e2f678ae963b89f6af695ca1897ebcf0574a4d4a18a07ed7644df37b7d8538ce

Analysis

max time kernel
52s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 05:53

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

2023-08-26_a97bbbee11c4aa5e3873d169dc93c812_magniber_JC.exe
Size

25.2MB
MD5

a97bbbee11c4aa5e3873d169dc93c812
SHA1

f553a4d28d1b5718ac1188b5022ffd640a9062d1
SHA256

e2f678ae963b89f6af695ca1897ebcf0574a4d4a18a07ed7644df37b7d8538ce
SHA512

20f47eb780641d86bb0966d817771dd183b9e57c0ad633f21badd46e9c064c08206e18f66ebde9d6774b41a6d70e9ca22c610e0f96f83296091b5ef7f458c5a2
SSDEEP

786432:Lrby/kC3lo7f9WKxFrWuPUY9s20qaOCdV6mfcLzvEEAu2:LrCloIK3Wu8n20WTlHAR

Score

8^/10

bootkit persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Version = "28,0,2195,0"	KB931125.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Locale = "*"	KB931125.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ComponentID = "Windows Roots Update"	KB931125.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}	KB931125.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ = "RootsUpdate"	KB931125.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\IsInstalled = "1"	KB931125.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	2023-08-26_a97bbbee11c4aa5e3873d169dc93c812_magniber_JC.exe

Executes dropped EXE 5 IoCs

pid	Process
1184	KB931125.exe
4148	updroots.exe
4708	updroots.exe
1100	updroots.exe
2772	updroots.exe

Loads dropped DLL 2 IoCs

pid	Process
3128	2023-08-26_a97bbbee11c4aa5e3873d169dc93c812_magniber_JC.exe
1184	KB931125.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2023-08-26_a97bbbee11c4aa5e3873d169dc93c812_magniber_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "108"	LogonUI.exe

