Analysis
-
max time kernel
47s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
04-12-2022 03:13
Static task
static1
Behavioral task
behavioral1
Sample
1fd44f53bae4369a177295b93322f331112e67f7357e07ceef475a52f34918a0.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1fd44f53bae4369a177295b93322f331112e67f7357e07ceef475a52f34918a0.dll
Resource
win10v2004-20221111-en
General
-
Target
1fd44f53bae4369a177295b93322f331112e67f7357e07ceef475a52f34918a0.dll
-
Size
7.4MB
-
MD5
ad0541f1a98fec199c33580c11bebb50
-
SHA1
74114e04912f606b98aca27e5a57f46236f61bd2
-
SHA256
1fd44f53bae4369a177295b93322f331112e67f7357e07ceef475a52f34918a0
-
SHA512
aee734d5487c071e8b64c59f4f6e5fd819c20112682888ebc0671eefe325aa0c254a433b822b0ca558c662f1d9fb4d212616c3922eca50329a35caae347e5343
-
SSDEEP
98304:Y2F/rBjd+nbf5ewT0f+2Ck7XbJUjC3AMDb7Kz/Ec0gD6aZaQhB104uwoPWvY:xbmbhewo22RXbajYHHuL0gjBhBIWvY
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
Processes:
rundll32.exeflow pid process 3 1672 rundll32.exe 5 1672 rundll32.exe 7 1672 rundll32.exe 10 1672 rundll32.exe -
Executes dropped EXE 5 IoCs
Processes:
KB931125.exeupdroots.exeupdroots.exeupdroots.exeupdroots.exepid process 1272 KB931125.exe 1808 updroots.exe 984 updroots.exe 1940 updroots.exe 1772 updroots.exe -
Modifies Installed Components in the registry 2 TTPs 6 IoCs
Processes:
KB931125.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Locale = "*" KB931125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ComponentID = "Windows Roots Update" KB931125.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A} KB931125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ = "RootsUpdate" KB931125.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\IsInstalled = "1" KB931125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Version = "28,0,2195,0" KB931125.exe -
Loads dropped DLL 17 IoCs
Processes:
rundll32.exeKB931125.exeupdroots.exeupdroots.exeupdroots.exeupdroots.exepid process 1672 rundll32.exe 1672 rundll32.exe 1672 rundll32.exe 1272 KB931125.exe 1272 KB931125.exe 1272 KB931125.exe 1272 KB931125.exe 1808 updroots.exe 1272 KB931125.exe 1272 KB931125.exe 984 updroots.exe 1272 KB931125.exe 1272 KB931125.exe 1940 updroots.exe 1272 KB931125.exe 1272 KB931125.exe 1772 updroots.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rundll32.exedescription ioc process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Drops file in Program Files directory 2 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Program Files (x86)\XiaoWeiPrivacy\{48970C86-4FEF-4679-B5EB-56B33540507B}.tf rundll32.exe File opened for modification C:\Program Files (x86)\XiaoWeiPrivacy\setup.log rundll32.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exeKB931125.exedescription ioc process File opened for modification C:\Windows\ rundll32.exe File opened for modification C:\Windows\INF\setupapi.app.log KB931125.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
rundll32.exeupdroots.exeupdroots.exeupdroots.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A3E31E20B2E46A328520472D0CDE9523E7260C6D updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F17F6FB631DC99E3A3C87FFE1CF1811088D96033\Blob = 0b00000001000000640000005400dc0052004b0054005200550053005400200045006c0065006b00740072006f006e0069006b00200053006500720074006900660069006b0061002000480069007a006d00650074002000530061001f016c0061007900310163003101730031010000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000f17f6fb631dc99e3a3c87ffe1cf1811088d960332000000001000000410400003082043d30820325a003020102020101300d06092a864886f70d01010505003081bf313f303d06035504030c3654c39c524b545255535420456c656b74726f6e696b20536572746966696b612048697a6d6574205361c49f6c6179c4b163c4b173c4b1310b3009060355040613025452310f300d06035504070c06416e6b617261315e305c060355040a0c5554c39c524b54525553542042696c676920c4b06c657469c59f696d2076652042696c69c59f696d2047c3bc76656e6c69c49f692048697a6d65746c65726920412ec59e2e20286329204172616cc4b16b2032303037301e170d3037313232353138333731395a170d3137313232323138333731395a3081bf313f303d06035504030c3654c39c524b545255535420456c656b74726f6e696b20536572746966696b612048697a6d6574205361c49f6c6179c4b163c4b173c4b1310b3009060355040613025452310f300d06035504070c06416e6b617261315e305c060355040a0c5554c39c524b54525553542042696c676920c4b06c657469c59f696d2076652042696c69c59f696d2047c3bc76656e6c69c49f692048697a6d65746c65726920412ec59e2e20286329204172616cc4b16b203230303730820122300d06092a864886f70d01010105000382010f003082010a0282010100abb73e0a8cc8a55815e68aef273d4ab4e825d3cd33c220dc19ee883f4d62f0dd13778f61a92ab5d4f2b93158293b2f3f6a9c6f737625ee342080eeeab7f0c40acd2b8694c9e360b14452b25a29b4919783d8b7a6142f2949a2f30506fbb44fdaa16c9a669ff04309caea728feb00d73539d75617471730f4bebf3fc268af3640c1a9f4a9a7e8106b088af7861edc9a2a1506f6a3f0f4e0c714d4517fcfb4db6daf4796179b7771d8a7719d240cf6943f8531124fbaee4e82b8b93e8f23375ecca2aa75f7186f09d3aea7542834fbe1e03b607da0be798986c89f2df90a4bc450a2e7fd7916c77a0b18cfce4cef7dd6076f98f1afb1c17ad78135b8aa17b4e0cb0203010001a3423040301d0603551d0e0416041429c590ab25af11e461bfa3ff886191e60efe9c81300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100100ddaf83aec28d1149582b1122c517a4125364c9fec3f1f849d65545ca8160240fa6e1a3784ef729d860a559d5628ac662cd03a5693340725ad08b08fc80f0959ca9d981ce554f8b9457f6a976f88684d4a06263788020eb6c6d67299ce6b77da6231a4561fae5f8d77da5df688fc1ad99eb581f032b8e388d09cf36aa0b99b145935364fcff38e5e5d17ad1595d8ddb2d5156e004eb34bcf6694e4e0cdb505da63578be5b3aadbc02e1c9044db1a5d18a4eebe045b99d5715f55656462d5a29b045986c86277e77c82456a3d17bfec9d750caea36f5ad32f9836f4f0f519ab115dc8a6e32a586a4209c3bd922666320d5d085574ff8c98d00aa6846ad1397d updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5F3AFC0A8B64F686673474DF7EA9A2FEF9FA7A51\Blob = 0300000001000000140000005f3afc0a8b64f686673474df7ea9a2fef9fa7a5109000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090b00000001000000260000005300770069007300730063006f006d00200052006f006f0074002000430041002000310000002000000001000000dd050000308205d9308203c1a00302010202105c0b855c0be75941df57cc3f7f9da836300d06092a864886f70d01010505003064310b30090603550406130263683111300f060355040a13085377697373636f6d31253023060355040b131c4469676974616c204365727469666963617465205365727669636573311b3019060355040313125377697373636f6d20526f6f742043412031301e170d3035303831383132303632305a170d3235303831383232303632305a3064310b30090603550406130263683111300f060355040a13085377697373636f6d31253023060355040b131c4469676974616c204365727469666963617465205365727669636573311b3019060355040313125377697373636f6d20526f6f74204341203130820222300d06092a864886f70d01010105000382020f003082020a0282020100d0b9b0a80cd9bb3f21f81bd533938016652075b23d9b606d46c88c316f17c3fa9a6c56ed3cc59157c3cdab9649902a194b1ea36d57ddf12b622875455eaad65bfa0b25d8a116f91cc42ee6952a67ccd0296e3c8534386149b1009fd63a715f4d6dce5fb9a9e4897f6a52faca9bf2dca9f99d99473f4e295fb4a68d5d7b0b99110303fee7dbdba3ff1da5cd901e011f35b07f00db906fc67e7bd1ee7a7aa7aa0c576fa46dc5133bb0a5d9ed321cb45e678b54dc7387e5d3177c6650725dd41a58c1d9cfd889026fa749b4365dd0a4de072cb675b72891d697be28f5981eea5b26c9bdb09773daae9126eb68c1f93915d6674b0a6d4fcbcfb0e442718c5379e7eee1db1da06e1d8c1a77355c161e2b531f348bd16cfcf267077af5adedd69aaba1b14be1cc375ffd7fcd4daeb81f9c43f92a58554345bc96cd700efcc9e366ba4e8d3b81cb15647bb994e85d335285712e4f8ea2061151c9e3cba16e3108640cc2d23cf536e8d7d00e78232091c9242a65295b22f721ce835ea4f3de4bd3688f46755c83096e296bc4708cf59dd7202fff46d22b38c22f751c3d7edaa5ef1e60856942d3ccf863fe1e433985a6b6634110b3731ebcd3faca7d1647e2a7d5d0a38a0a089662566e34dbd902b93075e304d2e78fc2b011400aacd57102628b31beddc623583142432d74f9c69ea68a0fe9febf83e6435724baef4634aad7120138ed0203010001a38186308183300e0603551d0f0101ff040403020186301d0603551d2104163014301206076085740153000106076085740153000130120603551d130101ff040830060101ff020107301f0603551d2304183016801403252fde6f82013a5c2cdc2ba169b567d48cd3fd301d0603551d0e0416041403252fde6f82013a5c2cdc2ba169b567d48cd3fd300d06092a864886f70d010105050003820201003510cbeca6040d0d0fcdc0dbaba8f288970cdf932f4d7c4056317aeba40f60cd7af3bec3278e033ea4dd12ef7e1e74063c3f31f21c7b913121b4f0d06c97d4e997b224561e56c335bd88050f5b101a64e1c78230f932ad9e502ce77805d031b15a988a754e905c6a142ae052478260e61eda81b1fb140b5af19fd295ba3ed01bd6151da3be86d5db0fc04964bb2e50194bd224f8dd1e0756d038a0957020768cd7dd1ede9f71c423ef83135ca324154d29403c6ac4a9d8b7a644a50df4e09d771e407026fcdad936e479e4b53fbc9b65bebb1196cfdbc628393a08ce475b535ac599fe5da9ddef4cd4c6a5ad02e68c07121e6f03d16fa0a3f329bd12c750a2b07f88a999779ab1c0a5392e5c7c69e22cb0ea376aa4e15ae1f550e583efa5bb2a88e78cdbfd6d5e9719a87e66756b71eabfb1c76fa0f48ea4ec34515b8c260370a177d50112570035db23de0e8a2899fdb1106f4bff382d604e2c9ceb67b5ad49ee4b1facaffb0d905a6660705daacd78d424eec841a09301929c6a9efcb924c5b315827ebeae952bebb1c0dae301600b5e69ac845661be7117fe1d130ffec68745e9fe32a01a0d13a4945571a5168bbaca89b0b2c7fc8fd854b593629dcecf59fb3d18ce2acb3515825dff54225b7152fbb7c9fe609b004164f0aa2aecb64243ce896681c88b9f39540325d316358e84d05ffa301af59a6cf40e53f93a5bd11c updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\016897E1A0B8F2C3B134665C20A727B7A158E28F updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D6DAA8208D09D2154D24B52FCB346EB258B28A58 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97E2E99636A547554F838FBA38B82E74F89A830A updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\89DF74FE5CF40F4A80F9E3377D54DA91E101318E updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\16D86635AF1341CD34799445EB603E273702965D updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\786A74AC76AB147F9C6A3050BA9EA87EFE9ACE3C updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F44095C238AC73FC4F77BF8F98DF70F8F091BC52 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\81968B3AEF1CDC70F5FA3269C292A3635BD123D3 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b0000000100000014000000550053004500520054007200750073007400000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c02000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\EC93DE083C93D933A986B3D5CDE25ACB2FEECF8E updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F9CD0E2CDA7624C18FBDF0F0ABB645B8F7FED57A updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6E3A55A4190C195C93843CC0DB722E313061F0B1\Blob = 0b000000010000004c0000004300680061006d006200650072007300690067006e0020004300680061006d00620065007200730020006f006600200043006f006d006d006500720063006500200052006f006f0074000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080300000001000000140000006e3a55a4190c195c93843cc0db722e313061f0b12000000001000000c1040000308204bd308203a5a003020102020100300d06092a864886f70d0101050500307f310b300906035504061302455531273025060355040a131e41432043616d65726669726d61205341204349462041383237343332383731233021060355040b131a687474703a2f2f7777772e6368616d6265727369676e2e6f726731223020060355040313194368616d62657273206f6620436f6d6d6572636520526f6f74301e170d3033303933303136313334335a170d3337303933303136313334345a307f310b300906035504061302455531273025060355040a131e41432043616d65726669726d61205341204349462041383237343332383731233021060355040b131a687474703a2f2f7777772e6368616d6265727369676e2e6f726731223020060355040313194368616d62657273206f6620436f6d6d6572636520526f6f7430820120300d06092a864886f70d01010105000382010d00308201080282010100b73655e5a55d1830e0da895491fcc8c752f82f50d9efb1757365477d1b5bba75c5fca18824fa2fedca084a3954c4517ab5da60ea383c81b2cbf1bbd991233f48017075a9052aad1f71f3c9543d1d066a403eb30c85ee5c1b79c262c4b8368e355d010c23044735aa9b604ea0663dcb260a9c40a1f45d98bf71aba500682aed837a0fa214b5d422b380b03c0c5a51692d58188fed999ef1aee295e6f647a8d60c0fb05858dbc366379e9b91543337d2941c6a48c9c9f2a5daa50c23f7230e9c32555e719c8405519a2dfde64e2a345adeca4037670c54215577da0a0ccc97ae80dc94364af43ece36131e53e4ac4e3a05ecdbae729c388bd0393b890a3e77fe75020103a38201443082014030120603551d130101ff040830060101ff02010c303c0603551d1f043530333031a02fa02d862b687474703a2f2f63726c2e6368616d6265727369676e2e6f72672f6368616d62657273726f6f742e63726c301d0603551d0e04160414e394f5b14de9dba1295b578b4d760676e1d1a28a300e0603551d0f0101ff040403020106301106096086480186f842010104040302000730270603551d110420301e811c6368616d62657273726f6f74406368616d6265727369676e2e6f726730270603551d120420301e811c6368616d62657273726f6f74406368616d6265727369676e2e6f726730580603551d200451304f304d060b2b0601040181872e0a0301303e303c06082b060105050702011630687474703a2f2f6370732e6368616d6265727369676e2e6f72672f6370732f6368616d62657273726f6f742e68746d6c300d06092a864886f70d010105050003820101000c4197c21a86c0227c9ffb90f31ad103b1ef13f9215f049cdac9a58d276c968791be4190017293e71e7d5ff689c65da740093dac494545dc2e8d3068b209bafbc32fccba0bdf3f777b467d3a12248e968f3c050a6fd294281d6d0cc02e8822d5d8cf1d13c7f048d7d705a7cfc7479e3b3c34c8804fd414bbfc0d50f7fab3ec425fa9dd6dc8f475cf7bc17226b1011c5c2cfd7a4eb401c50557b9e73caa05d988e9074641ceef4181ae58df83a2aecad7771fe7003c9d6f8ee432091d4d783478343c949b26ed4f71c6197abd2022485afe4b7d03b7e758bec6324e741e68dda8685bb33eee627dd980e80a757ab7eeb4659a2190e0aad098bc38b5733c8bf8dc updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F18B538D1BE903B6A6F056435B171589CAF36BF2\Blob = 0b000000010000003800000074006800610077007400650020005000720069006d00610072007900200052006f006f00740020004300410020002d002000470033000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308030000000100000014000000f18b538d1be903b6a6f056435b171589caf36bf220000000010000002e0400003082042a30820312a0030201020210600197b746a7eab4b49ad64b2ff790fb300d06092a864886f70d01010b05003081ae310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303038207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79312430220603550403131b746861777465205072696d61727920526f6f74204341202d204733301e170d3038303430323030303030305a170d3337313230313233353935395a3081ae310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303038207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79312430220603550403131b746861777465205072696d61727920526f6f74204341202d20473330820122300d06092a864886f70d01010105000382010f003082010a0282010100b2bf272cfbdbd85bdd787b1b9e776681cb3ebc7caef3a6279a34a3683171383362e4f3716679b1a965a3a58bd58f602d3f42ccaa6b32c023cb2c41dde4dffc619ce273b222951143185fc4b61f576c0a055822c8364c3a7ca5d1cf86af88a74402137471730a425902f81b146b42df6f5fba6b82a29d5be74abd1e0172db4b74e83b7f7f7d1f04b4269be0b45aac473d55b8d7b026522801314066d8d924bdf62ad8ec21495c9bf67ae97f55357e966b8d939327cb92bbeaac40c09fc2f880cf5df45adcce7486a63e6c0b53cabd92ce190672e60c5c3869c704d6bc6cce5bf6f7689cdc25154888a1e9a9f8989ce0f3d5312861116c67968d3999cbc24524390203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414ad6caa94609cede4fffa3e0a742b6303f7b659bf300d06092a864886f70d01010b050003820101001a40d89565ac099289c639f410e5a90e66535d78defa2491bbe74451dfc616340aef6a4451ea2b078a037ac3eb3f0a2c5216a02b43b925903f70a933256d451a283b27cfaac329421bdf3b4cc033345b4188bf6b2b65af28efb2f5c3aa66ce7b56eeb7c8cb67c1c99c1a18b8c4c34903f1600e50cd46c5f37779f7b615e038dbc72f28a00c3f772674d92512da31da1a1edc294191223c69a7bb02f2b65c270389f406ea9be47282e3a109c1e90019d33ed4706bba71a6aa58aef4bbe96cb6ef87cc9bbbff39e65661d30aa7c45c4c607b0577267abfd807522c62f77063d939bc6f1cc279dc7629afcec52c64045e88366e31d4401a6234363f3501aeac63a0 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\ED8DC8386C4886AEEE079158AAC3BFE658E394B4\Blob = 030000000100000014000000ed8dc8386c4886aeee079158aac3bfe658e394b4090000000100000016000000301406082b0601050507030106082b060105050703020b000000010000002800000054007200750073007400690073002000450056005300200052006f006f007400200043004100000053000000010000002400000030223020060a2b06010401a87501010630123010060a2b0601040182373c0101030200c020000000010000007b030000308203773082025fa00302010202102406625f11b64cccda9e9c6cea040268300d06092a864886f70d01010505003045310b300906035504061302474231183016060355040a130f54727573746973204c696d69746564311c301a060355040b1313547275737469732045565320526f6f74204341301e170d3037303130393132303030315a170d3237303130393131353630305a3045310b300906035504061302474231183016060355040a130f54727573746973204c696d69746564311c301a060355040b1313547275737469732045565320526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d25c94c3cfdc490b7cdf045c0bea79bbe0d0375b8c0ed7cd3918de8c97b8b434106d67adc4b30eed37d4a5bffa43e5da702786479fe2e9b281b9be2d5bb9b128803041dfb894a920a67eaaacca704ca3120ccf606281527a49830bc8222073a09d353c966fedce3d26c24f48caa282a79506a9f62632fef2c1fd23585f713bf8c7d7dd4c331fa0d6c1cf7337ab95fe9d9decec85c3e209bb8957f994562a546289cc04686e648a4fb1857b6cd4a4bd260af527fc133e5d6a330a6739628cfe14fdaa24da4fdeb2b5f27790a191ef29771d719559b6c0e381b8f4ff89ee7aa7fb59fec9d48d6edfd6a99ffc0b35b5dc6ea49979f388306bfa4aa96b38c8614b430203010001a3633061300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414792d7396ceb27d5a730e87562931c528f2eda55f301f0603551d23041830168014792d7396ceb27d5a730e87562931c528f2eda55f300d06092a864886f70d0101050500038201010043c86fdf9bcc09afdc38261d48fbd69673a066df1ae2c0e69dd22f891ce834f2223491f4159f2ebdb472aad7ed3c9fad519f7f1e8566256a42698060375646ba3c56ab6a808098b5ca7a58db0508c7f60781bfa03535c93792bf11f217414f3f41ed13d3af193d718a7eb064c83be7fa931364fe56c3de2bd9eb57cd82d08c9d5252bc6113353f6f9f68f669f76e1acf0b384a43b5400533d2a62b1a360fd38fb1f77b3e1dd2a06dd843aa2b3f690b007e1ae44e6fca6d3191ff7481fcfbe24893765c8b8cc3dca108200b5b6536fc76fb233fd1da97c1d35a90a3bf459bd75b8108a452fc787e182e2d71fddaef0d814689f052f20c5069f7ced5017cb27f28 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A3E31E20B2E46A328520472D0CDE9523E7260C6D\Blob = 