1b2030090d85b1edd52282fe99f2aa0d5cf0a12af393bffb74a1081dcd25dd2ffb9b28ac40ca151c1b8f390649dd99f50d97e5c9fe9607f6713ca21cbaff6ede

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_25EBFEC9C14E42B04A7785CD49B3BAA4
Filesize
436B

MD5
67d74bc943f4eaeff611c206fd685694

SHA1
416ea0dd404877fc7c843e368d361d6b62d5c586

SHA256
4deec360eb20491615f8068df226df921ae256f4538f3948ec8900e6213d2f9b

SHA512
67f1952e80bac9ef10431981922e81aae9e07726d17772dad22aac33c0c747bf91e6fc6fa579eafe0d28b2d89e8bef8263c15e641a8c89f04567918d25d4ffd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
49572f6c9fd1b9586c35ff108af51c66

SHA1
eed1e67da2c8c41084dc1c3d713757d975666dc4

SHA256
5892864ed8c93d2b058e180b669582ac496550a23f4e2cefcd82186c1eb79f43

SHA512
7eb872d9a205ef1f06c3400c0865e3003f7a8b36df482e831f9534c2d33c1dd1c800c4634f994b612a5a5321fb4e5392c4e4d69e917770e788a6c9aa79db05bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
49572f6c9fd1b9586c35ff108af51c66

SHA1
eed1e67da2c8c41084dc1c3d713757d975666dc4

SHA256
5892864ed8c93d2b058e180b669582ac496550a23f4e2cefcd82186c1eb79f43

SHA512
7eb872d9a205ef1f06c3400c0865e3003f7a8b36df482e831f9534c2d33c1dd1c800c4634f994b612a5a5321fb4e5392c4e4d69e917770e788a6c9aa79db05bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
429f100cf536e03fba2acab8b4d045cd

SHA1
04295c519499882abd67cbb1e34fa6d12a62e3d6

SHA256
6181b8e5fbac04b8df3d836cb5db46dec35ab30c18941f01fb51bc7c94d79348

SHA512
7dcd42ef3d71465fcc1d8f492b1d71e9922d2b5507132de10311fec01baf8d258c94c6c8e1d7091c1249acdfbbc753d3df81dc901909f834aadb00450ce2e185

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
0c00c515da9ad3a4287d322c2a815f26

SHA1
eb61ecc411ac1e54d1de496fa6668a0152c186cc

SHA256
c6d8d97f41e364137ad9d40234a84125834cba3e87889e6550df7328f9361fbd

SHA512
d5d6721cee03acd5603e6d3f4b3bf108ddf25a1d61e9a6e10879e7a1f4db50dbbec4b6dce044e2d1a671584129b94426711bd600bf28525a66086b40eaea5f6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
8c1692d754d1f8632c4fc6176b3d7714

SHA1
c6aef81bdea34563e2e10ae3399100a3ef8f90e2

SHA256
20f5f7ac9817ab131c4c830bc4dad4f8623e548a4168d7e72f23a4948cb5f3ba

SHA512
a375d812fe3508df62781de2af92d9a90f37cfa19bce9a415c66d445bc21a4e6c31e855ec70da083d8c25a816dbcc6839d1bfc168001d9b4a504c2e7681e93b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
3d2a9c512d357b6f23b7e94862bfcd1c

SHA1
69e13eed8a19062f64591e5b07901dcaa76d403d

SHA256
0fbf531a0e356114ddcfdc67d0b3bdc3663081dcc67cb930c0094415d185395c

SHA512
3821d3cffedd34eb9233c6305e7d091dafe1a7f631d537bf09a3ab80ff1105723a8c26275210481e168d4cdb8ba1c794fe1bc4742b6026b2c621bfe5f42cdcae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
f7641572cd44a9fee0ebe8175964c17f