Modifies system certificate store 2 TTPs 64 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B72FFF92D2CE43DE0A8D4C548C503726A81E2B93	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B31EB1B740E36C8402DADC37D44DF5D4674952F9\Blob = 53000000010000002400000030223020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c00b000000010000001000000045006e0074007200750073007400000009000000010000005e000000305c06082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030606082b0601050507030706082b0601050508020206082b06010505070308060a2b0601040182370a0304030000000100000014000000b31eb1b740e36c8402dadc37d44df5d4674952f92000000001000000950400003082049130820379a0030201020204456b5054300d06092a864886f70d01010505003081b0310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31393037060355040b13307777772e656e74727573742e6e65742f43505320697320696e636f72706f7261746564206279207265666572656e6365311f301d060355040b1316286329203230303620456e74727573742c20496e632e312d302b06035504031324456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479301e170d3036313132373230323334325a170d3236313132373230353334325a3081b0310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31393037060355040b13307777772e656e74727573742e6e65742f43505320697320696e636f72706f7261746564206279207265666572656e6365311f301d060355040b1316286329203230303620456e74727573742c20496e632e312d302b06035504031324456e747275737420526f6f742043657274696669636174696f6e20417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100b695b64342fac66d2a6f48df944c395705eec37911416836edecfe9a018fa13828fcf71046662e4d1e1ab11a4ec6d1c09588b0c9ff318b3303dbb7837b3e20845eedb25628a7f8e0b9407137c5cb470e972a68c022956215db47d9f5d02bff824bc9ad3ede4cdb9080503f098a8400ec300a3d18cdfbfd2a599a2395172c459e1f6e43796d0c5c98fe48a7c523475c5efd6ee71eb4f66845d186835ba28a8db1e32980fe257188adbebc8fac52964baa518de4133119e84e4d9fdbacb36ad5bc395471ca7a7a7f90dd7d1d80d981bb5926c211fee693e2f780e465fb34370e2980704daf38862e9e7f57af9e17aeeb1ccb28215fb61cd8e7a20422f9d3dad8cb0203010001a381b03081ad300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff302b0603551d1004243022800f32303036313132373230323334325a810f32303236313132373230353334325a301f0603551d230418301680146890e467a4a65380c78666a4f1f74b43fb84bd6d301d0603551d0e041604146890e467a4a65380c78666a4f1f74b43fb84bd6d301d06092a864886f67d0741000410300e1b0856372e313a342e3003020490300d06092a864886f70d0101050500038201010093d430b0d703202ad0f963e8910c0520a95f19ca7b724ed4b1dbd096fb545a192c0c08f7b2bc85a89d7f6d3b52b32adbe7d4848c63f60fcb260191506cf45f14e29374c0139e303a50e3b460c51cf022448d7147acc81ac9e99b9a006013ff707e5f114d491bb315527bc954dabf9d95af6b9ad89ee9f1e4438de211443abfafbd834273528baabba729cff5641c0a4dd1bcaaac9f2ad0ff7f7fda7deab1ed3025c184da34d25b788356ec9c36c326e211f667491d92ab8cfbebff7aee854aa75080f0a75c4a942e5f05993c5241e0cdb463cf0143ba9c83dc8f603bf35ab4b47baeda0b903875ef811d66d2f7577036b3bffc28af7125855b13fe1e7f5ab43c	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3E84D3BCC544C0F6FA19435C851F3F2FCBA8E814\Blob = 0b000000010000004600000053006b006100690074006d0065006e0069006e0069006f00200073006500720074006900660069006b006100760069006d006f002000630065006e0074007200610073000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703080300000001000000140000003e84d3bcc544c0f6fa19435c851f3f2fcba8e81420000000010000002f0600003082062b30820413a003020102021100be928318f3558a78a367591c6924093f300d06092a864886f70d01010505003074310b3009060355040613024c54312b3029060355040a1322536b6169746d656e696e696f20736572746966696b6176696d6f2063656e747261733120301e060355040b131743657274696669636174696f6e20417574686f72697479311630140603550403130d53534320526f6f742043412042301e170d3036313232373132323235305a170d3236313232353132303832365a3074310b3009060355040613024c54312b3029060355040a1322536b6169746d656e696e696f20736572746966696b6176696d6f2063656e747261733120301e060355040b131743657274696669636174696f6e20417574686f72697479311630140603550403130d53534320526f6f74204341204230820222300d06092a864886f70d01010105000382020f003082020a0282020100c1f355f547514e5517658db0b24128a14ad19f4bf673ff3ed2c94d593fe4b7c79f065dd83ca38884e0735dfd05eac78ed7a4046aeb9fbd43fd149246b8c5baaaed60ececca908d0a72a9419bd49dbcb06ca2111f64cbe71dd445670e096be578ecf13f0454f39a99c759d1d279a7a41ab07c49fc1c87545e7806d5dd1dcc85a04278d5d0b08aeae8f1a19e56efd3c17d87ace7da684f19d66fe093ad495c7314c1466a9df75840d957584e6c37f4722304f8db4ab0def141961240a1158b67b85e7856cb7fe4bec0496891b847089381c1b51b3106d3807bd145a1cf0c3d61f392f8f1b0150ef82e305b00a349f76dfeeedcbf88cff07d573eafc0d18aeb7cd26d3155fa848d736ada7080c4f4c2cf908e309ae1c635720108e63fe66600a3f2f8921dbc52ec8ff6dcf70aefbc1087f984188c5e1f03b8ff352f016ae5f05b627ce3b37f33aa94d74e5181b5e857788f2296a90c89543eb6eed9735f64f444e1f16a18ff5296c41cbf8997a4c3a7ca7e186e16dc138cbbd5b5250986aff62f45942a30c1149435f65dca25959cb15889b8b56085c9c6be1419a33ef95685abca6cd69979a24a146fc33ad8e766510ae91cfecc69e6346cf481db7da211f84cc48705163deb97743f6eec9cb9b6278c24df2db3afdd1361768ffff24ce00819303224325c368017ee86c9df2f51e256ae8392f0b3bdd8873a2c9ec4dc6999f9cb0203010001a381b73081b4300f0603551d130101ff040530030101ff303d0603551d20043630343032060b2b0601040181af650102003023302106082b060105050702011615687474703a2f2f7777772e7373632e6c742f63707330330603551d1f042c302a3028a026a0248622687474703a2f2f63726c2e7373632e6c742f726f6f742d622f636163726c2e63726c300e0603551d0f0101ff040403020106301d0603551d0e041604149c03f0a8d2987268aef2ede04fe2850eb2254ecf300d06092a864886f70d01010505000382020100ac5cbc2ffcae0124a6103eaca8e1a727998dca88c11d3d91f6a27ea5f19841ffaa61f809becd1a256174b4c3af425a090f9101be4895f4ca775e0b83ce849dcf40fd802cbde366350ab8b1fa60dae5d854b54b97baa21ac320698db446735caabfbd7bff1a30345840f92b600b7944f9f7a2960b6b527bf02b4b3bd28ba06b933dc957638a6bcc50138f77a851be1a4c2d4c5d0c905b8ef3ef50206d81e65149abc4e7d75d082b51fc3d4612e7d1a576c5532405c9aad38e58c5f38a749232edf02fddabade9d2358f7423e39900e28b30e4c342aef0bbe9e2081b4a702d7df8d29a27914270757a087ebe2f1c7f373da88bdc4672f5e86f3668fa6e8d209dd4f50771bfbd2742b97328d6ec49b405854f6848f6ab94df0ea3461460c231203beb2e5bded5a12c6de552fa815f9788c963bd01ece3cd6b0a35c2c938e30ef3581b7dda906db7f5c858569dae01df919dad5582030c1174049186c77c938cf327fbc524576e8bd91b989d8831f0af77b80db4cccff60a6f129bec092b5389ec44e0a1698ba87486741852e0d2bfa0a16521b908837af3a4f5f85e37254799a65dd7225adb936717db10e38cd11291478a95a547a103f84b2e21c59062b07f27a3db157f387f6c7f4e05c503b42ddf455f752c1df15fa6b5f6173941e9f865c21e5811ca7c8ee2b5ba920f67b78feb99d431fb727b5a985f9294c704ea30f6bb1a	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8D1784D537F3037DEC70FE578B519A99E610D7B0	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\912198EEF23DCAC40939312FEE97DD560BAE49B1	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\55C86F7414AC8BDD6814F4D86AF15F3710E104D0	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7F8A77836BDC6D068F8B0737FCC5725413068CA4	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\016897E1A0B8F2C3B134665C20A727B7A158E28F\Blob = 030000000100000014000000016897e1a0b8f2c3b134665c20a727b7a158e28f090000000100000036000000303406082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030c0b00000001000000740000004e00650074004c006f0063006b0020004d0069006e006f0073006900740065007400740020004b006f007a006a006500670079007a006f0069002000280043006c0061007300730020005100410029002000540061006e007500730069007400760061006e0079006b006900610064006f0000002000000001000000d5060000308206d1308205b9a00302010202017b300d06092a864886f70d01010505003081c9310b30090603550406130248553111300f06035504071308427564617065737431273025060355040a131e4e65744c6f636b2048616c6f7a617462697a746f6e73616769204b66742e311a3018060355040b131154616e7573697476616e796b6961646f6b31423040060355040313394e65744c6f636b204d696e6f736974657474204b6f7a6a6567797a6f692028436c617373205141292054616e7573697476616e796b6961646f311e301c06092a864886f70d010901160f696e666f406e65746c6f636b2e6875301e170d3033303333303031343731315a170d3232313231353031343731315a3081c9310b30090603550406130248553111300f06035504071308427564617065737431273025060355040a131e4e65744c6f636b2048616c6f7a617462697a746f6e73616769204b66742e311a3018060355040b131154616e7573697476616e796b6961646f6b31423040060355040313394e65744c6f636b204d696e6f736974657474204b6f7a6a6567797a6f692028436c617373205141292054616e7573697476616e796b6961646f311e301c06092a864886f70d010901160f696e666f406e65746c6f636b2e687530820122300d06092a864886f70d01010105000382010f003082010a0282010100c75225b2d83dd4845509a71bbd6cb914f48a02db76fc6a2a78abe577f06ee08c2367dba56499b9dd013e6fef2d9a3c22f05dc957a055417ff2435e5882533165ce1ef226ba00541eafb0bc1ce4528ca032afb737b1536768746750f62d2e64deae2679dfdf9986abab7f85eca0fb80ccf4b80c1e934563b9dcb85b9bed5b39d45f62b0a78e7c66382caab1086317677dccbdb3f1c33fcf5039edd1198315db87122796b7daeae59dbcbaea394f8bef749ae7c5d0d2ea86511ce4fe640828047905ebcac5710e0befabeaec1211a118053269d10c2c1a3d25993fb57cca6db0ae9999fa0860e719c2f2bd51d3ccd302acc1110c80ceabdc949d6ba339533ad685020300c57da38202c0308202bc30120603551d130101ff040830060101ff020104300e0603551d0f0101ff0404030201063082027506096086480186f842010d048202661682026246494759454c454d2120457a656e2074616e7573697476616e792061204e65744c6f636b204b66742e204d696e6f73697465747420537a6f6c67616c74617461736920537a6162616c797a61746162616e206c6569727420656c6a617261736f6b20616c61706a616e206b65737a756c742e2041206d696e6f73697465747420656c656b74726f6e696b757320616c6169726173206a6f67686174617320657276656e796573756c6573656e656b2c2076616c616d696e7420656c666f6761646173616e616b2066656c746574656c652061204d696e6f73697465747420537a6f6c67616c74617461736920537a6162616c797a617462616e2c20617a20416c74616c616e6f7320537a65727a6f646573692046656c746574656c656b62656e20656c6f69727420656c6c656e6f727a65736920656c6a61726173206d6567746574656c652e204120646f6b756d656e74756d6f6b206d656774616c616c6861746f6b20612068747470733a2f2f7777772e6e65746c6f636b2e68752f646f63732f2063696d656e2076616779206b65726865746f6b20617a20696e666f406e65746c6f636b2e6e657420652d6d61696c2063696d656e2e205741524e494e4721205468652069737375616e636520616e642074686520757365206f66207468697320636572746966696361746520617265207375626a65637420746f20746865204e65744c6f636b205175616c69666965642043505320617661696c61626c652061742068747470733a2f2f7777772e6e65746c6f636b2e68752f646f63732f206f7220627920652d6d61696c20617420696e666f406e65746c6f636b2e6e6574301d0603551d0e04160414096a621692b05abb550ecb75323a32e5b221c928300d06092a864886f70d01010505000382010100916a509cdb78819b3f8b42e33bfca6c3ee43e0cff3e2803549457602e2e32f05c5f12ae7c04133c6b69bd03339cdc0dba1ad6c37024c58413bf29792c648a8cde58a398961f95297e9bdf6f99474e8710ebc7786c306cc5a7c4a7e3450302efb7f329a8d3df3205bf86aca86f3314c2c5980027dfe38c930751cb755e3bc9fbaa86d84280575b38b0dc0915421e7a60bb499f55141dccda34722d9c70181c4dc474f26ea1feddbcd0d98f4a39cb473324a9699febc7fc82558f858f376668954a4a63ec4505cba891882754821d24f13e8607e0776db10b551e6aab968aacdf69d907512ea381aca44e8b799a72a68956695abadef89cb60a90612c69447e928	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E392512F0ACFF505DFF6DE067F7537E165EA574B\Blob = 030000000100000014000000e392512f0acff505dff6de067f7537e165ea574b09000000010000004a000000304806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030706082b06010505070306060a2b0601040182370a030406082b060105050703080b00000001000000580000004e00650074004c006f0063006b00200045007800700072006500730073007a002000280043006c006100730073002000430029002000540061006e007500730069007400760061006e0079006b006900610064006f0000002000000001000000530500003082054f308204b8a003020102020168300d06092a864886f70d010104050030819b310b30090603550406130248553111300f06035504071308427564617065737431273025060355040a131e4e65744c6f636b2048616c6f7a617462697a746f6e73616769204b66742e311a3018060355040b131154616e7573697476616e796b6961646f6b313430320603550403132b4e65744c6f636b20457870726573737a2028436c6173732043292054616e7573697476616e796b6961646f301e170d3939303232353134303831315a170d3139303232303134303831315a30819b310b30090603550406130248553111300f06035504071308427564617065737431273025060355040a131e4e65744c6f636b2048616c6f7a617462697a746f6e73616769204b66742e311a3018060355040b131154616e7573697476616e796b6961646f6b313430320603550403132b4e65744c6f636b20457870726573737a2028436c6173732043292054616e7573697476616e796b6961646f30819f300d06092a864886f70d010101050003818d0030818902818100ebecb06c618a2325af6020e3d99ffc930bdb5d8db0a1b3403a82cefd75e0783203865a869591ed53fa9d40fce6e8ddd95b7a03bd5df33b0cc351799bad55a0e9d00310af0aba1442d952261122c7d220cc82a49aa9feb881769d6ab7d236753eb18609f66e6d7e4eb77aecae7184f60433082532eb74ac1644c6e440931d7fad0203010001a382029f3082029b30120603551d130101ff040830060101ff020104300e0603551d0f0101ff040403020006301106096086480186f84201010404030200073082026006096086480186f842010d048202511682024d46494759454c454d2120457a656e2074616e7573697476616e792061204e65744c6f636b204b66742e20416c74616c616e6f7320537a6f6c67616c7461746173692046656c746574656c656962656e206c6569727420656c6a617261736f6b20616c61706a616e206b65737a756c742e204120686974656c65736974657320666f6c79616d617461742061204e65744c6f636b204b66742e207465726d656b66656c656c6f737365672d62697a746f73697461736120766564692e2041206469676974616c697320616c616972617320656c666f6761646173616e616b2066656c746574656c6520617a20656c6f69727420656c6c656e6f727a65736920656c6a61726173206d6567746574656c652e20417a20656c6a61726173206c656972617361206d656774616c616c6861746f2061204e65744c6f636b204b66742e20496e7465726e657420686f6e6c61706a616e20612068747470733a2f2f7777772e6e65746c6f636b2e6e65742f646f63732063696d656e2076616779206b65726865746f20617a20656c6c656e6f727a6573406e65746c6f636b2e6e657420652d6d61696c2063696d656e2e20494d504f5254414e5421205468652069737375616e636520616e642074686520757365206f662074686973206365727469666963617465206973207375626a65637420746f20746865204e65744c6f636b2043505320617661696c61626c652061742068747470733a2f2f7777772e6e65746c6f636b2e6e65742f646f6373206f7220627920652d6d61696c20617420637073406e65746c6f636b2e6e65742e300d06092a864886f70d01010405000381810010ad7fd70c32800ad886f17998b5add4cdb336c49648c15ccd9ad9052e9fbe50ebf42614102dd46617f89ec127fdf1ede47b4ba06cb5ab9a5770a6eda0a4ed2ef5fdfcbdfe4d37080cbce3968322f5491b7f4b2bb454c1807c994e1dd08ceed0ace592fa7556fe64a0138fb8b8169d61056780c8d0d8a507023498048d3304d4	