0b000000010000002c00000044005300540020002800420061006c00740069006d006f0072006500200045005a0029002000430041000000090000000100000016000000301406082b0601050507030406082b06010505070301030000000100000014000000a3e31e20b2e46a328520472d0cde9523e7260c6d20000000010000000604000030820402308202eaa003020102020437826d48300d06092a864886f70d01010505003075310b300906035504061302555331243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311c301a0603550403131342616c74696d6f726520455a2062792044535431223020060a0992268993f22c640103141263614064696773696774727573742e636f6d301e170d3939303730363230353635335a170d3039303730333139353635335a3075310b300906035504061302555331243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311c301a0603550403131342616c74696d6f726520455a2062792044535431223020060a0992268993f22c640103141263614064696773696774727573742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100bcccb33d4379b847f915b76e26b14c929879edc570f33ae9d5dd03f42a3f608c96e5471602f736b2f19e2688f59e42659e0fae7fe3ccb16e21f5f1882274d61fb277043932ba47b535c0135d0172a30543cc4eda269a87a86163f466a7c31546ead1d1ea30c3bb716a9bc14386c1391fc65660021bfc883aa099bb8cd77861d05e578f913b808b6effc965810a39bb90132035483fa5e1bf2dc171838520ed2087cbb6fe198c04dded295ddf0a12ce8956f21f5a193158b6fd6336eac923dea79197276572996cc77a44c45fbe9b1f1eca9e581ca6aa236ae3061b9224d857220950159046f0835eb6804c12813d666f04553a886bd0ef568750a0b9d6551b9d0203010001a38199308196300f0603551d130101ff040530030101ff305b0603551d2004543052305006096086480186f92f00003043304106082b060105050702011635687474703a2f2f7777772e64696773696774727573742e636f6d2f4453545f54525553545f4350535f763939303730312e68746d6c30110603551d0e040a04084cd762ce894ede2430130603551d23040c300a80084cd762ce894ede24300d06092a864886f70d010105050003820101007c028914385f831be6c6585bf34cc21cf6db27772ddcce1b13502f12478aca9cb3026727c41f32dfe0c25444a02518e32ff4ac2d66e4cc875eab097dd394a9d57d5948abee297c087b0738dd2bb22f1ee0cde79710ffc608065d3f81f436fec60e0dc16b7a509de7375ca059475dac18953f859edc73580400a44ce421b7ee90ba2afc58e309b07017b4aa66a3fa8939f403438322024374b3ddb5c9062996c7b993385fe00b65e27c7c19c35573e8cc0e060808c9a40571512a2c7d03170ecc8ee05da2d0777772b1661b748def08735358bd20dbf91b01a210d192fec3b2a574722ee6ec3dfc5a2fa86986bb6e40e16657842389af3164e78fe17a65a00b86 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CC4307BC60755E7B22DD9F7FEA245936C7CF288\Blob = 0b000000010000003e00000054004300200054007200750073007400430065006e00740065007200200055006e006900760065007200730061006c002000430041002000490049000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080300000001000000140000008cc4307bc60755e7b22dd9f7fea245936c7cf2882000000001000000e3050000308205df308203c7a003020102020e193300010002281a9a04bcf25545300d06092a864886f70d0101050500307a310b3009060355040613024445311c301a060355040a1313544320547275737443656e74657220476d624831243022060355040b131b544320547275737443656e74657220556e6976657273616c204341312730250603550403131e544320547275737443656e74657220556e6976657273616c204341204949301e170d3036303332323135353833345a170d3330313233313232353935395a307a310b3009060355040613024445311c301a060355040a1313544320547275737443656e74657220476d624831243022060355040b131b544320547275737443656e74657220556e6976657273616c204341312730250603550403131e544320547275737443656e74657220556e6976657273616c20434120494930820222300d06092a864886f70d01010105000382020f003082020a02820201008bd4776b346ce536d86a5c5e38eefcd51d79033b7b836244824e88edde83ffeecc5062050595997698f6b9f25fd8069192c2f62d66171ffd5303e8a88d63a96ee1d61b8cbc98b38b3bd4e42eca7d8549265b79b81a8b409e7fbbc93f632ccfd15a7cba282241125a4df91777fc85fdc249e02a187fe9a02c9cf944fc0c683942f52705be8e157a609df03bc73ce63e16bcaf76de6ab7a2e1ab4645eb8c657dd197f3971125ab59eba022d982dd98ed7ee2faa0610a4a32de2c17f76d44ea8147599757370339dd5e8222d433b8fa2609b6bc39882f51154e9bc33bdf138288dd4b34f233d690e9f353dc357cc0c3d97c78b3cd703f8d6ae0a38148e429ad63b8f0fc28643b99b37dfe9a9d88f69922089147168935785d77a1cfbf49e1fd24942b69367be81ce62a908a5bd53b345942dc6dcfbb0f411c55cdf50d5b2e162226ef611e97fce253c8cf5ba3c7a9f1ba0e8612cb13ca15c7ece4368dda5c133d65d20e5d7074dcbf8f7a6ac12e0fd3c65e0f2b596ccc616cfec0614ed9e64f46b25ae219147084f82000ed01a7977ec3bd125c922317a0a51d451715239a9208b522888ddc2b24ebe0b11768d3af61bdd98578f68dba78ca378d63bee7ac1fdfa54709b9c8253154465111550d895c8ddad2182d73f2b8d527f5482237d162f77b0dc8388ba14ab0fcd0f1ebb78663e7e00e737ffd7251b5e97de255056478677f0203010001a3633061301f0603551d23041830168014cdd790a16ea3bfdb30d6da3225900ce6391e8065300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414cdd790a16ea3bfdb30d6da3225900ce6391e8065300d06092a864886f70d010105050003820201007e1688e8130e36cc6e2a850738c656897ae34721664c5008315a51d0fca65e1475de4c3becf1edcc7e11074a61eeeab38e3aa433c6ed8a42664ff13c7bc9a5054199b1ec2c5beedc96d288534b7834b96ee6bb0fc57aa67c0e18df6f0f744cd1a9f1a1e9d85464cc5e9678a2561ac173b215c65705dfdaf748248a8e7f6aa9f94de93e6ace602c7d2d9008f6638f15d02d9c8cfff1fdfc0c16505614fbba9786eeb4490354ee1b597f303a02828621aefef015f2df4e83e699c5ba35f720908c38ed75cfe12ef70430fb51ad8e822440ca7d295dd5d9f76564fcaa9f74b87d925dd28429e013ea8af7d0abc4aeef15c5c289f27bb63b499861f34e7291378c4992e9c8ec2aa0f7496e7c0d24c66b6cf2382fca7005e57fdfc62b2b8080d5da6fcb40bbd81bf024c910c844027e2ed398aaa20df12bd0dafa8e1cff54e8e14a6edda8d678b537a5ac64d51423c70ea5ebe10938d7c07c60a55d988f8c02d5dc56a8f34d58a90bd47c64740132f2df0f4a8aa902a2a21d8477c2f1cc97bd3419745de2743e7527f7afbfee7c0e6d5488a656e226ad31123c1e41796d17ea135e1ff55c9f4959a3b22fa342c3faa87ebfa59f48c96062620adfbd45dee342b55196fdc4f51a99b852a244cd2d618c158f81d55da2d4903d8c6e4061c3595dd8d9e1f674472279747ddacaa36f371536f02c1a713c1176df5d1a3e5463786b657e1f updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C09AB0C8AD7114714ED5E21A5A276ADCD5E7EFCB updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E3D73606996CDFEF61FA04C335E98EA96104264A\Blob = 0b000000010000001a00000044002d0054005200550053005400200047006d00620048000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308030000000100000014000000e3d73606996cdfef61fa04c335e98ea96104264a2000000001000000eb040000308204e7308203cfa00302010202030326da300d06092a864886f70d01010505003052310b300906035504061302444531153013060355040a0c0c442d547275737420476d6248312c302a06035504030c23442d5452555354205175616c696669656420526f6f74204341203120323030373a504e301e170d3037303630383131343734365a170d3132303630383131343734365a3052310b300906035504061302444531153013060355040a0c0c442d547275737420476d6248312c302a06035504030c23442d5452555354205175616c696669656420526f6f74204341203120323030373a504e30820124300d06092a864886f70d010101050003820111003082010c028201010089d9ffd3ff37fc57881560c1bd2f681080b72d59a5a24ac70ad62f8e40377b2a32aac6b6130d20e74ffe3f0e6eadf954cf6b050bfe69f2fabc813fdeedb333bb392c74c434f6b4fac3d3d258ca79708f63e39534f839579f01748b979cadea1cbb65fd4ae62438493e9eb2c650e35cd63be9873977d9a41e0728a05d92872b4c8b75c54003bd3f400d943c3b14a7e0ae72bd2bebd2f1b0de08e2d1a411d638c24ef212771fcf48460bf817339b831f08b805e746534b887b87fcd2a33d4572e90e19b4058a6a1f370c0f0cccc8a8b95b02baf3b8a30d0fc314eb6b7b3781ea9e58d1b0b7474b053104e94c0aa1c09214bd2337d221f6e4c0ec4e997f8d8de851020500e9cc4529a38201c2308201be300f0603551d130101ff040530030101ff301d0603551d0e041604142c4cf69a2a9f288201c1990611afb34b7cb79afe303806082b06010505070101042c302a302806082b06010505073001861c687474703a2f2f7175616c2e6f6373702e642d74727573742e6e657430170603551d200410300e300c060a2b06010401a534021f0130330603551d11042c302a8110696e666f40642d74727573742e6e65748616687474703a2f2f7777772e642d74727573742e6e6574301806082b06010505070103040c300a3008060604008e460101300e0603551d0f0101ff0404030201063081d90603551d1f0481d13081ce3081cba081c8a081c5867f6c6461703a2f2f6469726563746f72792e642d74727573742e6e65742f434e3d442d54525553542532305175616c6966696564253230526f6f7425323043412532303125323032303037253341504e2c4f3d442d5472757374253230476d62482c433d44453f63657274696669636174657265766f636174696f6e6c6973748642687474703a2f2f7777772e642d74727573742e6e65742f63726c2f642d74727573745f7175616c69666965645f726f6f745f63615f315f323030375f706e2e63726c300d06092a864886f70d0101050500038201010069a9f184c8b6069d1a170765f3aa479cf772aa3daf2666e514210ece1b893e8a54c8ff36c91d2c8a11e5cdc772a4845b1e5bc33535b1b16d4baa08d4d9d4e2fd074be4565bf6ca70c875ba9c7e440e058afdd61b74d3bbd2e55ae4daf60fb21f8d54cc1565fe761a2c10b9c6d424263b0cad68496f63acac585ed617b906680cb430cce1b7e63fc0eed20f4da0d8a25f7c80c8e0178a54f7450872774a4bb329a093a0e1ca43c1732dbbdab492f15ce61026d588f186e73e1b622726ccbbcecc30decfd8baff8c82371e6c4584d923b58696970ec7aa228d4fa2fb2903b01adc105463bd9cd69e9ce41f329790d0d79abb79a3238fb475ae64c87797fa2c238d updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D904080A4929C838E9F185ECF7A22DEF99342407 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F9DD19266B2043F1FE4B3DCB0190AFF11F31A69D updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7998A308E14D6585E6C21E153A719FBA5AD34AD9 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D2EDF88B41B6FE01461D6E2834EC7C8F6C77721E\Blob = 