SHA1
cddd8c71d12b85cc42570a7158f6717683e7f1c0

SHA256
cafe09d22b60cc64bad2b7114e06382c080e412c1ffb75ad99db3e0e03aa30fb

SHA512
6fddd3327a3621dc447adc797735e68cb59f72258594d43051fe66a44e94beda7169f73cd6b6e732ad95cc55fb620d9a81768669665baf2b90ea98668d0c32e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C
Filesize
492B

MD5
c6c75808ca304fb556114e03c8357805

SHA1
afd55f088ccfebba26f0a5b23460b2a6b25aed05

SHA256
89359204dda284504f61f4ee8ce81220a3339463569a688a397823c90a83455b

SHA512
71aae6e42af45b27c95df8b10bd380cab1eab89da8f152bfe11f2954a9918337806edffcd4d208280bb7ed078b681fefda1cfdc7d6d8d50e641a4d9ebc5dc23f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
Filesize
506B

MD5
538e7a691482117ae01d3c34735031d6

SHA1
660f28220ae8919ba19cead093fea742a6ba7e10

SHA256
ad2bc7350a628d04bcef017e9d5eb0fa40060e63195f1fce0d8135363af364ef

SHA512
26b2d61043146d880e8d2a8f53990efd4c89b93e82929a090422b573608f03049e227fb9c4d62bbb0af69ad161fe064cd000c21d6fb7a7081432b32326f1052e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
Filesize
506B

MD5
538e7a691482117ae01d3c34735031d6

SHA1
660f28220ae8919ba19cead093fea742a6ba7e10

SHA256
ad2bc7350a628d04bcef017e9d5eb0fa40060e63195f1fce0d8135363af364ef

SHA512
26b2d61043146d880e8d2a8f53990efd4c89b93e82929a090422b573608f03049e227fb9c4d62bbb0af69ad161fe064cd000c21d6fb7a7081432b32326f1052e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
Filesize
506B

MD5
538e7a691482117ae01d3c34735031d6

SHA1
660f28220ae8919ba19cead093fea742a6ba7e10

SHA256
ad2bc7350a628d04bcef017e9d5eb0fa40060e63195f1fce0d8135363af364ef

SHA512
26b2d61043146d880e8d2a8f53990efd4c89b93e82929a090422b573608f03049e227fb9c4d62bbb0af69ad161fe064cd000c21d6fb7a7081432b32326f1052e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8408FE5CA4467EE4DA84A76EF238FE3
Filesize
192B

MD5
9882e1efa80c976c71f7c0bb745b56eb

SHA1
432d72947db8393812dd9bd58e9b67f48ac8ab38

SHA256
aa75cd317fe49a0013de777ab8439c93ef2c7cb9b4f27e07183e577413c2c631

SHA512
d480b48f04b8fbac1935c566b224c892c1e1914a774ed7cd7754e2b6da51609abeaadc8c597d9cd80263262250eb05c0d095583ba75516a9b87eadae6ea3276c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1
Filesize
242B

MD5
6cbb4a1b8ed28e2c61684acd003fa8c2

SHA1
57add5f2e4354b1e174b991a3c6d783c50644878

SHA256
562d40bfb2f678aa34469d2bc1c6e6cd02380a5d5c57a1a97a5c3056bc7e4b82

SHA512
58d6a955eaf513eac5d9e5daf4a64be5db65bc521de02a7ba294e96e453f5e9dbb79627ebd75792e4bbdaeb60c1a6152e8ee8dfc4b641d0240cb68d420bc6628

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1
Filesize
242B

MD5
e11f0bd007842cc6a40cc3c8fd46ab1d

SHA1
aa5073c2d7252d725da90d900769389b3a66abaf

SHA256
0151b84839ec8f440d48e69593eec0b75cc47d81bcc006f502a819f7d85b3e80

SHA512
1fe0f0e30b177a73d19b68eb24097684a1090f886edd2339a3d08c02ba192bda811bb6ad507c58c075bd1fafc7b2dcdb05faca0a77b6156e9a294df774a3f58c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\0SNJ2AO9\www.75yoyo[1].xml
Filesize
382B