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A399F76F0CBF4C9DA55E4AC24E8960984B2905B6\Blob = 030000000100000014000000a399f76f0cbf4c9da55e4ac24e8960984b2905b609000000010000000c000000300a06082b060105050703080b000000010000004000000054004300200054007200750073007400430065006e007400650072002000540069006d00650020005300740061006d00700069006e006700200043004100000020000000010000004703000030820343308202aca003020102020203f1300d06092a864886f70d01010405003081c1310b30090603550406130244453110300e0603550408130748616d627572673110300e0603550407130748616d62757267313a3038060355040a1331544320547275737443656e74657220666f7220536563757269747920696e2044617461204e6574776f726b7320476d624831283026060355040b131f544320547275737443656e7465722054696d65205374616d70696e67204341312830260603550403131f544320547275737443656e7465722054696d65205374616d70696e67204341301e170d3938303330393131353935395a170d3131303130313131353935395a3081c1310b30090603550406130244453110300e0603550408130748616d627572673110300e0603550407130748616d62757267313a3038060355040a1331544320547275737443656e74657220666f7220536563757269747920696e2044617461204e6574776f726b7320476d624831283026060355040b131f544320547275737443656e7465722054696d65205374616d70696e67204341312830260603550403131f544320547275737443656e7465722054696d65205374616d70696e6720434130819f300d06092a864886f70d010101050003818d0030818902818100b64be4366a9c038ce9196fbe87f9f7308c3e2f184d54dee8cc2c083d7c462f840c9debeffb119463e7ecb4cd13fd9af63065c58a7dc882d1a3bd117b1e7ebf2fdc6781045b704beae1b3b6983db5be70d33e795d0b3798588ac3fa99288f0104631e807f7772c45d7fff4f57ffaac9567743adfc16376a382f74411937a7ffc30203010001a3483046300f0603551d130101ff040530030101ff303306096086480186f842010804261624687474703a2f2f7777772e747275737463656e7465722e64652f67756964656c696e6573300d06092a864886f70d0101040500038181002eac8fb619a0a48c5e01bb0969d62e05fb762b6935d7c86f06a81bf2d55f0bcc4bf3c153f495bf9c8e6cb35f7b0bc6e69ca7d02c033ed539e19c6eeb41f8c96443b83da24ae11e4f8592d71b476e3f17daafec163e8e1a892d4189d6692f43aa5d2ef2e8d054ee0d16c5da70d8127444ae164b74ed8c0bab350a4868ec690329	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B172B1A56D95F91FE50287E14D37EA6A4463768A\Blob = 030000000100000014000000b172b1a56d95f91fe50287e14d37ea6a4463768a090000000100000016000000301406082b0601050507030406082b060105050703020b000000010000001400000055005300450052005400720075007300740000002000000001000000a6040000308204a23082038aa003020102021044be0c8b500024b411d336252567c989300d06092a864886f70d01010505003081ae310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d313630340603550403132d55544e2d5553455246697273742d436c69656e742041757468656e7469636174696f6e20616e6420456d61696c301e170d3939303730393137323835305a170d3139303730393137333635385a3081ae310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d313630340603550403132d55544e2d5553455246697273742d436c69656e742041757468656e7469636174696f6e20616e6420456d61696c30820122300d06092a864886f70d01010105000382010f003082010a0282010100b23985a4f27dab413b624637aecdc16075bc3965f94a1a47a2b9cc48cc6a98d54d3519b9a442e5ce49e28a2f1e7cd23107c74eb483649d2e29d5a264c485bd85513579a44e68907b1c7aa492a817f29815f293ccc9a43295bb0c4f30bd98a00b8be56e1ba246fa78bca26fab595ea52fcfcada6daa2febaca1b36aaab72e67358b79e11e6988e2e646cda0a5eabe0bce763a7a0e9beafcda275b3d731f22e64861c64cf369b1a82e1bb6d431202cbc828a8ea40ea5d78943fc165aaf1d71d71159daba870daffaf3e1c2f0a4c5678cd6d6543ade0aa4ba0377b365c8fd1ed37462aa18ca68931ea1857ef54765cbf84d572874d234ff30b6eef66230148c2ceb0203010001a381b93081b6300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e041604148982677dc49d2670004bb450487cde3dae046e7d30580603551d1f0451304f304da04ba0498647687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d436c69656e7441757468656e7469636174696f6e616e64456d61696c2e63726c301d0603551d250416301406082b0601050507030206082b06010505070304300d06092a864886f70d01010505000382010100b16d615da61a7f7cab4ae430fc536f2524c6caede2315c2b0eeeee61556f043ecf39dec51b4994e4eb204cb4e69e502e72d98df5aaa3b34ada561c609780dc82a2ad4abd8a2bff0b09b4c6d7200445e4cd8001baba2b6eceaad792fee4afebf4261d162a7f6c3095372f3312ac7fddc7d1118c5198b2d0a391d0adf69f9e83931e1d42b846af6b66f09b7feae30302e50251c1aad5359d72400389ba311dc51068529edfa285c55c08a678e6534fb1e8b7d3149e93a6c364e3ac7e71cdbc9fe9031bccfbe9ac31c1af7c15740299c3b247a6c23261d7c76f48245127a1d58755f27b8f983d169eee75b6f8d08ef2f3c6ae285ba7f0f33617fcc305d3ca034a54	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\23E833233E7D0CC92B7C4279AC19C2F474D604CA\Blob = 03000000010000001400000023e833233e7d0cc92b7c4279ac19c2f474d604ca090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703080b000000010000004600000053006b006100690074006d0065006e0069006e0069006f00200073006500720074006900660069006b006100760069006d006f002000630065006e007400720061007300000020000000010000002e0600003082062a30820412a003020102021034b9129facc79255425cde57ffe3c005300d06092a864886f70d01010505003074310b3009060355040613024c54312b3029060355040a1322536b6169746d656e696e696f20736572746966696b6176696d6f2063656e747261733120301e060355040b131743657274696669636174696f6e20417574686f72697479311630140603550403130d53534320526f6f742043412043301e170d3036313232373132323633305a170d3236313232323132313133305a3074310b3009060355040613024c54312b3029060355040a1322536b6169746d656e696e696f20736572746966696b6176696d6f2063656e747261733120301e060355040b131743657274696669636174696f6e20417574686f72697479311630140603550403130d53534320526f6f74204341204330820222300d06092a864886f70d01010105000382020f003082020a0282020100a14522fa8ccca96f04b3f468321669114f79df43bd5160701a98dd7878969862f7704b81a8e01d0489f48feb6ee9f0ff81d82e7daf1720f122eff03f454740b4cbb2b8203f3e4a6850ff9a06d797c5b78a162e71d247735d18652fef3933e8b655af26ad0280e963d72170073eccbe5f89c0f8ce1d256ec3fc7f563961d18ec2267ae778020a59dd5523b0f835a7e2abf3ab2fd7b58b0a2a72542b6d79bcf2d9e943f9cff18e6612f797592ad9d794dcf894b345a3af162db380ca3dcee8a6c70a9474fc379ae93f0c37162043c94770bb8c85fc988929cb87197e195310898075ae13f1bfa45d3005297ca8f7b65e07301588ae4d15a0cacdd7ffaba306570fa7e389691cd61ad1d427df96c6385caf77fe15ab44417dd398bba82018af8b6dd45ac2d8968d48f507317e61f4619b5281408e4a2704b207d3021094f3fbddb17b70b8b4c881f50007a68d88054dc48f96ced4b6c0c1668c2aac684ac946dc0de62ea879287d774370167e1c1a3aa6794f134089b132bb0946110d74bc27e5d8ed2dfa5029dc25ca9710e7a9a2612e3a89a64461be4f5e9209eddc2ea6ef53bb6125d827a5144629852600d8f9f905d57b163142430517919c4a6040246db56d7a79fb9c9a63c39869e57762232a51890f6cb2fdc3cad8f41a4394d07d0be1583e1ac874849bf7ac82ae514592d20659e1b3c1dea51f932279d8cdc4796023950203010001a381b73081b4300f0603551d130101ff040530030101ff303d0603551d20043630343032060b2b0601040181af650102003023302106082b060105050702011615687474703a2f2f7777772e7373632e6c742f63707330330603551d1f042c302a3028a026a0248622687474703a2f2f63726c2e7373632e6c742f726f6f742d632f636163726c2e63726c300e0603551d0f0101ff040403020106301d0603551d0e04160414880773f6f1bc521a5a1d3d9162ed5dac9d0be5b7300d06092a864886f70d010105050003820201001f90715098d5d934d2968418c2ac4602201ccb39b1b7af05a4d758f391517d8e81279ce892b1e71c9f3a8b1052734cc2c7421dd0ebde2aca22517d8c747a1afcbca4f373c86623c42e431047e08a6957ee2ff20052b03092aad6d415c557cb607af40e8dfe1e0963748fe0febe50d9013956ba504cf6e3459abb5276de7e9dfb8dc254313ec7b13c3edfe34ffddd9b24697cede871b64206c71fc55ffb2075dbc1fde96ca22a90d486fdcd0dffe0058a58613d9fc4992feddb7cc40d9898559c74a2175edbaa11e4370c24ff2067d125db9a89a06588319104715f20945833361d32de6fd76708a9a03bfddba45025961ea95f8917a59799519569dbc4f18ff46f302b59f3ac7587337d06dde1c16bd6c4c95e70447a6ac79c773b16fefe75be9f2cd1c003ee117975eca95b1c7a85b5285020a91a1de67b8c3318ffc1edc876651f1df04c3ba7dbeacd56d894573fe048a97f8c334bbdf40c65148082f43577d8041070ce0f6cc159cb99ad81eede3d48d07a882f4093d79cba7984188075dfd05adf51773e588969754731e46a16705404ecbd5c795363d2e25ebd4d25da11b60faae92caef5d1a98d0256cbfcb024ea8cba70ff32d0b7c6042a63d5ca4691d5997209075e2803ab121c25b36c3a5965b4746d2d2d19726ffde79811871e7323bf35f19bb6c3d9cc3b507c72e8cf5ec098cc2e03fd1f2fca745cb11cd1ec69	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AE5083ED7CF45CBC8F61C621FE685D794221156E	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6631BF9EF74F9EB6C9D5A60CBA6ABED1F7BDEF7B\Blob = 0300000001000000140000006631bf9ef74f9eb6c9d5a60cba6abed1f7bdef7b090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b000000010000000e00000043004f004d004f0044004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c02000000001000000210400003082041d30820305a00302010202104e812d8a8265e00b02ee3e350246e53d300d06092a864886f70d0101050500308181310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312730250603550403131e434f4d4f444f2043657274696669636174696f6e20417574686f72697479301e170d3036313230313030303030305a170d3239313233313233353935395a308181310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312730250603550403131e434f4d4f444f2043657274696669636174696f6e20417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d0408b8b72e3911bf751c11b540498d3a9bfc1e68a5d3b87fbbb88ce0de32f3f0696f0a2295099aedb3ba157b0745171cded42914d41fea9c8d86a867744bb596697505eb4d42c7044cfda379542693c30c471b352f0214da1d8ba397c1c9ea3249df2831698aa167c439b155bb7ae3491fed4622618469a3febc1f9f19057ebac7a0d8bdb72306a66d5e046a370dc68d9ff04488977deb5e9fb676d41e9bc39bd32d96202f1b1a83d6e379ce22fe2d3a2268bc6b8554388e1233ea5d224396a47ab00d4a1b3a925fe0d3fa71dbad351c10ba4daac38ef55502405654693344f2d8dadc6d42119d28eca056171077347e58a1912bd044dce4e9ca548acbb26f70203010001a3818e30818b301d0603551d0e041604140b58e58bc64c1537a440a930a921be47365a56ff300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff30490603551d1f04423040303ea03ca03a8638687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f43657274696669636174696f6e417574686f726974792e63726c300d06092a864886f70d010105050003820101003e989e9bf61be9d739b778ae1d721849d387e44382eb3fc9aaf5a8b5ef557c215265f9d50de16cf43e8c9373912e02c44e07716fc08f386108a81e810ac02f202f418b91dc4845bcf1c6deba766b33c8002d31464cede79dcf8894ff33c056e8248626b8d83838df2a6bdd12ccc73f47174ca2c2069609d6dbfe3f3c4641df58e2560f3c3bc11c9335d93852aceec8ec2e304e9435b4241f4b7869daf20238cc955293f07025599c2067c4eef98b5761f492767d3f848d55b7e8e5acd5f1f51956a65afb901caf93ebe51cd467975d040ebe0b83a61783b93012a0c5331505b90dfbc70576e3d84a8dfc3417a3c62128be3045311ec778be586138ac3be20165	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9ED18028FB1E8A9701480A7890A59ACD73DFF871	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0483ED3399AC3608058722EDBC5E4600E3BEF9D7	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\68ED18B309CD5291C0D3357C1D1141BF883866B1	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A\Blob = 030000000100000014000000627f8d7827656399d27d7f9044c9feb3f33efa9a090000000100000016000000301406082b0601050507030106082b060105050703030b000000010000000e000000740068006100770074006500000053000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c020000000010000002b0300003082032730820290a003020102020101300d06092a864886f70d01010405003081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d301e170d3936303830313030303030305a170d3230313233313233353935395a3081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d236366a8bd7c25b9eda8141628f38ee490455d6d0ef1c1b951647ef1848353a52f42b6a068f3b2fea56e3af868d9e17f79eb46575024defcb09a22151d89bd067d0ba0d92061473d493cb972a009c5c4e0cbcfa1552fcf2446eda114a6e089f2f2de3f9aa3a8673b6465358c88905bd8311b8733faa078df4424de7409d1c370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010405000381810026482c16c258fae816740caaaa5f543ff2d7c978605e5e6e37632277367eb217c434b9f50885fcc90138ff4dbef2164243e7bb5a46fbc1c6111ff14ab02846c9c3c4427dbcfaab596ed5b7518811e3a485196b824ca40c12ade9a4ae3ff1c349659a8cc5c83e25b79499bb92327107f0865eed5027a60da623f9bbcba6071442	