0b0000000100000038000000430065007200740050006c0075007300200043006c006100730073002000330020005000720069006d006100720079002000430041000000090000000100000016000000301406082b0601050507030406082b06010505070301030000000100000014000000d2edf88b41b6fe01461d6e2834ec7c8f6c77721e2000000001000000950300003082039130820279a003020102021059dfac7e8a661511e58824ceefa9bca9300d06092a864886f70d0101050500303d310b30090603550406130246523111300f060355040a130843657274706c7573311b301906035504031312436c6173732033205072696d617279204341301e170d3939303730373137303830305a170d3139303730363233353935395a303d310b30090603550406130246523111300f060355040a130843657274706c7573311b301906035504031312436c6173732033205072696d61727920434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b794306ed04cd97e5e60e56fbb26ca526f6b6c8599a50bef001a6f1b4d58b51807fadd7bf8cb2c52ddfc9cb88d52e9b9b20b7cf58f5b99480958decd4895862589053427300b57b60c776329cb6caa3eb99951120d987076474cf949962208f96beaaa0036a315a71c1e9f8cca5a797b21da891f637e799250090428adcee36d04494a99b13f4509785820ef8dfe80c804ed292ca0588d840225973fa013d77b8b23e39fb8c7b84240381b924abd4a9455c756150d8177cc9fa237892b5b850d8b77f8c48bfb10cb94c7e91a5612976614c4bbd77d6d021bbf71622618e9498afaa3dee184ad80ca4ae2228c6a086183b222c7098838565dd131abf0099f13590203010001a3818c308189300f0603551d13040830060101ff02010a300b0603551d0f040403020106301d0603551d0e041604146a643676509c4ef4f74f15f50ded332560eccb20301106096086480186f842010104040302010630370603551d1f0430302e302ca02aa0288626687474703a2f2f7777772e63657274706c75732e636f6d2f43524c2f636c617373332e63726c300d06092a864886f70d010105050003820101009aa13e38aee152d2450dd1e98363ad8c80f493c3b8c23a229727b251863ed2f297de7cbbd7964053ca52aa8a6c63ccba718ae2f0f0108a17b04f8fc6ef0e31305a8dad04c7ab8c5f1a08cf9a179946be8e6b4a6a7f0147692518f84e3c4a042b06f210003dff3ea5e80ecf703886bbc58e0cd6e24b4b66f3735f80b53bf11229ea73bc689e1c60f7f3aa42d816c868de730b3f40c17777541d94572901935b98c36b04fa7c298dac47f0fe55154baf7123f5c3ce0167932680acf4828ac41b404adcc6390a6e63b6644d7ace90aa99bd36fd59fc2ffc45bede8e3359fa8a0b0f30364de35bb5d69650d7bffe85dcdab4822bcc1b083ff19a4eb5e18f08612416 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CFF810FB2C4FFC0156BFE1E1FABCB418C68D31C5\Blob = 0b0000000100000050000000430065007200740069007300690067006e0020004100750074006f00720069006400610064006500200043006500720074006900660069006300610064006f0072006100200041004300330053000000090000000100000016000000301406082b0601050507030406082b06010505070301030000000100000014000000cff810fb2c4ffc0156bfe1e1fabcb418c68d31c52000000001000000b7020000308202b33082021c020100300d06092a864886f70d01010405003081a1310b3009060355040613024252311730150603550408130e52696f206465204a616e6569726f311730150603550407130e52696f206465204a616e6569726f312e302c060355040a132543657274697369676e20436572746966696361646f7261204469676974616c204c7464612e3130302e060355040b132743657274697369676e204175746f72696461646520436572746966696361646f72612041433353301e170d3939303730393230353633325a170d3138303730393230353633325a3081a1310b3009060355040613024252311730150603550408130e52696f206465204a616e6569726f311730150603550407130e52696f206465204a616e6569726f312e302c060355040a132543657274697369676e20436572746966696361646f7261204469676974616c204c7464612e3130302e060355040b132743657274697369676e204175746f72696461646520436572746966696361646f7261204143335330819f300d06092a864886f70d010101050003818d0030818902818100ce644ed6cfae7c982798ef28efba34c3351a9dd2661e71f1e4962d27173990458f2defe6d547a9e183817c3e2871fa80bb5df8436b1910c1986f159e2dae496444ec841a69591657b23d92d8664bbf99ad4318c738c98b8e2c042eb34b6b93f69d1f84b2cde600c2be36a5bc59b59f8b1920ffe5a828a455b68ab6b2c5d744e30203010001300d06092a864886f70d010104050003818100cb75d7e4c1fff2a0438c9d2ea4439fae9148b86ab7ffc8338c13c6d2e426707ab8adedac9bc5a52baa578b04d781cdaa0d396fe444a9906502f7fa78d6d45577c56b40247854cbc446b1e5d28640859008fcdb15abce2a3e68be175fc4b2d0bcb22dcd4cb70cc42df8d60b4183cae474690be155b1911cc94a3c3ef052141df4 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D23209AD23D314232174E40D7F9D62139786633A\Blob = 5300000001000000230000003021301f06092b06010401f022010630123010060a2b0601040182373c0101030200c00b0000000100000012000000470065006f00540072007500730074000000090000000100000020000000301e06082b0601050507030406082b0601050507030106082b06010505070303030000000100000014000000d23209ad23d314232174e40d7f9d62139786633a2000000001000000240300003082032030820289a003020102020435def4cf300d06092a864886f70d0101050500304e310b30090603550406130255533110300e060355040a130745717569666178312d302b060355040b1324457175696661782053656375726520436572746966696361746520417574686f72697479301e170d3938303832323136343135315a170d3138303832323136343135315a304e310b30090603550406130255533110300e060355040a130745717569666178312d302b060355040b1324457175696661782053656375726520436572746966696361746520417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c15db158670862eea09a2d1f086d911468980a1efeda046f13846221c3d17cce9f05e0b801f04e34ece28a950464acf16b535f05b3cb6780bf42028efedd0109ece100144ffcfbf00cdd43ba5b2be11f80709915579316f10f976ab7c268231ccc4d5930ac511e3baf2bd6ee63457bc5d95f50d2e3500f3a88e7bf14fde0c7b90203010001a38201093082010530700603551d1f046930673065a063a061a45f305d310b30090603550406130255533110300e060355040a130745717569666178312d302b060355040b1324457175696661782053656375726520436572746966696361746520417574686f72697479310d300b0603550403130443524c31301a0603551d1004133011810f32303138303832323136343135315a300b0603551d0f040403020106301f0603551d2304183016801448e668f92bd2b295d747d82320104f3398909fd4301d0603551d0e0416041448e668f92bd2b295d747d82320104f3398909fd4300c0603551d13040530030101ff301a06092a864886f67d074100040d300b1b0556332e3063030206c0300d06092a864886f70d01010505000381810058ce29eafcf7deb5ce02b917b585d1b9e3e095cc25310d00a6926e7fb692639e5095d19a6fe411de63856e98eea8ff5ac8d355b2667157dec021eb3d2aa72349010486427bfcee7fa21652b56767d340db3b2658b228773dae147761d6fa2a6627a00dfaa7735cea70f1942165445ffafcef2968a9a28779ef79ef4fac077738 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DBAC3C7AA4254DA1AA5CAAD68468CB88EEDDEEA8\Blob = 0b000000010000002800000047005400450020004300790062006500720054007200750073007400200052006f006f0074000000090000000100000020000000301e06082b0601050507030406082b0601050507030206082b06010505070301030000000100000014000000dbac3c7aa4254da1aa5caad68468cb88eeddeea82000000001000000500200003082024c308201b5020200fd300d06092a864886f70d0101040500306e310b300906035504061302555331183016060355040a130f47544520436f72706f726174696f6e31273025060355040b131e475445204379626572547275737420536f6c7574696f6e732c20496e632e311c301a06035504031313475445204379626572547275737420526f6f74301e170d3938303430333134353230315a170d3034303430333233353930305a306e310b300906035504061302555331183016060355040a130f47544520436f72706f726174696f6e31273025060355040b131e475445204379626572547275737420536f6c7574696f6e732c20496e632e311c301a06035504031313475445204379626572547275737420526f6f7430819f300d06092a864886f70d010101050003818d0030818902818100ba8ebd759012fae57974b2d9f726d40e411de936075672d5b869da54d4b1d6786daae33b3da3843725c7afaf04dcb322b1e96dbe826deb8d2fbdb4ae701ea2d66e203151e6565c7352b223504ebcfb9a6740c4861146c74322baea004f6c72cd619cdecbfaee30d2e6fa5b9dc599dc20f839bf648c07563bbddc6c5ef6bfe1d90203010001300d06092a864886f70d010104050003818100965f1d3cc67595b66baf8700cda5412b8bbfd08d315b3965d3f1d18f581e5222c33d86f2c29af6dd485e71c3451c7c4ca259eea151963df7d534243aaafd822665c54c420f0c8f69607ce7d6d51a4b79faee5ab54ca6cca36b46d6d1c83254a03067d25d861191bcc3ba2a9cd578511ad45ddd769122456b31593ef985594ecb updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\90AEA26985FF14804C434952ECE9608477AF556F\Blob = 03000000010000001400000090aea26985ff14804c434952ece9608477af556f090000000100000016000000301406082b0601050507030406082b060105050703020b000000010000001200000056006500720069005300690067006e0000002000000001000000410200003082023d308201a6021100cdba7f56f0dfe4bc54fe22acb372aa55300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732031205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830313233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732031205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100e519bf6da356612d994871f667deb98debb79e86800a910efa3825af468882e573a8a09b245d0d1fcc656e0cb0d0568418879a069b10a173dfb458396b6ec1f615d5a8a83faa12068d31ac7fb034d78f34678809cd1411e24e4556691f780280dadc479129bb36c9635cc5e0d72d877ba1b732b07b30ba2a2f31aaeea367dadb0203010001300d06092a864886f70d0101020500038181004c3fb88bc668dfee43330e5de9a6cb07844d7a33ff921bf436add895223668116c7c42ccf39c2ec4073f14b00f4fff909276f9e2bc4ae98fcda0800af7c529f182225db8b1dd8123a37b251546307916f8ea054b947f1dc21cc8e3b7f410403c13c35f1f53e848e486b47ba135b07b25bab8d38eab3f389d00340098f3d17194 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\76B76096DD145629AC7585D37063C1BC47861C8B\Blob = 03000000010000001400000076b76096dd145629ac7585d37063c1bc47861c8b09000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090b000000010000002a00000055002e0053002e00200047006f007600650072006e006d0065006e00740020004600420043004100000020000000010000007e0300003082037a30820262a003020102021039e3815404c50ab247effef336cfc698300d06092a864886f70d0101050500304e310b300906035504061302757331183016060355040a130f552e532e20476f7665726e6d656e74310d300b060355040b130446424341311630140603550403130d436f6d6d6f6e20506f6c696379301e170d3034313030363138343530395a170d3130313030363138353335365a304e310b300906035504061302757331183016060355040a130f552e532e20476f7665726e6d656e74310d300b060355040b130446424341311630140603550403130d436f6d6d6f6e20506f6c69637930820122300d06092a864886f70d01010105000382010f003082010a0282010100cf267cb0694c7700caf4e3741994fb5a61af62e4bdc300e524a30126a0d4d6e3d1f9a678efebf40192a830902fca33a368822025d437b2ed1920b72916b30b59380744416108915f7142c5642a292e46ba0c32a51325e3d9debdf8c913908a5711b557487838b527d1ac85ca2af840f8257f9d4220e173db45fdd35a9abfdd47ee3e3e491800e4f6be5c882d782807ae5ed2d69be6bdfc2cba27f396be30fe20f8f7d9a80f7871c75323cdb0ac7f478ccf7126c11ac330249e08d3587425f216dfb0d0823735689989e1bd04a04e96629ec163b41a5152fcc9de2ff85ef57d8c6f1b41814dbb2853ae9b613f29eadcd0b7a9531daef5aa96d65c7793562a49530203010001a3543052300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604141e2c4bf9ec66a61e925f877903edd5c295b79583301006092b06010401823715010403020100300d06092a864886f70d010105050003820101006635cba17282e037ce9659be07cca97e171ad110c85d8c1dfa125cc77239a2e92c845860fe77f94d3b6b13eadedb3ee619f66c63847a056bee3a19cdb4ce4ee115314137638a347f9487c708a3f7cbf9b07b49e1e821d7a1c2e4f2a6ade7f34079a1e9ec7fa0248ac51b351ecaa3e079e687a3a3c67c39c649c2102eff97d26c7ed3bb0f1beb561a632cbcc31eb6b269c767edca4c2d9f0430a3e246520083d5d50a6bede9342090185484ba973c37918733eafa5c195b7c2c299a8d445874bb06316e89b4591179e09ad23c62413d4c3ae9b9a549c5008f0fa1775c3d46947a4a8e08312d257b086011acfb3aee77cc6d06ce43a5e902c9bde258ba087aad07 