MD5
fe5137855da57e2d8ad6bb3f0f8c8ade

SHA1
6a396169e50ec81047fbd2a25ce94026a4ce370f

SHA256
d1f50aa8cbf69da8c42d1cb3c32bb245a7aa6c804c648270d24a4b0df6c0dba5

SHA512
cca608ed0591e60bdf19f322db72eaf5de499369c3a506c38a648c32f6c42623932dadc8c6d2e08da67e0e6c3bec4f9a45f2155a70106d02d58a08c3f43d60c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\0SNJ2AO9\www.75yoyo[1].xml
Filesize
505B

MD5
54b45e48dac2d614c2769dd588f432f9

SHA1
98b1796a2cfd7f63b96f6ab896094a8f320e363f

SHA256
d581a4154e99c6c295b9e2379be09df7a8def83a313583b1bd5bdda70aa8ccc0

SHA512
1fbcd318a27e5b5090f4d2f7c5940a1ce05d5ab5b1a45172f73f12511098fa4c845401e75b7e85a32d5c5a159d4a4ce7552305252ec34145f59d28b82e127ed8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\0SNJ2AO9\www.75yoyo[1].xml
Filesize
527B

MD5
94a1ba18d1cfa1f816114a5868ba4248

SHA1
46c66c0f76248afab8478a856b39ff98b6398132

SHA256
15d38604287d0d4266ac634a486cac003b46ebdd83aecd86a04e7164a7970514

SHA512
275e39c17063aa753f5b311cf3f721e39070f32d31e407dde63aafd9b236a3245b5ad7e17de68a3c3f63166943c1c95a108cc25e9e80e7883f4204e0bd209722

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\0SNJ2AO9\www.75yoyo[1].xml
Filesize
527B

MD5
94a1ba18d1cfa1f816114a5868ba4248

SHA1
46c66c0f76248afab8478a856b39ff98b6398132

SHA256
15d38604287d0d4266ac634a486cac003b46ebdd83aecd86a04e7164a7970514

SHA512
275e39c17063aa753f5b311cf3f721e39070f32d31e407dde63aafd9b236a3245b5ad7e17de68a3c3f63166943c1c95a108cc25e9e80e7883f4204e0bd209722

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\0SNJ2AO9\www.75yoyo[1].xml
Filesize
672B

MD5
fe28187869cea5dc3d39d58ed422f319

SHA1
078c482d9b583e0b5e59ef570c7d8648a4831ada

SHA256
a99981695030d235234dc1db476c7953e397e43ecc247899587cabd870b22e7c

SHA512
25892f43b1a1e648562e3b9625340a1bb1fb4a9e40f1702f3ffb612917609782746de8fc52d153d3217b8abf38f139f1b1e32bb7adab4204e5ecbd91ffcf9640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6OB1Q09Y\loading[1].svg
Filesize
503B

MD5
178e7b58ae935551b8819e74bc9cd9ba

SHA1
31c53f0632733924ac39da2c62e9f499c0624354

SHA256
5824f3b35ec70256260ed3e5593ef13f4be295465dc942da9bf76cb89efc2db3

SHA512
e4eb63993b426a374fcaf6d653da6dd846442df0463ffb46ccb7795fb4063756b131a2890c33fb5c8ea5caeed8c77ad7d26d6977b0edc76de74053d95ea72a52

Download Submit
C:\Users\Admin\AppData\Local\Temp\CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Filesize
2.0MB

MD5
374ed76da0246da8ff3f8cf611066b27

SHA1
36437344d1ad7bf863517c57fb704877171ed450

SHA256
47ae3aa334c6f294879fe0033da6417b3e5df4e11241d17bef230e1ced421fb5

SHA512
561b20748d1a9f4829d4735672401e365f512da58b243282ce2cc3ae6d7bf14f782c49090eda0f7fea97c80111724999082e60aa978fa60959ee3ec4d20b2172