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B8236B002F1D16865301556C11A437CAEBFFC3BB\Blob = 030000000100000014000000b8236b002f1d16865301556c11a437caebffc3bb090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b0000000100000018000000410066006600690072006d0054007200750073007400000053000000010000002400000030223020060a2b06010401828f09020430123010060a2b0601040182373c0101030200c0200000000100000002020000308201fe30820185a00302010202087497258ac73f7a54300a06082a8648ce3d0403033045310b300906035504061302555331143012060355040a0c0b41666669726d54727573743120301e06035504030c1741666669726d5472757374205072656d69756d20454343301e170d3130303132393134323032345a170d3430313233313134323032345a3045310b300906035504061302555331143012060355040a0c0b41666669726d54727573743120301e06035504030c1741666669726d5472757374205072656d69756d204543433076301006072a8648ce3d020106052b81040022036200040d305e1b159d03d0a17935b73a3c927aca151ccd62f39c265c073de554faa3d6cc12eaf4145fe88e19ab2f2e48e6ac184378acd037c3bdb2cd2ce647e21ae663b83d2e2f78c44fdbf40fa4684c55726b951d4e18429578cc373c91e29b652b29a3423040301d0603551d0e041604149aaf297ac011353526513000c36afe40d5aed63c300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106300a06082a8648ce3d040303036700306402301709f38788505aafc8c042bf475ff56c6a86e0c42774e43853d7057f1b34e3c62fb3ca093c379dd7e7b846f1fda1e271023042598743d451dfbad309325ace887e573d9c5f426bf5072db5f08293f9596fae64fa58e58b1ee363beb581cd6f028c79	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F555CE20DCD3364E0DC7C41EFDD40F50356C122	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\99A69BE61AFE886B4D2B82007CB854FC317E1539	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\90AEA26985FF14804C434952ECE9608477AF556F\Blob = 03000000010000001400000090aea26985ff14804c434952ece9608477af556f090000000100000016000000301406082b0601050507030406082b060105050703020b000000010000001200000056006500720069005300690067006e0000002000000001000000410200003082023d308201a6021100cdba7f56f0dfe4bc54fe22acb372aa55300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732031205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830313233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732031205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100e519bf6da356612d994871f667deb98debb79e86800a910efa3825af468882e573a8a09b245d0d1fcc656e0cb0d0568418879a069b10a173dfb458396b6ec1f615d5a8a83faa12068d31ac7fb034d78f34678809cd1411e24e4556691f780280dadc479129bb36c9635cc5e0d72d877ba1b732b07b30ba2a2f31aaeea367dadb0203010001300d06092a864886f70d0101020500038181004c3fb88bc668dfee43330e5de9a6cb07844d7a33ff921bf436add895223668116c7c42ccf39c2ec4073f14b00f4fff909276f9e2bc4ae98fcda0800af7c529f182225db8b1dd8123a37b251546307916f8ea054b947f1dc21cc8e3b7f410403c13c35f1f53e848e486b47ba135b07b25bab8d38eab3f389d00340098f3d17194	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0CFD83DBAE44B9A0C8F676F3B570650B94B69DBF	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\56E0FAC03B8F18235518E5D311CAE8C24331AB66	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\209900B63D955728140CD13622D8C687A4EB0085	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\67EB337B684CEB0EC2B0760AB488278CDD9597DD	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\EDB3CB5FB419A185066267E5791554E1E28B6399	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\216B2A29E62A00CE820146D8244141B92511B279\Blob = 030000000100000014000000216b2a29e62a00ce820146d8244141b92511b279090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000003a000000430065007200740050006c0075007300200043006c0061007300730020003300500020005000720069006d006100720079002000430041000000200000000100000099030000308203953082027da003020102021100bf5cdbb6f21c6ec04deb7a023b36e879300d06092a864886f70d0101050500303e310b30090603550406130246523111300f060355040a130843657274706c7573311c301a06035504031313436c617373203350205072696d617279204341301e170d3939303730373137313030305a170d3139303730363233353935395a303e310b30090603550406130246523111300f060355040a130843657274706c7573311c301a06035504031313436c617373203350205072696d61727920434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ab37ffeb609b417869f54958b0de1f7169a62be3ae50c6a9bc93e920bee4c4138256eff0433209ca9b75038f7c4fe1e04f769e0bad647a143a9a9dbf2f160b651ca9ee9cbce31a65cb4f85ea92567566d65540effbccd6383fab1cef428d1989f6b79586c2a71de9f729f12ad96579fc2bf58eca1a777e9ee8acf966bf45fbe8139d5fb673e57d7b8efb12745d1f065e851ba65e184400babcd36ed1520e06adebeeb5b4c1bbbceb380f482291c76fd2b8723bba7fc08d6cb7bc4773212a85ffacd628a219d5976a3ab9ac6d45ece64dc3dba85dc55d8298ac4a5aaae62b080c1074bc62f63a490466d8511c26a6d8759f9cbfae60513d5cbca24f7b8967cd530203010001a3818d30818a300f0603551d13040830060101ff02010a300b0603551d0f040403020106301d0603551d0e0416041486e1e18171bf6a12f10af201e4c8fb40ce688089301106096086480186f842010104040302000130380603551d1f0431302f302da02ba0298627687474703a2f2f7777772e63657274706c75732e636f6d2f43524c2f636c61737333502e63726c300d06092a864886f70d0101050500038201010025aae12240c2a4803cb7a25d998d1f7a423538661711dfbdaffc1511981933e605428454a84bebb09ddb37da165240117468bfe9c9b21084b71d440079271cf5580617183235b6309763c6a6391bc8ee461762c52ee70aa39a8a306373aa14a54d0aa87293f0491110907c187da82005c4c27a35ba1c5a0ae02e78c888b1cf5701ec3de2061334c0a8dcfa808005ee0576bd9d2bc89d506f6bc5405084fd5d1de6909c10d3a4c6b9281adeb5f80a70aacede503d0380dbd888c54806e40373dd16ce36d6e59bea77dab296b565a7045d23aef793b25e8a51645fdacf8c3d415bdef9a3e92a7c47101ff6323c7e70e9dfa1d52e0db11a45b4bc12ed2817e91e02	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4054DA6F1C3F4074ACED0FECCDDB79D153FB901D\Blob = 0b000000010000001e000000440053005400200041004300450053002000430041002000580036000000090000000100000016000000301406082b0601050507030406082b060105050703010300000001000000140000004054da6f1c3f4074aced0feccddb79d153fb901d20000000010000000d04000030820409308202f1a00302010202100d5e990ad69db778ecd807563b8615d9300d06092a864886f70d0101050500305b310b30090603550406130255533120301e060355040a13174469676974616c205369676e61747572652054727573743111300f060355040b13084453542041434553311730150603550403130e4453542041434553204341205836301e170d3033313132303231313935385a170d3137313132303231313935385a305b310b30090603550406130255533120301e060355040a13174469676974616c205369676e61747572652054727573743111300f060355040b13084453542041434553311730150603550403130e445354204143455320434120583630820122300d06092a864886f70d01010105000382010f003082010a0282010100b93df52cc994dc758a955d63e884777666b959915c46dd923e9ff90e03b43d6192bd2326b563ee92d29ed63cc80d905f6481b1a8080d4cd8f9d3052852b40125c5951c0c7e3e108475cfc1199163cfe8a89188b94352bb80b155898b31fad0b776be413d309aa422251773e81ee2d3ac2abd5b3821d52a4bd7557de33a55bdd76d6b02576be6477c08c882badea7873da16db83056c2b302815f2df5e29a301828b866d3cb01966fea8a4555d6e09dff672b1702a64e1a6a110b7eb77be798d68c766fc13bdb50937ee5d08e1f37b8bdbac69f6ce97c33f2323c2647fa272402c97e1d5b8842136a357c7d35e92e66917293d53226c474f553a3b35d9af609cb0203010001a381c83081c5300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201c6301f0603551d11041830168114706b692d6f70734074727573746473742e636f6d30620603551d20045b30593057060a608648016503020101013049304706082b06010505070201163b687474703a2f2f7777772e74727573746473742e636f6d2f6365727469666963617465732f706f6c6963792f414345532d696e6465782e68746d6c301d0603551d0e041604140972064e18430fe5d6ccc36a8b317b788fa883b8300d06092a864886f70d01010505000382010100a3d88ed6b2dbce05e732cd01d30403e576e4562b9c9990e808306cdf7d3deee5bfb524408449e1d128aec4c23a533088f1f5776e51cafaff99af245f1ba0fdf2ac84cadfa9f05f042ead16bf219710813de3ff878d32dc94e5478a5e6a13c994953dd2eec83495d080d4ad320880543ce0bd5253d7527cb2693f7f7acf6a74cafa042a9c4c5a06a5e920ad45660f69f1ddbfe9e3328bfae0c1864d723c2ed893780a2af8d8d2273d19895f5a7b8a3bcc0cda51aec70bf72bb03705ecbc5723e238d29b68f35612884f427cb831c4b5dbe4c82134e9481135eefac79257c59f34e4c7f6f70e0b4c9c68787b7131c7eb1ee06741f3b7a0a7cde57a33366afa9a2b	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\68ED18B309CD5291C0D3357C1D1141BF883866B1\Blob = 0b000000010000002000000058006300650072007400200045005a0020006200790020004400530054000000090000000100000016000000301406082b0601050507030406082b0601050507030103000000010000001400000068ed18b309cd5291c0d3357c1d1141bf883866b12000000001000000fc030000308203f8308202e0a003020102021100d01e40900000274b0000000100000004300d06092a864886f70d010105050030818c310b3009060355040613025553310d300b0603550408130455746168311730150603550407130e53616c74204c616b65204369747931183016060355040a130f586365727420455a20627920445354311830160603550403130f586365727420455a206279204453543121301f06092a864886f70d010901161263614064696773696774727573742e636f6d301e170d3939303731343136313431385a170d3039303731313136313431385a30818c310b3009060355040613025553310d300b0603550408130455746168311730150603550407130e53616c74204c616b65204369747931183016060355040a130f586365727420455a20627920445354311830160603550403130f586365727420455a206279204453543121301f06092a864886f70d010901161263614064696773696774727573742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100ad5418deb4bff7ade874aaed8b7c8fc2d4751ad584b9b662fc89efe4976192fb1db8e15a47349e9e0622fbd3ea38cbb88b07f71aa01777075a301cd4293820d72740d8509343bfd218a229760572aa6bb66998ab791e1c65f56a8bfcc516aaa272da60ed4e6e19257a0a1d30e3509b423c44eba1b0201edb027efe3d1fbfd0008adb4076a618a515a757b652c2011798778f8a81c61ab46a2ae6afa9d600accfd815497cdb1ba1fe81fa87f9d390c102c0f9d042e99168255fc6bf8739e995006028bf832cc0e75eb6d73616e7608776e8e727b2250d8b7ae5aa1de559cdce0b0e6fc6c89ce310d98539d3b79bfac6ba7c74d25d7556ab74a4a251bf527cee710203010001a3533051300f0603551d130101ff040530030101ff301f0603551d2304183016801408206c66eb810a6c5cd5b5a63c41dd1c96912777301d0603551d0e0416041408206c66eb810a6c5cd5b5a63c41dd1c96912777300d06092a864886f70d010105050003820101005a87588f2dab76216b540cd9f141f64ecd2b9ee31f9ba32d7fd92b7d58c867a429f5e9ecd5bd963fa373f8c45b367cd0632c34399b48b83d6ff614c59e63e6a7346ed3e833b3c73c186e23ae4392993f98c56930f1363badb93082d6b6591696020b291261b41189f70c2f94908598289c536c7e63dd73f419ff4a81d1b25223fd3c4a34ce5a1be0508aed4f8195d860e7e4c40dbb583e58f74e686f3e67c9cb7a971627ec42611476bb00c5eb083d157f4bb6225d873b90f4f3c0fe37b3e9d9620cc0c359af60bd1f0ddba1341f30c43d8badb01d0493ed5fd5e4bf203004f448e93301d12e902752b39bde3a1caba9977f9bebc28dc26decdc13d346c5797c	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DA40188B9189A3EDEEAEDA97FE2F9DF5B7D18A41	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B31EB1B740E36C8402DADC37D44DF5D4674952F9	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C18211328A92B3B23809B9B5E2740A07FB12EB5E\Blob = 0b000000010000001800000045002d0043006500720074006300680069006c0065000000090000000100000016000000301406082b0601050507030106082b06010505070302030000000100000014000000c18211328a92b3b23809b9b5e2740a07fb12eb5e20000000010000000d08000030820809308205f1a003020102021067d6b6ddd44b1eaa4bec947872359766300d06092a864886f70d01010505003081b1310b300906035504061302434c311d301b06035504081314526567696f6e204d6574726f706f6c6974616e613111300f0603550407130853616e746961676f31143012060355040a130b452d434552544348494c453120301e060355040b13174175746f726964616420436572746966696361646f7261311f301d06092a864886f70d010901161073636c69656e746573406363732e636c311730150603550403130e452d4345525420524f4f54204341301e170d3038303930353139333430385a170d3238303930353139333934315a3081b1310b300906035504061302434c311d301b06035504081314526567696f6e204d6574726f706f6c6974616e613111300f0603550407130853616e746961676f31143012060355040a130b452d434552544348494c453120301e060355040b13174175746f726964616420436572746966696361646f7261311f301d06092a864886f70d010901161073636c69656e746573406363732e636c311730150603550403130e452d4345525420524f4f5420434130820222300d06092a864886f70d01010105000382020f003082020a0282020100a4808725db9552ec183f3e212f94819da7231ac36a4e465e9ad8277ff4a4f118b0bd944cd48afb448845c45e27997e636a84125471d7593bb8a8124eb1a72de0e27c4714cdb570b46294c762a3fb6d953a665cea7eca8cfeea1f63f5c95beb409d84d833a8dd81ac7efbe8b899bb927964ff0a6f83378dde2bad0f0dbbe7c361fdb04ab31ae010e61d150c375d8bdfbc3d2bf2ed8a01a4404bfd426819146334355bc5446bcc50989c9eed6bddeb07433b1d6c0b047fcee2bc62bad33ecb4b14226c3bb456f4ba27db21450fbe16959254b5f1f917a7e7ed87c19dd692b7ac618d177650761e5133ce6f7e242b8e146fcd7cc4ad63709ed2ceee3c57c61a9440055d638e25d79163e2c6625a1fd0ecf7d4df0f4d56cd5ac58d27aa76838e661a1c95e3f982969ea213544dd6d6520eec438641ff54469e9435a46010b604cb98d9f67c7debb3a103e9d8b942df6f60266e47f08913e5812c07fbfd56d8fbd869ee3e87a9f98cf2f295d17cc88a9dc3c4c134d323e50b38ac7216dac3f4e6729b949b2d3f53b75db1dc6410238939c6c78e857b7f7c34988536f1bac7898722e2f23ea9e01de72b3063ac7455f7e032c9e32e6e8915be2c51d8100a78a9cf3a0d37e982920a9587e7033c4e7bdbe8e6720808d9ff9d3bd9a3f7f2f215109d394ef72e7325cbedbf5330d57fff19f7175d542a364856cf35eb74acd4a2c6ba38510203010001a382021930820215300e0603551d0f0101ff040403020106301306092b060104018237140204061e0400430041300f0603551d130101ff040530030101ff301d0603551d0e0416041450dd82d188922d8f3ce9ba5dc76266e26f7bab20308201130603551d1f0482010a3082010630820102a081ffa081fc8681ba6c6461703a2f2f2f434e3d452d43455254253230524f4f5425323043412c434e3d706b692d726f6f742c434e3d4344502c434e3d5075626c69632532304b657925323053657276696365732c434e3d53657276696365732c434e3d436f6e66696775726174696f6e2c44433d6563657274706b692c44433d636c3f63657274696669636174655265766f636174696f6e4c6973743f626173653f6f626a656374436c6173733d63524c446973747269627574696f6e506f696e74863d687474703a2f2f706b692d726f6f742e6563657274706b692e636c2f43657274456e726f6c6c2f452d43455254253230524f4f5425323043412e63726c301006092b0601040182371501040302010030620603551d20045b3059305706082b06010401c35205304b304906082b06010505070201163d687474703a2f2f7777772e652d636572746368696c652e636c2f68746d6c2f70726f647563746f732f646f776e6c6f61642f43505376312e372e70646630310603551d25042a302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070308300d06092a864886f70d010105050003820201007583953f21ed74792ededb1e76f221c2db9660be9bb0c54e0b572e4928a2b6c3a62e50048b004ca9b37285a4e6746f426fd29bd43ff8d4e8316b573e81cbb186ceb07ed9d8e3edeee004d77470ad551731b1bc1405579952a2e77bc3eedb4ab3b3faeca743b4c213565f0a32d10d5855e0303f640704aacf6f0b29afed891d1cc0e695031981b7b170ece17a7d383a53c5dcd2b9ea8229f14dae5dd9e8c59da84624690b6a29291aa9cd2fdce2e98319e27369ebeaf2d6d76816195eca62eb4a0b8f0456f5ee955d1211e30d50a0cdf4eb617ea820a2c4523731e7a6853063dfb64a298e5888cfb57558685c9bd23f1286aca6938d8793f73118a957d2ce37a517455f673e82dbe53a6f0a989206bf605d3a84a445124350401c569425fda7520a6c2dc4e8a0cd7142e4350ba85189a4f98708f81d08faae0e9d02bd2d7f596e1d0182a3897063b461ae63243574204dc0d71872e9ac2caf9951836ea37b17d8fc7215f3c711c44b41b472c470ff585121a1e12b6365e57490a26dc2ff917dad4f07372518aa9f9c2d1c28764edf82aece426e06923cbb877171a1ee341fec0d0e17f5a7f85afa66e47de7d1e882316547bb729f5495e4479a204cfaf81a45c968cb44986eec992d105dcbd8ecfb0a5449a58f30d3df8613d0543fee24b3a127fc20ef78e391b9d896f244ba6e5f8909ca7a274efbf98cacc117b75889ff763e	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\06083F593F15A104A069A46BA903D006B7970991\Blob = 0b00000001000000520000004e00650074004c006f0063006b0020004100720061006e0079002000280043006c00610073007300200047006f006c0064002900200046005101740061006e00fa007300ed0074007600e1006e0079000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030703000000010000001400000006083f593f15a104a069a46ba903d006b797099120000000010000001904000030820415308202fda003020102020649412ce40010300d06092a864886f70d01010b05003081a7310b30090603550406130248553111300f06035504070c08427564617065737431153013060355040a0c0c4e65744c6f636b204b66742e31373035060355040b0c2e54616ec3ba73c3ad7476c3a16e796b696164c3b36b202843657274696669636174696f6e205365727669636573293135303306035504030c2c4e65744c6f636b204172616e792028436c61737320476f6c64292046c59174616ec3ba73c3ad7476c3a16e79301e170d3038313231313135303832315a170d3238313230363135303832315a3081a7310b30090603550406130248553111300f06035504070c08427564617065737431153013060355040a0c0c4e65744c6f636b204b66742e31373035060355040b0c2e54616ec3ba73c3ad7476c3a16e796b696164c3b36b202843657274696669636174696f6e205365727669636573293135303306035504030c2c4e65744c6f636b204172616e792028436c61737320476f6c64292046c59174616ec3ba73c3ad7476c3a16e7930820122300d06092a864886f70d01010105000382010f003082010a0282010100c4245e73be4b6d14c3a1f4e397906ed230451e3cee67d964e01a8a7fca30ca83e320c1e3f43ad3945f1a7c5b6dbf304f8427f69f1f49bcc6990a90f20ff57f43843763518b7aa570fc7a58cd8e9bedc3466c84705ddaf3019023fc4e30a97ee12763e7ed643ca0b8c93363fe1690ffb0b8fdd7a8c0c094430bb6d559a69e56d0241f7079afdb39540d6575d915419401af5eecf68df1ffad64fe209ad75cebfea61f0864a38b7655ad1e3b28602e8725e8aaaf1fc6644620b7707f3cde48db9653b73977e41ae2c7168476975b2fbb191585f86985f599a7a9f234a7a9b6a603fc6f863d547c76049b6bf9405d0034c72e99759de58803aa4df803d24276c01b020300a88ba345304330120603551d130101ff040830060101ff020104300e0603551d0f0101ff040403020106301d0603551d0e04160414ccfa6793f0b6b8d0a5c01ef353fd8c53df83d796300d06092a864886f70d01010b05000382010100ab7fee1c16a99c3c5100a0c0110805a799e66f018854616ef1b918ad4aadfe814023942ffb757c2f284b622481820bf561f11c6eb86138eb81fa62a13b5a62d39465c4e1e66d82f82f2570b22126c172511f8c2cc38490c35a8fbacff4a765a5eb98d1fb05b2467515236a6f85633080f0d59e1f291cc26cb050595d905b3ba80d30cfbf7d7fcef19d83bdc9466e20a6f96151ba212f7bbea51563a1d49587f19eb9f389f33d85b8b8dbbeb5b929f9da3705004994038444e7bf4331cf758b25d1f4a664f592f6ab05eb3de9a50b3662dacc065f368bb65e31b82afb5ef671df44269ec4e60d91b42e759580516a4b30a6b062a193f19bd8cec463753f5947b1	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CE6A64A309E42FBBD9851C453E6409EAE87D60F1	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D6BF7994F42BE5FA29DA0BD7587B591F47A44F22\Blob = 030000000100000014000000d6bf7994f42be5fa29da0bd7587b591f47a44f22090000000100000040000000303e06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a03040b000000010000001c00000050006f00730074006100200043004100200052006f006f00740000002000000001000000230700003082071f30820607a003020102020448fc7ef5300d06092a864886f70d01010505003081ae31123010060a0992268993f22c6401191602727331153013060a0992268993f22c6401191605706f73746131123010060a0992268993f22c64011916026361311630140603550403130d436f6e66696775726174696f6e3111300f060355040313085365727669636573311c301a060355040313135075626c6963204b6579205365727669636573310c300a06035504031303414941311630140603550403130d506f73746120434120526f6f74301e170d3038313032303132323230385a170d3238313032303132353230385a3081ae31123010060a0992268993f22c6401191602727331153013060a0992268993f22c6401191605706f73746131123010060a0992268993f22c64011916026361311630140603550403130d436f6e66696775726174696f6e3111300f060355040313085365727669636573311c301a060355040313135075626c6963204b6579205365727669636573310c300a06035504031303414941311630140603550403130d506f73746120434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a8f2bd88bec0af44be9b4aa2631cd656ab1d29b21caa151e45d1ac9da061d535f9e45a83366343de385715fcf09462f40780578357a8b315bcfb4d23785fdaf6c78116beabdfe7dc8353732bb6dd63888d45f30ddd7dbfe888b066c1435d37d26da19c9a46c3b33fd0c2a08a942e83a63cc360bd2ccc1e8b6382764128e4156b5c0c6139553841cac866e8c7b89752102670b707b7091ea6135eae995a266f643decc4d3a5b95c7664ad637d8883e24bcc0dded4c6d30842f55b17f571e1912d039f9e1cdc8b72a4e847641087643073d8f2b4f157269357cbb6c70d888b1dcf05305d04d67637e8203257bf0f9c33c6088cf6b4c2a906b05b30a11e2d12ba3f0203010001a38203413082033d300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201063081ba0603551d200481b23081af3081ac060b2b06010401fa380a0a010130819c303006082b060105050702011624687474703a2f2f7777772e63612e706f7374612e72732f646f6b756d656e746163696a61306806082b06010505070202305c1a5a4f766f206a6520656c656b74726f6e736b6920736572746966696b617420524f4f54204341207365727665726120536572746966696b6163696f6e6f672074656c6120506f7374653a2022506f73746120434120526f6f74222e301106096086480186f8420101040403020007308201bc0603551d1f048201b3308201af3081c9a081c6a081c3a481c03081bd31123010060a0992268993f22c6401191602727331153013060a0992268993f22c6401191605706f73746131123010060a0992268993f22c64011916026361311630140603550403130d436f6e66696775726174696f6e3111300f060355040313085365727669636573311c301a060355040313135075626c6963204b6579205365727669636573310c300a06035504031303414941311630140603550403130d506f73746120434120526f6f74310d300b0603550403130443524c313081e0a081dda081da8681a36c6461703a2f2f6c6461702e63612e706f7374612e72732f636e3d506f7374612532304341253230526f6f742c636e3d4149412c636e3d5075626c69632532304b657925323053657276696365732c636e3d53657276696365732c636e3d436f6e66696775726174696f6e2c64633d63612c64633d706f7374612c64633d72733f63657274696669636174655265766f636174696f6e4c69737425334262696e6172798632687474703a2f2f736572746966696b6174692e63612e706f7374612e72732f63726c2f506f7374614341526f6f742e63726c302b0603551d1004243022800f32303038313032303132323230385a810f32303238313032303132353230385a301f0603551d23041830168014f2cb8de235ef1043c4da7bcafaeb8903a122afb8301d0603551d0e04160414f2cb8de235ef1043c4da7bcafaeb8903a122afb8301d06092a864886f67d0741000410300e1b0856372e313a342e3003020490300d06092a864886f70d010105050003820101007046a1c8e41705660f9de24331481d929019c4850185166ef892ce7bae5216c4978d0a287dd5cb6ce3d5e50e324fc8682d34083d73a893422933460c4467f1d09a9c6901e591f10dc9693c334b4e19936333052921a1d8ff3e54ab9ef6a17a02d7dcffa53e5478f9d3c1ca1295f9899e14e2f2a144b2cbe92d7535cc9655bb380b8826dad6acefd352a20b4b3a53da4b2253ccca2a249a62aac4329a7edcccc1b26ccd8fd9b4c0cff502c08c2b845b1b40bc10d050e161d666569a0491a5e3d5bda02e2281b1d938dae4a8875f3c460496dec99a3bbfad786c1d4949b469b9700f059256b6fdafaef8202d4723cfb61ccdc49b804ef9bf31c054bebb317ff33e	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D904080A4929C838E9F185ECF7A22DEF99342407	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\81968B3AEF1CDC70F5FA3269C292A3635BD123D3\Blob = 03000000010000001400000081968b3aef1cdc70f5fa3269c292a3635bd123d3090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001200000044005300540043004100200045003100000020000000010000002d0300003082032930820292a003020102020436701596300d06092a864886f70d01010505003046310b300906035504061302555331243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e3111300f060355040b13084453544341204531301e170d3938313231303138313032335a170d3138313231303138343032335a3046310b300906035504061302555331243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e3111300f060355040b1308445354434120453130819d300d06092a864886f70d010101050003818b0030818702818100a06c81a9cf341e24ddfe8628ccde832ff95ed442d2e87460661398061ca95112696f3155b9497200087ed3a562443724998fd983488f996d9513bb433b2e494e8837c1bb587ffee1bdf8bb61cdf347c099a6f1f391e8787c00cb61c944277169554a7e494deda2a3be024c00ca02a8ee010231640f522d13747636b57ab42d71020103a382012430820120301106096086480186f842010104040302000730680603551d1f0461305f305da05ba059a4573055310b300906035504061302555331243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e3111300f060355040b13084453544341204531310d300b0603550403130443524c31302b0603551d1004243022800f31393938313231303138313032335a810f32303138313231303138313032335a300b0603551d0f040403020106301f0603551d230418301680146a797e91694618130a0277a5595b6098250ea2f8301d0603551d0e041604146a797e91694618130a0277a5595b6098250ea2f8300c0603551d13040530030101ff301906092a864886f67d074100040c300a1b0456342e3003020490300d06092a864886f70d0101050500038181002212d87a1ddc8106b60965b287c81f5eb42fe9c41ef23cc1bb0490114a834e7e93b94d42c79226a05c349a3872f8fd6b163e20ee828b312a93368523888a3c0368d3c9090f4dfc6ca4da2872930e8980b07dfe806f656d1833978bc26b89ee603dc89bef7f2b32627393cb3ce37be2767845bca19304bb869f3a5b437ac38a65	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\54F9C163759F19045121A319F64C2D0555B7E073	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3913853E45C439A2DA718CDFB6F3E033E04FEE71	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A1E7C600AA4170E5B74BC94F9B9703EDC261B4B9\Blob = 0b0000000100000040000000530077006900730073005300690067006e00200050006c006100740069006e0075006d00200052006f006f007400200043004100200013202000470033000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000a1e7c600aa4170e5b74bc94f9b9703edc261b4b92000000001000000850500003082058130820369a0030201020208223fa91720de8194300d06092a864886f70d01010b0500304e310b300906035504061302434831153013060355040a130c53776973735369676e204147312830260603550403131f53776973735369676e20506c6174696e756d20526f6f74204341202d204733301e170d3039303830343133333430345a170d3337303830343133333430345a304e310b300906035504061302434831153013060355040a130c53776973735369676e204147312830260603550403131f53776973735369676e20506c6174696e756d20526f6f74204341202d20473330820222300d06092a864886f70d01010105000382020f003082020a028202010094a0ef131b9f44201bcdc5aa22bbd9f2523e7a5a5877e68da12bc9dca4f3e4b3139400629b1cf2435043817eaf303649ac18890c1845b83ec7546de3d89a596b8a1a25a9b6b50db77d23f05f7da807a9f73e862ec8014ddce636ed1de5370769124be383d1041c24f01f7071e719ed73486e952b15b656e602df56e99bfaeaa6eee0c2c3bae0ccc6c87bd76f3a959b3a8fbe5b2cd2a9a0383ed688e1b162138edcab3067cda86aa6632b82b0cbc73d4eed72f67dab324e6502eb0f9974f81c1a288c0e4500932c149f6dc71b9ef68adc7b78e3b494471d4d056d847a9054b29e8b75c280df87393f9ffb4854078da029f5f9605f5a72e8bb9ba042e0080034a3153c13e3d61a6b02b29421a39d41bc2a6b4e333ba69438fc3dc72b33b32e2b0674ac9b106fc54e45f75da156032c0d5f7abd1ede1d77906bdaa52d8a4ce9df41f4e74bec7d95429f4ca9090f43883f3d93e72bf47a48da68c4dd1280311a5d245426a62421b34cadda1708360257c69c8670c975c99e7c61d878e6b9e81469f91c1028125d4b7550ba3cd067705555564bfb3d1cd8db794d97dfb89edb172cd53507b850a9f78ef756ff7a67434f20d9ca66d638604bee9431d60da2489bff346994c635f59688efaa66cc81a6eb4c53ff3274a7b69d9857b4ba26a9f13333627e3ab0031157ffdc6f1123ad3ec60ad0cc54b72dc2931de5c2a68cc7d8ef53f70203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414562a3f9058f4175a14b2d7081b855b546a541a28301f0603551d23041830168014562a3f9058f4175a14b2d7081b855b546a541a28300d06092a864886f70d01010b050003820201006ced8ae743a879279bb8cf873e6438188c1142928637e058c31bee042ef784ec8310680c7f782d9cc2978e364e16d80eea6b48ad4f9e5d0dcc0da93e18857ecc68993935d6d89f86c132fb4d65b322144bc88566da17ff7191ac9c5657de712c5642bff8cd0ef0a2d3ffd22215fbd0780a7ee1b05ace8e37dba99ee795cf63f22c0dd2fa6ff3c8d5fb00b7f7356710d37b52ec1032f8bfdd5ec9a682a4f1b0bf1d2edd25e4bd4df035a9910147f81002945beb3eeb0dbad51d632ca52eabe7e31ea3ee4baa5fb16601b4825af9464bc7f1f8df2cbefd75dd96389a373a6ea5e632156eb390c0398a74a595a0be0d2e8979cd29568ec35e5751c4056f04558f81e94cbd5946cb2abc4dc91df2c64f05e4c8040df76e4fdac33a9cd2c2f5e9c6247a143e1c4230a8024531a9fc50a9dcdc86380f5b933f7f084e6a0d273a107956c315b83e0686f6d97067af757a8be258ccc6754f3255c56c1409283bf295e46ade2c2807ada07d0728ddd45aa3e9a67c138c990b5278dbd9d1df3e5a43767f466053c2cde776477c55cdb43964105b954b355d448324d5e02e240cc1806e69008006770a6682100c516f378957dbf34ce5b8b9ee23669760b752ddd996fbba8a3ba04dce5ef0444c90cc214f1b3a986b8e3183f9830852cb19c1356beea1155b883f6dacf2349253a6302a13d7e686a85dd942d2c79da97a8bcbdfeea231c2e5	