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F555CE20DCD3364E0DC7C41EFDD40F50356C122\Blob = 0300000001000000140000004f555ce20dcd3364e0dc7c41efdd40f50356c12209000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703090b000000010000002200000043004500520054004900430041004d00410052004100200053002e0041002e0000002000000001000000d1050000308205cd308204b5a003020102020100300d06092a864886f70d0101050500308192312430220603550407131b426f676f74612041562043616c6c65203236204e203638442d3335310b300906035504061302434f31423040060355040a1339456e74696461642064652043657274696669636163696f6e204469676974616c204162696572746120436572746963616d61726120532e412e3119301706035504031310434552544943414d41524120532e412e301e170d3035303232333137313033375a170d3135303232333137313033375a308192312430220603550407131b426f676f74612041562043616c6c65203236204e203638442d3335310b300906035504061302434f31423040060355040a1339456e74696461642064652043657274696669636163696f6e204469676974616c204162696572746120436572746963616d61726120532e412e3119301706035504031310434552544943414d41524120532e412e30820122300d06092a864886f70d01010105000382010f003082010a0282010100f089afa72bf13e5e196ca98cdcd9e14cbe45c725f7bb875df2971995a8c51de8dc407ddcf7ce0850d62984b667e90105c371e47bca31df6972dfb107ea790e908c60a47fb5c6dbc382d0ad96c68aa527746d669e233e79c2741385ea30cd4018ccfe137d15f261fb57f57beaa2b93f6c6d0429080785c90ee57fca7aee112e42eeab6cdc383b7abf3330a30224fd3d9f20737e017c3c2f524c8f2972fe7942c708fe1f1b9df5a2106cd8b04e89afed5f9e2e744176dcffbb132f470247ca2be5091835c7bcc35ab73257d221493455d7647ef66b1caecd20d1ff60971255f9c188737c7abcbc99ed80697c58074462401483917524cedcb4c8e6abbbf168c2c70203010001a382022a30820226300f0603551d130101ff040530030101ff301d0603551d0e0416041452c97f765df5e1f422cd7de5676e8db76a9212793081bf0603551d230481b73081b4801452c97f765df5e1f422cd7de5676e8db76a921279a18198a48195308192312430220603550407131b426f676f74612041562043616c6c65203236204e203638442d3335310b300906035504061302434f31423040060355040a1339456e74696461642064652043657274696669636163696f6e204469676974616c204162696572746120436572746963616d61726120532e412e3119301706035504031310434552544943414d41524120532e412e820100300b0603551d0f04040302010630090603551d110402300030090603551d1204023000301106096086480186f8420101040403020007304306096086480186f842010d04361634434552544943414d41524120532e412e2043657274696669636174696f6e20417574686f72697479204365727469666963617465303d0603551d1f043630343032a030a02e862c687474703a2f2f7777772e636572746963616d6172612e636f6d2f636572746963616d61726163612e63726c303b06096086480186f8420104042e162c687474703a2f2f7777772e636572746963616d6172612e636f6d2f636572746963616d61726163612e63726c303b06096086480186f8420103042e162c687474703a2f2f7777772e636572746963616d6172612e636f6d2f636572746963616d61726163612e63726c300d06092a864886f70d0101050500038201010011a35f53682c2f38d314fbab33b84ce2a1d1220c7f18a9514d16df1e1fbfb3b297086317346ef5fc6efdaef466f3bda2d9b8396afce629d5dfd8c18a7804a2b05f661dd2e4d614bb2edf1e3cac1b40126c957ced5aec3c6b209b1696b002c17cccd101ae2b4dd3ffd02d0580b431fc11ceb47b5cf58b4bf04682ce5d62d9f0239e547df99ef1626dda816468452195ef0f5ab24b5db6ce5633d4f2fa5867911aed2f03d5edaaa07dd9c73797a28409e781b8cf665d065d312091011fd3608cb6d577f15a727940a227f81bc404d2fd36d43f68c76cefb0aa4cca3907d2099f6e9215e29176fd63333eb8bafb1d558107074c48e173472181fd319229cacd5afc updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABB51672400588E6419F1D40878D0403AA20264 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\74207441729CDD92EC7931D823108DC28192E2BB updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\51A44C28F313E3F9CB5E7C0A1E0E0DD2843758AE updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4A058FDFD761DB21B0C2EE48579BE27F42A4DA1C updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D8C5388AB7301B1B6ED47AE645253A6F9F1A2761\Blob = 5300000001000000230000003021301f060960857401590102010130123010060a2b0601040182373c0101030200c00b0000000100000014000000530077006900730073005300690067006e00000009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303030000000100000014000000d8c5388ab7301b1b6ed47ae645253a6f9f1a27612000000001000000be050000308205ba308203a2a003020102020900bb401c43f55e4fb0300d06092a864886f70d01010505003045310b300906035504061302434831153013060355040a130c53776973735369676e204147311f301d0603550403131653776973735369676e20476f6c64204341202d204732301e170d3036313032353038333033355a170d3336313032353038333033355a3045310b300906035504061302434831153013060355040a130c53776973735369676e204147311f301d0603550403131653776973735369676e20476f6c64204341202d20473230820222300d06092a864886f70d01010105000382020f003082020a0282020100afe4ee7e8b240e126ea9502d16443b92925ccab85d849242132abc655782403e5724cd508b252ab76ffcefa2d0c01f02244a13968f2313e6285800a347c706a784232bbbbd962b7f55cc8bc1571f0e62650fdd3d568a73daae7e6dba811c7e428c2035d9434d84fa84db522cf30e27770b6bbf112f72789f2ed83ee618375a2a72f9da62909295ca1f9ce9b33c2bcbf30113bf5acfc1b50a60bdddb5996453b8a096b36fe22677918ce06210029f340fa4d5923351debe8dba847a603c6adb9f2becdede013f6e4de55086cbb4afed4440c5ca5a8cdad22b7ca8eebea6e50aaa0ea5df0552b755c7225d326a97976313dbc9db79367b853a4ac55289f924e79d77a982ff551ca571692bd10224f2b326d46bda0455e5c10ac76d3037902ae49e14335e161755c55bb5cb348992f19d268fa107d4c6b27850db0c0c0b7c0b8c41d7b9e9dd8c88f7a34db232ccd817dacdb7ce669dd4fd5effbd973e2975e77ea76258af2534a541c73dbc0d50ca03030f085a1f95737862bfaf7214690ea5e5030e788e262842f0070b622010673946faa903cc04387a66ef2083b58c4a568e9100fc8e5c82de88a0c3e2686e7d8def3cdd65f45dac51ef2480aeaa56976ff9ad7dda613f98773ca591b61c8c26da65a2096dc1e254e3b9ca4c4c808f777b609a1edfb6f2481e0eba4e546d98e0e1a21aa27750cfc46392ec47199debe66bcec10203010001a381ac3081a9300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604145b257b96a465517eb839f3c078665ee83ae7f0ee301f0603551d230418301680145b257b96a465517eb839f3c078665ee83ae7f0ee30460603551d20043f303d303b0609608574015901020101302e302c06082b060105050702011620687474703a2f2f7265706f7369746f72792e73776973737369676e2e636f6d2f300d06092a864886f70d0101050500038202010027bae3947cf1aec0de17e6e5d8d5f554b083f4bbcd5e057b4f9f7566af3ce8567efc72783803d92b621b00b9f8e960cdccce518ac750316ee14a7e182f6959b63d64812be38384e622878e7de0ee029961b81ef4b82b88121684c23193389631a6b93b533fc32493565b6992ecc5c1bb3800e3ec17a9b8dcc77c01839f3247ba5222341d327a0956a77c2536a93d4bdac0826f0abb12c8874b2711f91e2dc7933f9edb5f266b52d92e8af114c6448d15a9b7bfbddea61aeeae2dfb487717febbecaf18f52a51f0398497956c6e1bc32bc474607925b00a27dfdf5ed239cf457d424bdfb32c1ec5c65dca553aa09c699a8fdaefb2b03c9f876c122b65701552311a24cf6f3123501f8c4f8f23c37441631c55a814dd3ee05150cff11b30560e92b08285d883cb2264bc2db825d554a2b806eaad92a424a0c186b54a136a47cf2e0b569554cbce9adb6ab4a6b2db4108862777f76aa0426c0b38ced775503292c2df2b302248d0d54138255da4e95d9fc69475d045fd3097438f90ab0ac78673604a692ddea578d706da6a9e4b3e773a20132201d0bf689e63606b354d0b6dbaa13dc093e07f23b355ad72254e46f9d216efb064c1019ee9caa06a980ecfd860f22f49b8e442e1383516f4c86e4ff78156e8baa3be23afaefd6f03e0023b3076fa1b6d41cf01b1e9b8c966f4db26f33aa474f249245bc9b0d057c1fa3e7ae197c9 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\688B6EB807E8EDA5C7B17C4393D0795F0FAE155F updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3E84D3BCC544C0F6FA19435C851F3F2FCBA8E814 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\90DECE77F8C825340E62EBD635E1BE20CF7327DD updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5F3B8CF2F810B37D78B4CEEC1919C37334B9C774 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0048F8D37B153F6EA2798C323EF4F318A5624A9E\Blob = 0b0000000100000050000000430065007200740069007300690067006e0020004100750074006f00720069006400610064006500200043006500720074006900660069006300610064006f0072006100200041004300310053000000090000000100000016000000301406082b0601050507030406082b060105050703010300000001000000140000000048f8d37b153f6ea2798c323ef4f318a5624a9e20000000010000006802000030820264308201cda003020102020105300d06092a864886f70d0101040500306f310b3009060355040613024252312e302c060355040a132543657274697369676e20436572746966696361646f7261204469676974616c204c7464612e3130302e060355040b132743657274697369676e204175746f72696461646520436572746966696361646f72612041433153301e170d3939303632373030303030305a170d3138303632373030303030305a306f310b3009060355040613024252312e302c060355040a132543657274697369676e20436572746966696361646f7261204469676974616c204c7464612e3130302e060355040b132743657274697369676e204175746f72696461646520436572746966696361646f7261204143315330819f300d06092a864886f70d010101050003818d0030818902818100b0c095eba3c541f89b6f71638e911157f903c7689a1a9c61f0c30f0c9762887e2601357dfdf16f4f1795aa7ef2bbbcefe2767361953651833e84e83fba57363794136c92641f940deb542f515ae5285ef09286e7e46d217a5f370be75bbd2d02a881f93fcb14c8bca4c5e3d1cb37dcabe587aaf20b982e7acfcc1ec27fe8fd010203010001a310300e300c0603551d13040530030101ff300d06092a864886f70d0101040500038181001baea9d876bc7a9ef88b1ae7fb45d35e300e93bdf8a95d03429bf064c6793d43693c40a13646488256e888f03a95e6bee8a1b640bdffd62cada1330673780265e9ed7b7b49846d64d3f39d9b6c9fe143039860c0b5d3e5eb48a94962e2b9cecc240ad822c13d3730049c75fe88ba04a57aa200deed011da63913a46cd8b59aa2 