Download Submit
C:\Users\Admin\AppData\Local\Temp\CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Filesize
2.0MB

MD5
374ed76da0246da8ff3f8cf611066b27

SHA1
36437344d1ad7bf863517c57fb704877171ed450

SHA256
47ae3aa334c6f294879fe0033da6417b3e5df4e11241d17bef230e1ced421fb5

SHA512
561b20748d1a9f4829d4735672401e365f512da58b243282ce2cc3ae6d7bf14f782c49090eda0f7fea97c80111724999082e60aa978fa60959ee3ec4d20b2172

Download Submit
C:\Users\Admin\AppData\Local\Temp\gamedmon.exe
Filesize
172KB

MD5
ceef802c5f0704313fa75ab44dfd2fdb

SHA1
e904aceee1b077a6d98cf80d0419c5b71ebd0a79

SHA256
21b6174a585d9388faa9561213982d08e88473e11b21a07deba2e70023e3e3c9

SHA512
029d2436d3f6bfb567b75799f48d423a09803094ff4a96c1e47b5ac2902c3d4abf552b6a666fdfe86c59f727546e93dd17361d6abe8b94c999a616cb0eb16743

Download Submit
C:\Users\Admin\AppData\Local\Temp\tj1.exe
Filesize
189KB

MD5
9381e74be11b04acfa7cac3ca62a359b

SHA1
7e1203c1b50022dcfe3ad4746ad210fe0c4a8915

SHA256
e94f229e151bd11070c564966cf04d692699071cf8b82d041fafaf0c4d7e1a2a

SHA512
be555c3389d20207af3edd01a67fe588dd7984879acf65adc3166a2ab09a1094e40c3c003a25de06e681e8b48197f734c4b7b8e54297f0d2a883ebfeef91dea3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tj1.exe
Filesize
189KB

MD5
9381e74be11b04acfa7cac3ca62a359b

SHA1
7e1203c1b50022dcfe3ad4746ad210fe0c4a8915

SHA256
e94f229e151bd11070c564966cf04d692699071cf8b82d041fafaf0c4d7e1a2a

SHA512
be555c3389d20207af3edd01a67fe588dd7984879acf65adc3166a2ab09a1094e40c3c003a25de06e681e8b48197f734c4b7b8e54297f0d2a883ebfeef91dea3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0B1EPAK1.txt
Filesize
93B

MD5
0275391f5f865247a5075d425438f1a8

SHA1
43ebaa398def5582d424fe10a1efd1538d0dae18

SHA256
17de5521abfa002036adfde1b7ce8b4105cfb5af1f4a39b063b216978dd61dd8

SHA512
e0474a815a6720069cb96c3d52c10c0dd81e37178a4ff1a343885ed74dbb98d4ee35678f3f43049df36845be1da543f12c1beed8c9180e0d0613f8817fab7125

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\1SLQJNIE.txt
Filesize
93B

MD5
79869189d877813e484776a5bdaf5f9a

SHA1
b248145130281ec5fd7dd804f26198453d945724

SHA256
cec882b17b62e6014cde706e4d31f8a85f76aa5f1f1276aa9528c0867ddc5241

SHA512
e933d6d0e833b8bb6c1f6ad2ae8a227ca490324da23d9fe23d29375a8556d8c6a59fb896437cc9950c7bb66390282e64c82ddffdc40d33601f6b13f8feab0e03

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\30AP2MEY.txt
Filesize
93B

MD5
e6bb08c80b0a5f42adea2b75dedf9ecf

SHA1
91d2a188501d80e1dbe8fc42b6be7b45d35897d6

SHA256
61f1aab22ab3d70fd5c4aa2482e1d08c504785d3a7a6c2b22656752ab04e8e89

SHA512
401bb9b0882584db0b7b97813e4025758515f93805693fb2ded8649925e9c9cec5554efbf61881bbd6f3c04d397ae3f1a7b9b61cbcd784a8387568a23463583a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\71ABKVFK.txt
Filesize
93B