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\EC93DE083C93D933A986B3D5CDE25ACB2FEECF8E	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B19DD096DCD4E3E0FD676885505A672C438D4E9C	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\BC9219DDC98E14BF1A781F6E280B04C27F902712	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\027268293E5F5D17AAA4B3C3E6361E1F92575EAA	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B12E13634586A46F1AB2606837582DC4ACFD9497\Blob = 0b00000001000000120000004300650072007400690067006e006100000009000000010000005c000000305a06082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b0601050507030906082b0601050507030606082b0601050507030706082b06010505080202030000000100000014000000b12e13634586a46f1ab2606837582dc4acfd94972000000001000000ac030000308203a830820290a003020102020900fedce3010fc948ff300d06092a864886f70d01010505003034310b300906035504061302465231123010060355040a0c094468696d796f7469733111300f06035504030c084365727469676e61301e170d3037303632393135313330355a170d3237303632393135313330355a3034310b300906035504061302465231123010060355040a0c094468696d796f7469733111300f06035504030c084365727469676e6130820122300d06092a864886f70d01010105000382010f003082010a0282010100c868f1c9d6d6b3347526821eecb4beea5ce126ed114761e1a27c16784021e4609e5ac863e1c4b19692ff186d6923e12b62f7dde2362f9107b948cf0eec79b62ce7344b700825a33c871b19f281070f389019d311fe86b4f2d15e1e1e96cd806cce3b3193b6f2a0d0a995127da59acc6bc884568a33a9e722155316f0cc17ec575fe9a20a9809dee35f9c6fdc48e3850b155aa6ba9fac48e309b2f7f432de5e34be1c785d425bce0e228f4d90d77d3218b30b2c6abf8e3f141189200e7714b53d940887f7251ed5b26000ec6f2a28256e2a3e186317253f3e442016f626c825ae054ab4e7632cf38c16537e5cfb111a08c146629f22b8f1c28d69dcfa3a5806df0203010001a381bc3081b9300f0603551d130101ff040530030101ff301d0603551d0e041604141aedfe413990b42459be01f252d545f65a39dc1130640603551d23045d305b80141aedfe413990b42459be01f252d545f65a39dc11a138a4363034310b300906035504061302465231123010060355040a0c094468696d796f7469733111300f06035504030c084365727469676e61820900fedce3010fc948ff300e0603551d0f0101ff040403020106301106096086480186f8420101040403020007300d06092a864886f70d0101050500038201010085031e9271f642afe1a3619eebf3c00ff2a5d4da95e6d6be68363d7e6e1f4c8aefd10f216d5ea55263ce12f8ef2ada6feb37fe1302c7cb3b3e226bda612e7fd4723ddd30e11e4c40198c0fd79cd183307b9859dc7dc6b90c294ca133a2eb673a6584d396e2ed7645708fb52bdef923d6496e3c14b5c69f351e50d0c18f6a70440262cbae1d6841a7aa57e853aa07d206f6d514060b9103752c6c72b561959a0d8bb90de7f5df54cddee6d8d609089763e5c12eb0b74426c026c0af55309e3bd5362a1904f45c1effcf2cb7ffd0fd874011d51123bb48c021a9a4282dfd15f8b04e2bf4305b21fc119134be41ef7b9d9775ff9795c096582feabb46d7bbe4d92e	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DD83C519D43481FAD4C22C03D702FE9F3B22F517	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C060ED44CBD881BD0EF86C0BA287DDCF8167478C\Blob = 030000000100000014000000c060ed44cbd881bd0ef86c0ba287ddcf8167478c090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b000000010000002400000044006900670069004e006f00740061007200200052006f006f007400200043004100000053000000010000002800000030263024060e6084100187690101010c0601010130123010060a2b0601040182373c0101030200c020000000010000008e0500003082058a30820372a00302010202100c76da9c910c4e2c9efe15d058933c4c300d06092a864886f70d0101050500305f310b3009060355040613024e4c31123010060355040a1309446967694e6f746172311a301806035504031311446967694e6f74617220526f6f742043413120301e06092a864886f70d0109011611696e666f40646967696e6f7461722e6e6c301e170d3037303531363137313933365a170d3235303333313138313932315a305f310b3009060355040613024e4c31123010060355040a1309446967694e6f746172311a301806035504031311446967694e6f74617220526f6f742043413120301e06092a864886f70d0109011611696e666f40646967696e6f7461722e6e6c30820222300d06092a864886f70d01010105000382020f003082020a0282020100acb058c100bdd821080b2b9afe6e5630059f1b779010415cc30d8711778e81f1ca7ce98c6aed387435bbdadff9bbc00937b49673817d331a9839f7936f957f3db9b17587ba5148e88b703e9504c5d8b6c316d988b0b1871d70da86b40f148b7acf10d17436a2127b77864a79e67bdf021168a54e86ae34589b2413785622251e018b4b5171fb82cc599669885a6853c5b90d0237cb4bbc664a907e2a0b0507ed165f559075d846c91b83e208bef123cc991dd62a0f8320155827822efae222c249b1b901816a9d6d9d407768764e212a6d8440854e76997c82f3f3b70259d426011b8edfad5306d1ae18dde2b23acbd788388eac5b29b919d398f91803cf488286660b1b690fc9eb38887a261a054c92d724d496f2ac522da347d552f63ffece840670a6aa3ea2f2b656341857a2e4816de7caf06ad3c7916b0283417c15ef6b9a645ee3d03ce5b1eb7b5d86fbcbe67749cda365dcf7b99cb8e40b5f93cfcc301a321cce1c6395a5f9eae1748b9ee92ba9307ba0181f0e180be55ba9d3d16c1e07678f914ba98abcd266aa930188b291fa315cd5a6c1520809cd0a63a2d322a6e8a1d9390697f56e8d02908c147b3f80cd1b9cbac4587223afb6569fc67a423329073f82c9e61f050dcd4c28368bd3c83e1cc688ef5eee8964e91debda897e32a669d1ddcc889fd1d0c96621dc0667c5947a9a6d624c7dcce06480b29e478ea30203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604148868bfe08e35c43b386b62f7283b8481c80cd74d300d06092a864886f70d010105050003820201003b028dcb3c30e86ea0adf273b35f9e25130405d3f6e38bbb0b79ce53dee496c5d1af73bcd5c3d040557c407fcd1b5f09d5f27c9f681dbb5dce7a39c28cd6987bc58355a8d57d40cae01ef7895e635da113c25d8ab68a7c00f323c3ed855f7176f06863aa45213948617836dcf14393d425c7f28065e153027551fc7a3aef37ab8428570cd8d4d499566ce3a2fe5984b431e833f86494945197ab39c54beddadd800b6f7c290dc48e8a720de75314b260413d849131683d2744dbe5def4fa6345c84c3e98f53f41ba4ecb370dba6698f1ddcb9f5cf75436826b2cbc13619742f878bbccc8a29fcaf068bd6b1db2df8d6f079dda8e67c7471ecab9bf2a4291b7635366f142a3e1f45a4d586bb5e4a433ad5c701ddce0f2eb7314919a03c1ea0065bc07fccf1211222caea0bd3ae0a22ad859e929d31835a4ac115f19b5b51bff224a5cc67ae417ef20a9a7f43fad8aa79a04259d0eca37e650fd8c4229049aecb9cf4b72bde20836af232f62e5ca01d370db7c82232c16310cc63607907ab11f6758c43b585989b08c8c50b3d886cb68a3c40ae7694b20cec11e564b95a92368d830d8c3ebb05551cde5fd2bb8f5bb119f5354f634198c790936ca611725170b8298730c7774c3d50dc7a8124cc7a75471472e2c1a7dc9e32b3b48de2784a76336b37d8fa06439240d3d7b87af665c741b4b73b2e58cf08699b8e5c5df84c1b7eb	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A69A91FD057F136A42630BB1760D2D51120C1650	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABB51672400588E6419F1D40878D0403AA20264	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\36863563FD5128C7BEA6F005CFE9B43668086CCE\Blob = 0b000000010000000e0000007400680061007700740065000000090000000100000020000000301e06082b0601050507030206082b0601050507030406082b0601050507030303000000010000001400000036863563fd5128c7bea6f005cfe9b43668086cce20000000010000002d0300003082032930820292a003020102020100300d06092a864886f70d01010405003081cf310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311a3018060355040a131154686177746520436f6e73756c74696e6731283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e312330210603550403131a54686177746520506572736f6e616c205072656d69756d204341312a302806092a864886f70d010901161b706572736f6e616c2d7072656d69756d407468617774652e636f6d301e170d3936303130313030303030305a170d3230313233313233353935395a3081cf310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311a3018060355040a131154686177746520436f6e73756c74696e6731283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e312330210603550403131a54686177746520506572736f6e616c205072656d69756d204341312a302806092a864886f70d010901161b706572736f6e616c2d7072656d69756d407468617774652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100c966d9f80744cfb98c2ef0a1ef13456c05dfde2716513641116c6c3bedfe107d129ee59b429afe6031c366b7733a48ae4ed032379488b50db6d9f3f244d9d58812dd764df21afc6f231e7af1d898454e0710ef1642d043756d4adee2aac931ff1f00707c66cf102508bafaee00e94603662711153baa5bf298dd3642b2da88750203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d010104050003818100693689f7342a33722f6d3bd422b2b86f9ac536660e1b3ca1b1755ae6fd35d3f8a8f2076f85678ede2bb9e217b03aa0f00ea2009adff314156ebbc8855a9880f9ffbe741d3df3fe3025d1373467faa5717930612972c0e02c4cfb56e43aa86fe5325952db752850590cf80b19e4acd9af968d2f50db07c3ea1fab33e0f52b3189	updroots.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85A408C09C193E5D51587DCDD61330FD8CDE37BF\Blob = 03000000010000001400000085a408c09c193e5d51587dcdd61330fd8cde37bf090000000100000016000000301406082b0601050507030406082b060105050703010b0000000100000036000000440065007500740073006300680065002000540065006c0065006b006f006d00200052006f006f0074002000430041002000320000002000000001000000a30300003082039f30820287a003020102020126300d06092a864886f70d01010505003071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f742043412032301e170d3939303730393132313130305a170d3139303730393233353930305a3071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f74204341203230820122300d06092a864886f70d01010105000382010f003082010a0282010100ab0ba335e08b2914b11485af3c10e4396f355d4aaeddea618d9549f46f64a31a6066a4a9402284d9d4a5e578930e6801adb94d5c3aced3b8a84240dfcfa3ba82596a921bac1c9ada082b2527f9692347f1e0eb2c7a9bf51302d07e347cc29e3c0059abf5da0cf5323c2bac50dad6c3de8394caa80c99320e0848565b6afbdae1585801495f72413c1506018e5dadaab893b4cd9eeba7e86a2d5234db3aef5c7551dadbf331f9ee719832c45415440cf99b55edaddf1808a0a3868a49ee53058f194cd5de58799bd26a1c42abc5d5a7cf680f96e4e161987661c8917cd63e00e2915087e19d0ae6ad97d21dc63a7dcbbcda0334d58e5b01f56a07b716b66e4a7f0203010001a3423040301d0603551d0e0416041431c3791bbaf553d717e0897a2d176c0ab32b9d33300f0603551d13040830060101ff020105300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100946459ad3964e729eb13fe5ac38b1357c80424f07477c060e367fbe989a683bf96827c6ed4c33def9e806ebb29b4987ab13b54eb3917477e1a8e0bfc1f31593104b2ce17f32cc7623655e222d88955b49848aa64fad61c36d844785a5a233a5797f57a304fae9f6a4c4b2b8ea003e33ee0a9d4d27bd2b3a8e2723cad9eff8059e49b45b4f63bb0cd39199832e5ea216190e431218e34b1f72f354a8510dae78a3721be5963e0f285883153d45414857079f42e067727752f1fb88af9fec5bad836e483ece765b7bf635af346af819437d4418cd623d61ecff5681b4463a25abaa73559a1e570059b0e235799940a6dba3963288692f31884d8fbd1cf05566457	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5D989CDB159611365165641B560FDBEA2AC23EF1	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\FAB7EE36972662FB2DB02AF6BF03FDE87C4B2F9B\Blob = 0b000000010000002200000063006500720074005300490047004e00200052006f006f0074002000430041000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000fab7ee36972662fb2db02af6bf03fde87c4b2f9b20000000010000003c0300003082033830820220a0030201020206200605167002300d06092a864886f70d0101050500303b310b300906035504061302524f3111300f060355040a1308636572745349474e31193017060355040b1310636572745349474e20524f4f54204341301e170d3036303730343137323030345a170d3331303730343137323030345a303b310b300906035504061302524f3111300f060355040a1308636572745349474e31193017060355040b1310636572745349474e20524f4f5420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b733b97ec8254a8eb5dbb4281baa5790e8d122d364bad393e8d4ac8661406a60576854844dbc6a540205ffdf9b9a2aae5d078f4ac3287feffb2bfa79f1c7adf0105324908b66c9a888abaf5aa300e9beba46ee5b737b2c1782815e622ca10265b3bdc52b007ec4fc0333570dede2face5d45d638cd35b6b2c1d09c814aaae4b2015c1d8f5f99c4b1addb8821eb90088280f330a343e69082ae552849ed5bd7a910380efe8f4c5b9b46ea41f5b00874c3d08833b67cd774dfdc84d1430e7539a1254028ea78cb0e2c2e399d8c8b6e161c2f268210e2e365940a04c05ef75d5bf810e2d0ba7a4bfbde3700001a5b28e3d29c733e328798a1c9512fd7deac33b34f0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201c6301d0603551d0e04160414e08c9bdb2549b3f17c86d6b242870bd06ba0d9e4300d06092a864886f70d010105050003820101003ed21c892e35fcf875dde67f6588f4724cc92cd7324ef3dd197947bd8e3b5b930f504924136b140672ef09d3a1a1e34084c9e71832743c486e0f9f4bd4f71ed39386645497637250d555cffa209302a29bc323934e165576a070796dcd211fcf2f2dbc19e38831f8591a8109c897a674c760c45bcc578eb275fd1b0209db596f729369f73141d68838bf87b2bd1679f9aae4be8825dd6127231cb531070436b41a90bda0747150896dbc14e30f86aef1ab3ec7a009cca348d1e0db64e792b5cfaf7243708bf9c3843c13aa7e929b575393fa70c2910e31f99b675de996385e5fb3734e881567de9e76106220be5569954300394df6eeb05a4e494454585f4283	