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0409565B77DA582E6495AC0060A72354E64B0192 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CB44A097857C45FA187ED952086CB9841F2D51B5\Blob = 030000000100000014000000cb44a097857c45fa187ed952086cb9841f2d51b5090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b000000010000001c00000043006f006d006d006f006e00200050006f006c0069006300790000002000000001000000a5030000308203a130820289a0030201020210293647aae38aac864a2356f2cab761af300d06092a864886f70d0101050500304e310b300906035504061302757331183016060355040a130f552e532e20476f7665726e6d656e74310d300b060355040b130446424341311630140603550403130d436f6d6d6f6e20506f6c696379301e170d3037313031353135353830305a170d3237313031353136303830305a304e310b300906035504061302757331183016060355040a130f552e532e20476f7665726e6d656e74310d300b060355040b130446424341311630140603550403130d436f6d6d6f6e20506f6c69637930820122300d06092a864886f70d01010105000382010f003082010a0282010100978dbd3327e4ad5bfb78bd2f47476ec778e9939ca4dec91cfd2f1b3938ac4717c07e7729003b031f680fcd4da5ee77b82c626b31f6fa72097d3029067ce77ca33d84188a1dae2c92a81fe85e4f8d8eeb3f1af89c0a679db0674df02ed030dec394b0a0cf2e0a347f5409d336bda449575273e99dfee44879461b5b8d32e4a54864f3220d929d0815bf603c83f747222522ad2971b777ef17c9a2b6945ec83090a414485c56570b414c05d42a4c3fae129b591175700722692d2cd331cc927ecccda47e9447aa9c0908f64baf52e86a4091c555bd40b1c86d57869517e61f73be472e3e8b4c17b9b9251ca55217360859c042be0a2bb456513c1b55c98c9077eb0203010001a37b3079300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604142f5897d8a90598a5561ffbd9ab75ef023c3634c7301206092b060104018237150104050203010001302306092b06010401823715020416041476b76096dd145629ac7585d37063c1bc47861c8b300d06092a864886f70d0101050500038201010060aef348164072a60888c9bc472c244b5da09173ed657890f067907aa5bf0aadb62af99967df83c5771f340938f97e9e41e04860fee2aa5d8788ea88fd5c45b2c96ada7da4adb14fbf1c0d9f1e9ac0d51473382b8a78406e30f762e1cd99fc5169676c11ddb810a368de26a556fd366c37986cfbee7c3c6c6b703ff74837098f0b4281ad4646b80b8306f41b38a07f4fcd0bef838987971c8a3067dcfd54a1037e01cb854cb10b29c3beec7ce13f0f09523c2fa79a48fe37e9110658e136418ac4b6bf8eddce4ab3bc1ac0cdfa1a99d2719bfacfbcf2c454a3883576cc1b2c466f0cb4d1c36176927411ea4b808d1c89118bec5bff17c948fce7e00611e2845e updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D3C063F219ED073E34AD5D750B327629FFD59AF2 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\FD1ED1E2021B0B9F73E8EB75CE23436BBCC746EB updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 53000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000140000005500530045005200540072007500730074000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A1DB6393916F17E4185509400415C70240B0AE6B\Blob = 030000000100000014000000a1db6393916f17e4185509400415c70240b0ae6b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b000000010000008e00000056006500720069005300690067006e00200043006c006100730073002000330020005000750062006c006900630020005000720069006d006100720079002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200028005000430041003300200047003100200053004800410031002900000053000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c02000000001000000400200003082023c308201a502103c9131cb1ff6d01b0e9ab8d044bf12be300d06092a864886f70d0101050500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830323233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c95c599ef21b8a0114b410df0440dbe357af6a45408f840c0bd133d9d911cfee02581f25f72aa84405aaec031f787f9e93b99a00aa237dd6ac85a26345c77227ccf44cc67571d239ef4f42f075df0a90c68e206f980ff8ac235f702936a4c986e7b19a20cb53a585e73dbe7d9afe244533dc7615ed0fa271644c652e816845a70203010001300d06092a864886f70d010105050003818100107252a9051419320841f0c56b0acc7e0f2119cde467dc5fa91be6cae8739d22d8986e73036191c57cb045406e449d8db0b19674612d0da945d2a4922ad69a75976e3f53fd4599601da82b4cf95ea709d87530d7d265603d67d6485575693f91f5480b476922698296bec9c838864a7a2c731948694e6b7c65bf0ffc70ce8890 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\FA0882595F9CA6A11ECCBEAF65C764C0CCC311D0\Blob = 030000000100000014000000fa0882595f9ca6a11eccbeaf65c764c0ccc311d009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703080b000000010000001600000043006500720074004500750072006f00700065000000200000000100000003070000308206ff308204e7a00302010202027119300d06092a864886f70d0101050500305a310b300906035504061302465231133011060355040a130a436572746575726f706531173015060355040b130e3030303220343334323032313830311d301b06035504031314436572746575726f706520526f6f742043412032301e170d3037303332373232303030305a170d3337303332373233303030305a305a310b300906035504061302465231133011060355040a130a436572746575726f706531173015060355040b130e3030303220343334323032313830311d301b06035504031314436572746575726f706520526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100c3fc56b52b068bed9e46cfc300791c8039a2caca1b106d21f9c71f0aacf3ad7982979ec6b16888527138c4aa4c476f77fde71ff794f672579f443c6b5fd0d9ce2228cd702301142250100e1a7b4b1bf486578fea2f6940ba457a02405a5f35dba0b99e3ff03f75cd3a45911355c34829f3b7d714f20386a3c9b0577b3dd92aac5ee1df953a85c6054c31a2da2db1008eaf51579ec18b454d29078ba0e5e5df310c7f066c614f6be22332c1e58c2b0dd8960670b32627cacfb3a82300c0122481bfac443d17988388ce0990372ea2801949d9a0081786996add1e409fd202e7b39856477617aa4ea1d7dbeaa4bad5526769732ea0275473ac8bd0bbf0615826a86a7918c10ce77c56cccfcdd7068622075e73b8d0e60c253562ba04c4f1002cce9d489d5bb4f6d16298437757ab72fe3380102a311bdb19502992ac81e008695fe64e3e5ead5c48799ec55db09791179e16df07fa6ae1abbc257c3800e1d6d87a9cfcdcd722005267a897bb6c0d67999710b8793867686188296e94bf52078836c2f22fc6466a211ef19ae8bb9fedb626b386a7304a9b3063bce4e8425644273c5aa10e7dceaac31b5e68ec733f3fb3fbc4852c0415fbac0a3866331995034bcab4047de77e0f0d98563ed8575fb799be7a14adc5a7db940e059e25abb2abf9099578aa078b6c051cee5a8061e8dfbe36fbb3e323dc3d8c7566efa3e455d09aef0203010001a38201cd308201c9300f0603551d130101ff040530030101ff30110603551d0e040a04084bc94eb967b1983530530603551d20044c304a304806072a817a01690401303d303b06082b06010505070201162f687474703a2f2f7777772e636572746575726f70652e66722f7265666572656e63652f70632d726f6f74322e706466300b0603551d0f0404030201063082013f0603551d1f04820136308201323032a030a02e862c687474703a2f2f7777772e636572746575726f70652e66722f7265666572656e63652f726f6f74322e63726c307da07ba07986776c6461703a2f2f6c6372312e636572746575726f70652e66722f636e3d436572746575726f7065253230526f6f742532304341253230322c6f753d303030322532303433343230323138302c6f3d436572746575726f70652c633d46523f63657274696669636174655265766f636174696f6e4c697374307da07ba07986776c6461703a2f2f6c6372322e636572746575726f70652e66722f636e3d436572746575726f7065253230526f6f742532304341253230322c6f753d303030322532303433343230323138302c6f3d436572746575726f70652c633d46523f63657274696669636174655265766f636174696f6e4c697374300d06092a864886f70d010105050003820201001b449660245a3e6baadecdd3d85b52c04bfa5125e3eecdbc8c3ed3b51df6fc4083ac7ee5d706432d6c2773febfdaa48222516efe8c0ca611526068065e334cfa48f85b4821d60c9bbe38b9e1c04c13a153ef22396eee4650650b1a1f057e77d9ce25cdf4afc67c9d8c976c6a1df664ed94e1ce5def401d96cb71d54aad795839454dab6f07bb337cae3ea5e9c728da68a09e572766ef7d97ee69a842eb73aa4bb159c68d379ca9c046506f8c4953d5e52de1a24dcbe75bbfa5bb3cac52ce199364c3109a7942aba8fb8483c2465fbb28cc0e694f7c5fbb3c67e60d961e844c5e20155b3943e58b2b822489a3a0f71065d3c989daa4c1457d895990eb419e8ed0c409605f972d216d04a61181304c93c25860b86bd67aa0e5b1119f62b8307146a77764663a42591f556347d71da0348e81726248d997aea1f1be40e2a0317f6b00d9c702d069020ef1ce1e2da49defcc813b639ef7541bcebec40a579bcdb16be2a7e0ab1e1e83d8c0521caa3a514692d09fdb21df69a80b154d5ee489fc5b5348796bad619f1ee5b8b132b2db7de8476ad8a2e065f5ce5617a01290baf04b2d011aa969d2a7e7c7ac349b6da290c186264ab22fbdfb6f686b55bbc56338c17760632dad0c9c3caa98b243a3d446dc0ddc361f322e68ba7c6521419796906714d6a42ffd213f7ffc227b2a3558f546f1930ed9ede03a267f6e2e8f98b84fd499 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474\Blob = 