MD5
68c88b92165404898186d4b473a770e5

SHA1
aab63b0cdb2be7e3f66afbe8750afbc5eb6492ed

SHA256
7784119a58bc9f9b277838ffa6a2c49ace4f70bf5ff26884c5e546df7fcad607

SHA512
997d968e705d4c456550ebd1675e4617673d744c4a402266918b645ad76383fdfc9346b1d58d9b52557f9af557788fc4f2c31ea574c13320b8cfb7dc16f96e2e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\IR5PYCVH.txt
Filesize
587B

MD5
4835e56de4879cdeb9b2fa259a467ae8

SHA1
bdb1041fbb95af37eccb5a5d1c780910058db97c

SHA256
166dbf3e43430f384098f4c9eaa8a36ac8a3b22347b2da2b1338c5125a82a491

SHA512
6b49f013a461d9aa8657c76071614b709f1f731043e83157cc4fc2bc4102f090ec6da1fd01c210f783db39fcfb770fd30f4bd2f67485dd2611d8206cceb21e40

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\OM6USVHU.txt
Filesize
93B

MD5
d8091f2b3b2fac1033cf9cd7e98f0294

SHA1
27f72408267f83bf85f9efe4bbc515b6617eb6b2

SHA256
417ba33c22f9eeb825b73606a11f70cdbc04d389d9b5fedd38098985c57b9693

SHA512
8937f2c2669d624efb7354d94c4243048e6b86201223df250846f0e8ef45a5e85e938de873e882144d89aeb995496cf14a8806ba00320cd8eb9af2c23620e5cd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\TRT9D0ZN.txt
Filesize
474B

MD5
27bdb298ae07311ad4543a86efdc8fd6

SHA1
d33906283c8a2ec40e39ebe3ea54903b86c6d627

SHA256
84950a69d6c8dc85fb7596ae16cb38b86b3377dc3ce8aabd13d603f5b7184f46

SHA512
a5c57b4f82cb3690478d0ec09fbc7df8d88221c36084b3837203b48dea8ed4ee53d7dfb8334de2d483233b649aebaf45c3e46aa7b3dbb9d6010beb476c681fab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\VO7COQNT.txt
Filesize
463B

MD5
76ab3c88664c5b870493c332f7d7bdf5

SHA1
168866763230e4c1c5af8de31db28327770c0e00

SHA256
dd7cb42e762c9b0a67ab795fb93adf2e9281965c8dbb788d897d08fe98bad390

SHA512
ba8e22e2cae009e4a804e3f759aab1e46d2912634f6f12b872fc41a6333b0082cffb416f5ae0cff975c89c99e028e71395a9701e65a1cd41646525f7c18c5b03

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WTRERJTM.txt
Filesize
339B

MD5
6b22b5ace71d64032027350ce7e664df

SHA1
0ee389176070841366734277c775b9e0ecd4e8e0

SHA256
1c86cad02cff35fa922c22368a6b4253bc48543c008e8670df58776df8d8a631

SHA512
05c1ea00d0e1e8e263c4e81bb282a43f655a1a127bd9c8196098e921fbc6cc92a258ab5f2d79748237d53b38aed9caf394d8d0ad41820e5474ff1f8f618e6fe9

Download Submit
\Program Files (x86)\Æô¶¯\Uninstall.exe
Filesize
198KB

MD5
255397a0bde4c291da77d608653d111c

SHA1
8eac18bda6daabe84d67eca026fed8f8aaaf095b

SHA256
e266d81cb01770d95932f7c6f987f9eab03bf8d73cd5aa5899888a4f3e7067c1

SHA512
8df5774b58fdd5d1f6383dfb66468313c3ca5586464094b0f0b01afc052c27bb7e4e8b5bfe0defa5f6d55eb576179f20bb87e76378aed2b506a1e032e7c94016