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3BC49F48F8F373A09C1EBDF85BB1C365C7D811B3\Blob = 0b000000010000006e0000004a006100700061006e002000430065007200740069006600690063006100740069006f006e002000530065007200760069006300650073002c00200049006e0063002e0020005300650063007500720065005300690067006e00200052006f006f00740043004100310031000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070300000001000000140000003bc49f48f8f373a09c1ebdf85bb1c365c7d811b32000000001000000710300003082036d30820255a003020102020101300d06092a864886f70d01010505003058310b3009060355040613024a50312b3029060355040a13224a6170616e2043657274696669636174696f6e2053657276696365732c20496e632e311c301a060355040313135365637572655369676e20526f6f7443413131301e170d3039303430383034353634375a170d3239303430383034353634375a3058310b3009060355040613024a50312b3029060355040a13224a6170616e2043657274696669636174696f6e2053657276696365732c20496e632e311c301a060355040313135365637572655369676e20526f6f744341313130820122300d06092a864886f70d01010105000382010f003082010a0282010100fd77aaa51c90053bcb4c9b338b5a1445a4e79016d1df57d22110a417fddfacd61fa7e4db7cf7ecdfb803da9458fd5d727c8c3f5f0167741596e3023c87dbaecb018ec2f366c68545f402c63ab562b2affa9cbfa4e6d4803098f30db6938fa9d4d836f2b0fc8aca2ca115339531dac01bf2ee629986633fbfdd932a83a876b9131fb7ce4e42858f22e72e1af29509b205b5444e77a120bda9f24e0a7d50adf5050d454f4671fd283e53fb04d82dd7651d4a1bfacf3bb0319a356ec88b06d30091f29408654cb13406007a89e2f0c70359cfd5d6e8a732b3e6984086c5cd27128bcc7bceb7113c626007233e2b406e9480096db6b36f776f350850fb0287c53e890203010001a3423040301d0603551d0e041604145bf84d4fb2a586d43ad2f1639aa0be09f657b7de300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100a0a13816662ea7561f219c06fa1dedb922c53826d84e4feca37f79de4621a187778f07089ab2a4c5af0f32980b7c6629b69b7d25524943ab4c2e2b6e7a70af160ee3026cfb42e6189d45d855c8e83bdde7e1f42e0b1c345c6c584afb8c88505f951cbfedab22b565b385ba9e0fb8ade57a1b8a503a1dbd0dbc7b54500bb942af55a01881ad6599efbee49cbfc485ab41b2546fdc25cded78e28e0c8d0949dd637b5a69960221a8bd5259e97d35cbc852ca7f81fed96bd3f711ed25dff8e7f9a4fa729784530da5d03218517659146c0febec5f808c754383c38598ff4c9e2d0de47783934eb596078b28139b8c198d41274940eedee6234439dca122d6ba03f2	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 0b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030703000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\086418E906CEE89C2353B6E27FBD9E7439F76316\Blob = 030000000100000014000000086418e906cee89c2353b6e27fbd9e7439f76316090000000100000040000000303e06082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a030c0b000000010000003800000056004100530020004c0061007400760069006a006100730020005000610073007400730020005300530049002800520043004100290000002000000001000000ad070000308207a930820591a0030201020210630686a7c53765a54390a86a58ccd432300d06092a864886f70d010105050030818f310b3009060355040613024c5631353033060355040a132c564153204c617476696a6173205061737473202d205669656e2e7265672e4e722e343030303330353237393031233021060355040b131a536572746966696b6163696a61732070616b616c706f6a756d69312430220603550403131b564153204c617476696a6173205061737473205353492852434129301e170d3036303931333039323231305a170d3234303931333039323735375a30818f310b3009060355040613024c5631353033060355040a132c564153204c617476696a6173205061737473202d205669656e2e7265672e4e722e343030303330353237393031233021060355040b131a536572746966696b6163696a61732070616b616c706f6a756d69312430220603550403131b564153204c617476696a617320506173747320535349285243412930820222300d06092a864886f70d01010105000382020f003082020a02820201009bb8f9fd61552f4fa4a514b52e8eb9248facfbb1543f40ff4fc5e586687b5393fb358235a8502e9452a0db833e75da1570ac09cfee8249ad3649b9b4718bb400a14206ca080a6397b608fceeb4dc98781982c9f87f643eaac9feb18debb064f5bcf3c43e3a90ea4e8e3f1b19bc6a83c3913c6c55fb0a52c0e8e15d778533c549dfec6abfbf6c37fe8e49a21518ce8b8e6b1e38a3306f88817e7256441ac47a390ff6c48f96d4b2eb004e5cdebbe73bb7e62405936b4de69144bfee981bc7851b11417b2236a7be3ee87a37dc18de909d8fcdb2d79a3fe2177f5b0ce1ef3f663d6e24e4b0cec30c886c94da38257c5239e37314b30045639a0c42405e04c6f77264cec96e33b3e4d36d249537937ef2005d198b1ff34373a89f45d206a9ecb442bbfaee0cc74f3f511fd1afd0ac187f878122fea9dd07966d7cf84ed94d3a5069d5417ec5da74d88e73e57e83e1c31981b7bdbf408ebe2e9aa20caa4e022ebb2ae1085d3103c9ac27b0afdcd5c8147d409d558921f990ccd4c9604173abe8cdd83a55390a8299fe9bf5f53c1c91cbc0fa4654ae21fc2aac5c7bde7a9771fd6c6bcd489aa4db817c18372f907d6194bd17c95cb6541677ca094aaae9bc4f9475015a56bc92d28fb9d797de567401f7167149b1f518469941ee62e1b32c65756929724303f89b1ffa38f49eec40108eac97d5b033be9f18dc2df74178544a6244e70203010001a38201fd308201f9300e0603551d0f0101ff040403020106301806082b06010505070103040c300a3008060604008e460101300f0603551d130101ff040530030101ff301d0603551d0e04160414ccc3f566ff73ac385a961b2189b8814c1fcb5e25301006092b06010401823715010403020100308201890603551d20048201803082017c30820178060b2b0601040181c459010102308201673082013806082b060105050702023082012a1e82012600530069007300200069007200200073006500720074006900660069006b006100740073002c0020006b006f00200069007a0064006500760069007300200056004100530020004c0061007400760069006a00610073002000500061007300740073002c0020006e006f00640072006f00730069006e006f007400200061007400620069006c0073007400690062007500200045006c0065006b00740072006f006e00690073006b006f00200064006f006b0075006d0065006e007400750020006c0069006b0075006d0061006d00200075006e0020004500690072006f0070006100730020005000610072006c0061006d0065006e0074006100200064006900720065006b0074006900760061006900200031003900390039002f00390033002f0045004b302906082b06010505070201161d687474703a2f2f7777772e652d6d652e6c762f7265706f7369746f7279300d06092a864886f70d010105050003820201001f284a35902163680a2f78afa31e822697a33f2719d24ba3427a0613655bc104cbeb7d7cef94f2f189f5b7df52022169d2ea9634e5a0cf97b89c550e1085a3145e2c05f8b53a76f3f97ab8deb60c2769f2cb94910b1db9d58e6f992fcdf21956393a4856f001ff8275b6b2fdd1d4f5f263574c4da17ecc10ba0469eff414fcb3971f45ee6f4a287fd1c627bcc7a3a96b7bed82136fabde0ffb71eb5c111aa92cd0309ffc363756ef95e9bab713b6ae9f0261ad9eec6b046f369f0f99f7c2c9c84c28b928d421d79e54d5c0cef48ee455947b8f24c638fcab7aa456773da845ef6492a4d04a7ebb738bf40d5273b83a485e4380d3a9707762ffc7281c731e43e627245b49b9e636a48efdc52d2f7aa579127ad721b2256dc80fa2c3614be548e257ba9ff28a21dddb64f0da19dfcec09b8039c277776315537284faa48f073786217d50fa3d6a37db910e37b3fdce0bca7b61d09c749c7d38686de97b1dd6f12ab4ef3b60527705e602c25f8c5bbcf07db773c7916bb22ab363a334d5abad257147ff1a3e7ab68d9576c3eea6cd03096cee456798cf994876c1ce8a749a6852013422c8ede2140b84bd6e108cb1729bbee808d757d57feab4013d4ee4e2e867e78c7ee9e74211ef9546c891d6be271780193498e7c6df1efc215f9e863dbc7ef09cbd729ef447825b7167f3fadc544ca85cd859c7d0070e133327bcf469f06b21	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F65566336DB6598581D584A596C87934D5F2AB4\Blob = 0300000001000000140000004f65566336db6598581d584a596c87934d5f2ab409000000010000002a000000302806082b0601050507030406082b0601050507030206082b0601050507030306082b060105050703010b000000010000001200000056006500720069005300690067006e0000002000000001000000410200003082023d308201a6021100e49efdf33ae80ecfa5113e19a4240232300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3034303130373233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c95c599ef21b8a0114b410df0440dbe357af6a45408f840c0bd133d9d911cfee02581f25f72aa84405aaec031f787f9e93b99a00aa237dd6ac85a26345c77227ccf44cc67571d239ef4f42f075df0a90c68e206f980ff8ac235f702936a4c986e7b19a20cb53a585e73dbe7d9afe244533dc7615ed0fa271644c652e816845a70203010001300d06092a864886f70d0101020500038181006170ec2f3f9efd2be6685421b06779080c2096318a0d7abeb626df792c22694936e397776261a232d77a542136ba02c934e725da4435b0d25c805db394f8f9aceea460752a1f954923b14a7cf4b34772215b7e97ab54ac62e75decae9bd2c9b224fb82ade967154bbaaaa6f097a0f6b0975700c80c3c09a08204ba41daf799a4	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97E2E99636A547554F838FBA38B82E74F89A830A\Blob = 03000000010000001400000097e2e99636a547554f838fba38b82e74f89a830a09000000010000002a000000302806082b0601050507030406082b0601050507030206082b0601050507030306082b060105050703010b000000010000001200000056006500720069005300690067006e000000200000000100000006030000308203023082026b021046a433bd761f6a49e6a8c3a7f58540f5300d06092a864886f70d01010505003081c1310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355040b1333436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574776f726b301e170d3938303531383030303030305a170d3138303531383233353935395a3081c1310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355040b1333436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574776f726b30819f300d06092a864886f70d010101050003818d0030818902818100cc5ed1115d5c69d0abd3b96a4c991f5998308e168520466d473fd4852084e16db3f8a4ed0cf1170f3bf9a7f925d7c1cf8463f27c63cfa247f2c65b338e64400468c180b9641c4577c7d86ef595293c50e834d7781fa8ba6d4391958f45575e7ec5fbcaa404ebea973754306fbb01473233cddc579b646961f89b1d1c894f5c670203010001300d06092a864886f70d010105050003818100107bf4893fdc3d0bbb004ceb3428cbfd07a9436986f24b00a4c7d5d8b082780eed963c667b0707e13e73f67e72c8c541dd29485c63eb36f4752ec5048daabbb6b714a58066463d010cd2c000b5481b4b1df42947a83c4217582d787b205002274b9b270bedf32f54267348f025a989f79fc9aa8a61b7ca0c3dd684770614e815	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\027268293E5F5D17AAA4B3C3E6361E1F92575EAA\Blob = 0b000000010000001c0000004b00490053004100200052006f006f0074004300410020003100000009000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b06010505070309030000000100000014000000027268293e5f5d17aaa4b3c3e6361e1f92575eaa200000000100000077030000308203733082025ba003020102020104300d06092a864886f70d01010505003064310b3009060355040613024b52310d300b060355040a0c044b495341312e302c060355040b0c254b6f7265612043657274696669636174696f6e20417574686f726974792043656e7472616c3116301406035504030c0d4b49534120526f6f7443412031301e170d3035303832343038303534365a170d3235303832343038303534365a3064310b3009060355040613024b52310d300b060355040a0c044b495341312e302c060355040b0c254b6f7265612043657274696669636174696f6e20417574686f726974792043656e7472616c3116301406035504030c0d4b49534120526f6f744341203130820120300d06092a864886f70d01010105000382010d00308201080282010100bc04e4fa1339f03496206b6c68bbfadb77ff27f7acec2fe7fdf07f6d6f8c2acd25095b24f4a168fc28ecc925e2aceddec83384f5b0a5093aa7b14748c5cc4f8c799cf906577dddee38f6cf14b29cead3c05d7762f0470db91a40535c6470af085ac0f7cf75f96c8d64281e20feb71b19d35a668372e2b09bbdd325150d326f6437948546c872be77d56e1f282fc769ede783893358d3dea0bf40e84350eedc4d6bbca5eaa6c8618ef5c364af0615dc298b3f758cbc7144dbfcadb5171d6d8983cfc633bdbf45a2fe0a9fa3115f0fb91f9c1ac246cc9c28669f70263c2edfaa80fe8cc50409254fcd93473c37ea026792fefc22245cacd22ce05c01338ac119db020103a3323030301d0603551d0e04160414bfb627d8035a76654c6101415631e58b7b3ad9cc300f0603551d130101ff040530030101ff300d06092a864886f70d0101050500038201010013af510bde8a6a5be69a0ac8b1904a4ea1029dcc88d2ab66bd3decbbb142956ab25c5affa1636496a968157f255e8af8a473c1808a850a0e52e832e745f84e658091997443e5459d492af09495dde9e130d2136ec94eb177e504cfad5a1e94095ad73c081cae7ae91432c145add2264872aca841daf02187395edffc64ff61742a9cd99b8b5fc23793d8a3372f3b936bb21b07a77f0950efd33abe216b8a903b274a514e6b9e9c879df8789031ed1127c6a859befc180bfb8e7e2e42e1ede70921bdb913c55667f426a64243904454b4719b76e41a12ac1a2800df9bc1d5f8db5ca3f892b1bdb4d4f950d900024fdb83d0114fa44256613a7e1332d3841fc9ba	updroots.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1184	KB931125.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4976	LogonUI.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 1184	3128	2023-08-26_a97bbbee11c4aa5e3873d169dc93c812_magniber_JC.exe	86
PID 3128 wrote to memory of 1184	3128	2023-08-26_a97bbbee11c4aa5e3873d169dc93c812_magniber_JC.exe	86
PID 3128 wrote to memory of 1184	3128	2023-08-26_a97bbbee11c4aa5e3873d169dc93c812_magniber_JC.exe	86
PID 1184 wrote to memory of 4148	1184	KB931125.exe	87
PID 1184 wrote to memory of 4148	1184	KB931125.exe	87
PID 1184 wrote to memory of 4148	1184	KB931125.exe	87
PID 1184 wrote to memory of 4708	1184	KB931125.exe	89
PID 1184 wrote to memory of 4708	1184	KB931125.exe	89
PID 1184 wrote to memory of 4708	1184	KB931125.exe	89
PID 1184 wrote to memory of 1100	1184	KB931125.exe	90
PID 1184 wrote to memory of 1100	1184	KB931125.exe	90
PID 1184 wrote to memory of 1100	1184	KB931125.exe	90
PID 1184 wrote to memory of 2772	1184	KB931125.exe	91
PID 1184 wrote to memory of 2772	1184	KB931125.exe	91
PID 1184 wrote to memory of 2772	1184	KB931125.exe	91