53000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b000000010000003600000047005400450020004300790062006500720054007200750073007400200047006c006f00620061006c00200052006f006f007400000009000000010000002a000000302806082b0601050507030406082b0601050507030206082b0601050507030106082b0601050507030303000000010000001400000097817950d81c9670cc34d809cf794431367ef47420000000010000005e0200003082025a308201c3020201a5300d06092a864886f70d01010405003075310b300906035504061302555331183016060355040a130f47544520436f72706f726174696f6e31273025060355040b131e475445204379626572547275737420536f6c7574696f6e732c20496e632e312330210603550403131a475445204379626572547275737420476c6f62616c20526f6f74301e170d3938303831333030323930305a170d3138303831333233353930305a3075310b300906035504061302555331183016060355040a130f47544520436f72706f726174696f6e31273025060355040b131e475445204379626572547275737420536f6c7574696f6e732c20496e632e312330210603550403131a475445204379626572547275737420476c6f62616c20526f6f7430819f300d06092a864886f70d010101050003818d0030818902818100950fa0b6f0509ce87ac788cddd170e2eb094d01b3d0ef694c08a94c706c89097c8b8641a7a7e6c3c53e1372873607fb29753079f53f96d5894d2af8d6d886780e6edb295cf7231caa51c72ba5c02e76442e7f9a92cd63a0dac8d42aa240139e69c3f0185570d588745f8d385aa936926857048803f1215c779b41f052f3b62990203010001300d06092a864886f70d0101040500038181006deb1b09e95ed951db672261a42a3c4877e3a07ca6de73a21403853dfbab0e30c58316338113089e7b344edf40c874d7b97ddcf476557d9b635418e9f0eaf35cb1d98b421eb9c0954ebafad5e27cf56861bf8eec05975f5bb0d7a38534c424a70d0f9593efcb94d89e1f9d5c856dc7aaae4f1f22b5cd95adbaa7ccf9ab0b7a7f updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\40E78C1D523D1CD9954FAC1A1AB3BD3CBAA15BFC\Blob = 03000000010000001400000040e78c1d523d1cd9954fac1a1ab3bd3cbaa15bfc090000000100000020000000301e06082b0601050507030206082b0601050507030406082b060105050703030b000000010000000e0000007400680061007700740065000000200000000100000025030000308203213082028aa003020102020100300d06092a864886f70d01010405003081cb310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311a3018060355040a131154686177746520436f6e73756c74696e6731283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f0603550403131854686177746520506572736f6e616c2042617369632043413128302606092a864886f70d0109011619706572736f6e616c2d6261736963407468617774652e636f6d301e170d3936303130313030303030305a170d3230313233313233353935395a3081cb310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311a3018060355040a131154686177746520436f6e73756c74696e6731283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f0603550403131854686177746520506572736f6e616c2042617369632043413128302606092a864886f70d0109011619706572736f6e616c2d6261736963407468617774652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100bcbc93536dc0504f8215e6489435a65abe6f42fa0f47ee777572dd8d499b9657a078d4ca3f51b3690b9176172207976ac451934be08def3795a10c4dda34901d178997e03538574ac0f40870e93c447b507e619a90e323d388114627f50b070ebbddd17f200a88b9560b2e1c80daf1e39e29ef14bd0a44fb1b5b18d1bf2393210203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d0101040500038181002de2996bb03d7a89d759a294011f2bdd124b53c2ad7faaa7005c914057254a38aa8470b9d9800fa57b5cfb73c6bdd78a615c03e32d27a817e0848542dc5e9bc6b7b26dbb74afe43fcba7b7b0e05dbe78832594d2db810f79076d4ff439155a52017bde32d64d38f6125c0650df055bbd144ba1df29ba3b418df76356a1df22b1 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C73026E325FE21916B55C4B53A56B13DCAF3D625 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5F4E1FCF31B7913B850B54F6E5FF501A2B6FC6CF updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\379A197B418545350CA60369F33C2EAF474F2079\Blob = 030000000100000014000000379a197b418545350ca60369f33c2eaf474f2079090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b0000000100000030000000470065006f0054007200750073007400200055006e006900760065007200730061006c002000430041002000320000002000000001000000700500003082056c30820354a003020102020101300d06092a864886f70d01010505003047310b300906035504061302555331163014060355040a130d47656f547275737420496e632e3120301e0603550403131747656f547275737420556e6976657273616c2043412032301e170d3034303330343035303030305a170d3239303330343035303030305a3047310b300906035504061302555331163014060355040a130d47656f547275737420496e632e3120301e0603550403131747656f547275737420556e6976657273616c204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100b35452c1c93ef2d9dcb1531a5929e7b1c34528e5d7d1edc5c54ba1aa747b57af4a26fcd8f55ea76e19db740c4f355b320b01e3dbeb7a7735eaaa5ae0d6e8a15794f090a37456944430031e5c4e2b852674827a0c76a06f4dce412da01506145fb742cd7b8f586134dc2a08f92ec301a622441c4c0782e65bced04a7c04d3197327f0aa987f2eaf4eeb871e24776a5db6e85b45badcc3a1056f568e8f1026a549c32ed7418722e04f86ca60b5eaa163c001971079bd003c126d2b15b1ac4bb1ee18b94e96dcdc76ff3bbecf5f03c0fc3be8be461bffda40c252f7fee33af76a7735d0da8deb5e186a31c71eba3c1b28d66b54c6aa5bd7a22c1b19cca202f69b59bd376b86b56d82bad8eac956bca93658fd3e19f3ed0c26a99338f84fc15d2206d097eae1adc655e0812b28833afaf47b215100be5238cecd6679a8f48156e2d0830947515b506acfdb481a5d3ef7cbf665f76cf195f8023b325682397a5bbd2f891bbfa1b4e8ff7f8d8cdf03f1604e58114ceba33f102b839a0173d9946d84002766acf07040094292ad4f930d61095124d892d50b9461b287b2edff9a35ff8554caed4443ac1b3c166b484a0a1c40881f92c20b0005fff2c8024aa4aaa9cc99969c2f58e07de1bebb07dc5f04725c3134c3ec5f2de03d649022e6d1ecb82edd59aed9a137bf5435dc73324f8c041e33b2c946f1d85cc85550c968bda8ba36090203010001a3633061300f0603551d130101ff040530030101ff301d0603551d0e0416041476f355e1faa436fbf09f5c6271ed3cf44738102b301f0603551d2304183016801476f355e1faa436fbf09f5c6271ed3cf44738102b300e0603551d0f0101ff040403020186300d06092a864886f70d0101050500038202010066c1c623f3d9e02e6e5fe8cfaeb0b0254d2bf83b589b4024375acbab1649ffb3757933a12f6d70173491fe677e8fec9be55e82a9551f2fdcd4510712feac163e2c35c663fcdc10eb0da3aad07cccd1d02f512ec4145adee819e13ec6cca429e72e84aa06307876547328985938e0000d62d3427d219fae3d3a8cd5fa770d182b160e5f36e1fc2ab53024cfe0630c7b581afe99ba4212b191f47c68e2c8e8af2ceac97eaebb2a3d0d15dc3495b61874a86a0fc7b4f413c4e45bed0ad2a4974c2aed2f6c12893df12770aa6a0352219f40a86750f2f35a1fdfdf23f6dc784ee6984f553a53e3eff2f49fc77cd858af292297b8e0bd912eb076ec5711cfef2944f3e9857a6063e45d338917d931aadad6f3183572cf872b2f6323845d848c3f57a088fc999128266999d48f9744be8ed548b1a42829f115b4e1e59eddf88fa66f26d7093c3a1c110ea66c37f7ad44872c28c7d87482b3d06f4a57bb352927a08be821a78764365dccd816acc7b22740925538288d516edd1467536c715c26844d755ab67e6056a94dadfb9b1e97f30dd9d2975477da3d12b7e01eef0806acf98587e9a2dcaf7e181283fd5617412ed529827d99f431f671a9cf2c0127a505b9aab2484e2aef9f935251953c52738e564c1740c00928e48b6a4853dbeccd5555f1c6f8e9a22c4ca6d1265f7eaf5a4cda1fa6f21c2c7eae0216d256d02f575347e892 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\BC7B3C6FEF26B9F7AB10D7A1F6B67C5ED2A12D3D updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7AC5FFF8DCBC5583176877073BF751735E9BD358\Blob = 0b000000010000002a0000005300650063007500720065004e0065007400200043004100200043006c00610073007300200042000000090000000100000016000000301406082b0601050507030406082b060105050703010300000001000000140000007ac5fff8dcbc5583176877073bf751735e9bd3582000000001000000dd020000308202d9308201c1a003020100020100300d06092a864886f70d0101040500302c310b3009060355040613026175311d301b060355040a13145365637572654e657420434120436c6173732042302617113939303633303030303030302b3130303017113039313031353233353930302b31303030302c310b3009060355040613026175311d301b060355040a13145365637572654e657420434120436c617373204230820122300d06092a864886f70d01010105000382010f003082010a0282010100a663d9c6155a76e74665c73491f97bdd56bbf896352e29caa77d0a1ef73152e85ac8d3cf39014e5bf01fb1b84ad2b34743663f01404e3049e10ffdeb126378ccf6166218f56f69fd7e6e337621a3c0880feae625fca997cc1872c731b60b9bcdc2c578616345ac34a6277868c4bd5268ce844dd224a5286c80e6cae6cfe69a9e5078cef336d2a3435a1c06afcb20eed02cc44418906cb1916465b9b785834ba89199c5e09cf7b850d7d3b04f9aed63fb4df4d428243a805b7b938cc50584af3b86fe8131c7b69d5f1aea907bb0465eb2085200570d55528378954afd688f9ed950b64b53faf28502954e38f583a796d4313f3fa7ca3753dcc52f6d1a74a6ccbf0203010001300d06092a864886f70d010104050003820101004b46a6225ae9d1a5e4108f4c5360e34d5486deba1caa2a5a36081d4a0b49a1efaabdbc2632a4ff734030240fecab11d5cbafc44b9be71e1cc35085ba4f082b2f3f1423aaf6839986be467811152b9ae4a3bf7de98d7ef967df3e7fe6ad46e76065675fe580f32cbb5367736fe0ae97126d49181c684cb32cf35ac13531f6ece93ea7cbcd5450875845c014d548b6f3288e3a1829e89a99f1e0f5a3cb08b47d782513e134ce689bdab722211b3452cbef53e2f3d70c62dab1454145b897582c086245230e5995351a0e44c751704e3f04ad26c21ded0f482d55131d71a2a70eb32f876fb0eee5c7368b2c715140871ace56143929ef250a800a199df5569fdd8a updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0B77BEBBCB7AA24705DECC0FBD6A02FC7ABD9B52 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\89C32E6B524E4D65388B9ECEDC637134ED4193A3\Blob = 0b000000010000002c0000004d006100630061006f00200050006f0073007400200065005300690067006e00540072007500730074000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030703000000010000001400000089c32e6b524e4d65388b9ecedc637134ed4193a3200000000100000069030000308203653082024da003020102021043115a961f655ad6f03312fdedd0b975300d06092a864886f70d0101040500305f310b3009060355040613024d4f31133011060355040a130a4d6163616f20506f7374313b3039060355040313324d6163616f20506f737420655369676e547275737420526f6f742043657274696669636174696f6e20417574686f72697479301e170d3033303133303030303030305a170d3133303132393233353935395a305f310b3009060355040613024d4f31133011060355040a130a4d6163616f20506f7374313b3039060355040313324d6163616f20506f737420655369676e547275737420526f6f742043657274696669636174696f6e20417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a21cb6b8b8b1cd544983ae3ac7ad84d05dff95abf5ff011b5eef203ebd8020492c68b28331ec952d6e49b27bbf649f572dd5226bee57977487eafb50cd72e7242d7054bca4e22a85b502f9a760b67259eb51ac464afca775fb04d400ffda0ccecb930f327976d626e0cd720d4bea268f4b7cd6e362688826d04db79a279bc09bb612c19bec04d135da27be30e27d03ce4638086fe1f79e2c0eba0a31d7c26a448667d1e8499314c0cc5e91a7fb56ba8100386cd299c1bf5ce8a4ed4a9ceae252bde3f98bf844e6c44041cdef004cb9c2a9fc01f4eefeb0910f8071b6e59168a2e567d7e8e5e8a3ce74ac5e17ad3b1144175e6576b2224db80b3be93f8969f5b30203010001a31d301b300c0603551d13040530030101ff300b0603551d0f040403020106300d06092a864886f70d01010405000382010100a0945101d8ccfb177edc9d7ec188b25c17cfb0c624c934b006659913544587177dc1c82e6134eec66dc34d6aa91eab3d2314e205089855020ebc698bd7cf4f5f25d067b9563e4beb43820dd7282bcbef119af0da646970e2982a00866f98ea4b0e9a9c8dbcaa4fb8fd6ffb532473afd499bcf56ecc963ed65dd734356979b1d1ca75c9c084bd2e71a51a8191fc1b89c23247327c68c1bb54e221806cf6ee6cc607965e3dc0b96a33c40570a96c9ed56cdec6f593676f9509c068e5f8e3e132e4a30d69a10daa40c0e384a1cbfd312ed0069436e8a021ff74dd1137492651454f91122056f2bf01fcd9f1176e9af85c199c3422c426d1850884d2080348ca1806 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431 updroots.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