Download Submit
\Users\Admin\AppData\Local\Temp\CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Filesize
2.0MB

MD5
374ed76da0246da8ff3f8cf611066b27

SHA1
36437344d1ad7bf863517c57fb704877171ed450

SHA256
47ae3aa334c6f294879fe0033da6417b3e5df4e11241d17bef230e1ced421fb5

SHA512
561b20748d1a9f4829d4735672401e365f512da58b243282ce2cc3ae6d7bf14f782c49090eda0f7fea97c80111724999082e60aa978fa60959ee3ec4d20b2172

Download Submit
\Users\Admin\AppData\Local\Temp\CFÓ´Ó´Ê®±¶¼ÓËÙ.×Ô¶¯¿ªÇ¹0820sp1.exe
Filesize
2.0MB

MD5
374ed76da0246da8ff3f8cf611066b27

SHA1
36437344d1ad7bf863517c57fb704877171ed450

SHA256
47ae3aa334c6f294879fe0033da6417b3e5df4e11241d17bef230e1ced421fb5

SHA512
561b20748d1a9f4829d4735672401e365f512da58b243282ce2cc3ae6d7bf14f782c49090eda0f7fea97c80111724999082e60aa978fa60959ee3ec4d20b2172

Download Submit
\Users\Admin\AppData\Local\Temp\gamedmon.exe
Filesize
172KB

MD5
ceef802c5f0704313fa75ab44dfd2fdb

SHA1
e904aceee1b077a6d98cf80d0419c5b71ebd0a79

SHA256
21b6174a585d9388faa9561213982d08e88473e11b21a07deba2e70023e3e3c9

SHA512
029d2436d3f6bfb567b75799f48d423a09803094ff4a96c1e47b5ac2902c3d4abf552b6a666fdfe86c59f727546e93dd17361d6abe8b94c999a616cb0eb16743

Download Submit
\Users\Admin\AppData\Local\Temp\tj1.exe
Filesize
189KB

MD5
9381e74be11b04acfa7cac3ca62a359b

SHA1
7e1203c1b50022dcfe3ad4746ad210fe0c4a8915

SHA256
e94f229e151bd11070c564966cf04d692699071cf8b82d041fafaf0c4d7e1a2a

SHA512
be555c3389d20207af3edd01a67fe588dd7984879acf65adc3166a2ab09a1094e40c3c003a25de06e681e8b48197f734c4b7b8e54297f0d2a883ebfeef91dea3

Download Submit
memory/360-77-0x0000000000000000-mapping.dmp

Download
memory/520-81-0x0000000000400000-0x0000000000906000-memory.dmp

Filesize
5.0MB

Download
memory/520-71-0x0000000000400000-0x0000000000906000-memory.dmp

Filesize
5.0MB

Download
memory/520-79-0x00000000002F0000-0x0000000000302000-memory.dmp

Filesize
72KB

Download
memory/520-64-0x0000000000000000-mapping.dmp

Download
memory/688-58-0x0000000000000000-mapping.dmp

Download
memory/688-78-0x00000000008D0000-0x0000000000953000-memory.dmp

Filesize
524KB

Download
memory/688-60-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download
memory/688-69-0x00000000008D0000-0x0000000000953000-memory.dmp

Filesize
524KB

Download
memory/1408-74-0x0000000000000000-mapping.dmp

Download
memory/1456-54-0x0000000000000000-mapping.dmp

Download
memory/1456-80-0x0000000001F70000-0x0000000002476000-memory.dmp

Filesize
5.0MB

Download
memory/1456-70-0x0000000001F70000-0x0000000002476000-memory.dmp

Filesize
5.0MB

Download
memory/1772-68-0x0000000000880000-0x0000000000903000-memory.dmp

Filesize
524KB

Download
memory/1772-55-0x0000000000000000-mapping.dmp

Download