KB931125.exedescription pid process Token: SeRestorePrivilege 1272 KB931125.exe Token: SeRestorePrivilege 1272 KB931125.exe Token: SeRestorePrivilege 1272 KB931125.exe Token: SeRestorePrivilege 1272 KB931125.exe Token: SeRestorePrivilege 1272 KB931125.exe Token: SeRestorePrivilege 1272 KB931125.exe Token: SeRestorePrivilege 1272 KB931125.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
rundll32.exerundll32.exeKB931125.exedescription pid process target process PID 1380 wrote to memory of 1672 1380 rundll32.exe rundll32.exe PID 1380 wrote to memory of 1672 1380 rundll32.exe rundll32.exe PID 1380 wrote to memory of 1672 1380 rundll32.exe rundll32.exe PID 1380 wrote to memory of 1672 1380 rundll32.exe rundll32.exe PID 1380 wrote to memory of 1672 1380 rundll32.exe rundll32.exe PID 1380 wrote to memory of 1672 1380 rundll32.exe rundll32.exe PID 1380 wrote to memory of 1672 1380 rundll32.exe rundll32.exe PID 1672 wrote to memory of 1272 1672 rundll32.exe KB931125.exe PID 1672 wrote to memory of 1272 1672 rundll32.exe KB931125.exe PID 1672 wrote to memory of 1272 1672 rundll32.exe KB931125.exe PID 1672 wrote to memory of 1272 1672 rundll32.exe KB931125.exe PID 1672 wrote to memory of 1272 1672 rundll32.exe KB931125.exe PID 1672 wrote to memory of 1272 1672 rundll32.exe KB931125.exe PID 1672 wrote to memory of 1272 1672 rundll32.exe KB931125.exe PID 1272 wrote to memory of 1808 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 1808 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 1808 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 1808 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 1808 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 1808 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 1808 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 984 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 984 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 984 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 984 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 984 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 984 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 984 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 1940 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 1940 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 1940 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 1940 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 1940 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 1940 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 1940 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 1772 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 1772 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 1772 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 1772 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 1772 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 1772 1272 KB931125.exe updroots.exe PID 1272 wrote to memory of 1772 1272 KB931125.exe updroots.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1fd44f53bae4369a177295b93322f331112e67f7357e07ceef475a52f34918a0.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1fd44f53bae4369a177295b93322f331112e67f7357e07ceef475a52f34918a0.dll,#12⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{9DA0B2C1-0E67-42c3-BF0D-67C2079C818F}.tmp\KB931125.exe"C:\Users\Admin\AppData\Local\Temp\{9DA0B2C1-0E67-42c3-BF0D-67C2079C818F}.tmp\KB931125.exe"3⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst4⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\authroots.sstFilesize
73KB
MD5bb49ccc10926cdb601eba81afef749a2
SHA1a4766c9aea8d211e9632148fd4b625cece195be9
SHA256f013ee3b7fede9a95844e83e83ee298d38cba6efce5a5cafcd8b95255c32f86c
SHA51294c2809727039d1ed07a3742a4b2f9300e865ea7c49bc1fcf547a30238eeecc88d8dd06a2d4f3112317f948908b9af082b50f412a41a2bcb48d5e30d6d8ecbba
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\delroots.sstFilesize
9KB
MD57b32871e409608ff887b6cf4d87debb0
SHA1191f9ea1298ee52dbd6f977b3584109a064f57b9
SHA2563f01268547364d2d60a0f65b46757cccfd9225fc39d581846a8fbffdb5756ff2
SHA512534a384f7946db4083e639b8e02d83ac97293c60630b8811a84c85e0330e9c293f05f5cf71e0f3580551e7923bc5a3bfb7f0406432ca3cdb7efeb4a950ac5e8a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\roots.sstFilesize
7KB
MD59e5de0fd1f90486a66dee4bfe89a78d7
SHA190e3188ef63495aaa71c85d4ff0f23253c834b40
SHA2568b95ff56d61586582864d05563762615c8705779578dca3c98a303c3b1f4122e
SHA51260006fa6f57e4d280642d51055f85f8d27b913ce71373de5b928c515c77647295030ab73ab4a55024de4a40c18f200909f49ffb52c26cf554835fc3d4cc348f1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.sstFilesize
320KB
MD52d9b4498c847715418160bfd7e7c8a2d
SHA1e0873091d476d2566aa6fc988cb364247c95dc97
SHA256c49c05b701c390c679e5e3226ec621f22a08155b1065fcfc37b509f648f03b41
SHA512dcf3208cdd1e4353f82823f796d735c1209f149f183eea827a90753ec55509a1c460a16c120e07c12a5eacf0e67d2661c25638491ecf4403e25d6508983e519b
-
C:\Users\Admin\AppData\Local\Temp\{9DA0B2C1-0E67-42c3-BF0D-67C2079C818F}.tmp\KB931125.exeFilesize
349KB
MD54a4d72d34f9da1fc5019e0748fcde2f5
SHA1f54752ec63369522f37e545325519ee434cdf439
SHA25683b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca
SHA51295986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33
-
C:\Users\Admin\AppData\Local\Temp\{9DA0B2C1-0E67-42c3-BF0D-67C2079C818F}.tmp\KB931125.exeFilesize
349KB
MD54a4d72d34f9da1fc5019e0748fcde2f5
SHA1f54752ec63369522f37e545325519ee434cdf439
SHA25683b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca
SHA51295986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLLFilesize
89KB
MD5a64e4b204d44548eeb5c3d86eca2ad70
SHA1e3245bf6dbb2e56d71a9cbad2697aa4fa0df6bbe
SHA256985a5603ebf94539ac11549999f83b5e6dc008180994898c5daa6fd31ae1e9dc
SHA512dca4099318954bab5f1204645be0d0e8fea0c2e97ee95496fa884fbed627e376358623fa94c39bf0abe97d07d46a7e6c5e1081496cdd1987e07e595995a46cd5
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeFilesize
5KB
MD59c18ae971cbffb096952177f6804ea31
SHA1bb255dd1bd9bb39cdbb8671af66054432c686828
SHA2562703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
SHA51221086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c
-
\Users\Admin\AppData\Local\Temp\{1AAEF8E5-7DD3-4015-B02A-1AC6A9A232B3}.tmp\7z.dllFilesize
1.1MB
MD59d6512e7b271aec1511801a89ddce27a
SHA163ff62abf4095adc478f95431623e927d9934d22
SHA2563d1fd81def03c91a7beeed02c5dee630ab46481a87d6ccc4bdc9af5529b1315c
SHA512aa16d73794bdba1aef47fcb76cd0f6f3c55ea210f321c3a4b92952211f0aa05d6e3373a74cdebbc530fb5f558b85ae5793f4b7ecaf609fbf40b8b99b19a641f7
-
\Users\Admin\AppData\Local\Temp\{54A3E390-EDCE-408c-B16E-7B2426330649}.tmp\netcurl.dllFilesize
280KB
MD5eab9581c79c34a213984d0600def9762
SHA1f201daf147cf736be5e840bac1a465244d693dd4
SHA25699b8b0e5e5950fd079c63a1b9ce68da9cbd6056a2fad277c3bb8fa2749dc395a
SHA5123093f6a80da14d4bf3b48db5c1323fa10db05f88774e25091a18b250dc858702761a9d55fb4703d4282ff5459b450d71e3e5d7d129d53087db3621b452e48f04
-
\Users\Admin\AppData\Local\Temp\{9DA0B2C1-0E67-42c3-BF0D-67C2079C818F}.tmp\KB931125.exeFilesize
349KB
MD54a4d72d34f9da1fc5019e0748fcde2f5
SHA1f54752ec63369522f37e545325519ee434cdf439
SHA25683b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca
SHA51295986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33
-
\Users\Admin\AppData\Local\Temp\{9DA0B2C1-0E67-42c3-BF0D-67C2079C818F}.tmp\KB931125.exeFilesize
349KB
MD54a4d72d34f9da1fc5019e0748fcde2f5
SHA1f54752ec63369522f37e545325519ee434cdf439
SHA25683b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca
SHA51295986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33
-
memory/984-75-0x0000000000000000-mapping.dmp
-
memory/1272-59-0x0000000000000000-mapping.dmp
-
memory/1672-54-0x0000000000000000-mapping.dmp
-
memory/1672-55-0x00000000757A1000-0x00000000757A3000-memory.dmpFilesize
8KB
-
memory/1772-89-0x0000000000000000-mapping.dmp
-
memory/1808-67-0x0000000000000000-mapping.dmp
-
memory/1940-82-0x0000000000000000-mapping.dmp