C:\Users\Admin\AppData\Local\Temp\2023-08-26_a97bbbee11c4aa5e3873d169dc93c812_magniber_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-26_a97bbbee11c4aa5e3873d169dc93c812_magniber_JC.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Users\Admin\AppData\Local\Temp\{5D0E7E3A-657E-4d04-B3F8-47F626854EA4}.tmp\KB931125.exe
  "C:\Users\Admin\AppData\Local\Temp\{5D0E7E3A-657E-4d04-B3F8-47F626854EA4}.tmp\KB931125.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst
    3⤵
    - Executes dropped EXE
    - Modifies system certificate store
    PID:4148
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst
    3⤵
    - Executes dropped EXE
    - Modifies system certificate store
    PID:4708
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst
    3⤵
    - Executes dropped EXE
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst
    3⤵
    - Executes dropped EXE
    PID:2772

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39a7855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL

Filesize
89KB

MD5
a64e4b204d44548eeb5c3d86eca2ad70

SHA1
e3245bf6dbb2e56d71a9cbad2697aa4fa0df6bbe

SHA256
985a5603ebf94539ac11549999f83b5e6dc008180994898c5daa6fd31ae1e9dc

SHA512
dca4099318954bab5f1204645be0d0e8fea0c2e97ee95496fa884fbed627e376358623fa94c39bf0abe97d07d46a7e6c5e1081496cdd1987e07e595995a46cd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL

Filesize
89KB

MD5
a64e4b204d44548eeb5c3d86eca2ad70

SHA1
e3245bf6dbb2e56d71a9cbad2697aa4fa0df6bbe

SHA256
985a5603ebf94539ac11549999f83b5e6dc008180994898c5daa6fd31ae1e9dc

SHA512
dca4099318954bab5f1204645be0d0e8fea0c2e97ee95496fa884fbed627e376358623fa94c39bf0abe97d07d46a7e6c5e1081496cdd1987e07e595995a46cd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\authroots.sst

Filesize
73KB

MD5
bb49ccc10926cdb601eba81afef749a2

SHA1
a4766c9aea8d211e9632148fd4b625cece195be9

SHA256
f013ee3b7fede9a95844e83e83ee298d38cba6efce5a5cafcd8b95255c32f86c

SHA512
94c2809727039d1ed07a3742a4b2f9300e865ea7c49bc1fcf547a30238eeecc88d8dd06a2d4f3112317f948908b9af082b50f412a41a2bcb48d5e30d6d8ecbba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\delroots.sst

Filesize
9KB

MD5
7b32871e409608ff887b6cf4d87debb0

SHA1
191f9ea1298ee52dbd6f977b3584109a064f57b9

SHA256
3f01268547364d2d60a0f65b46757cccfd9225fc39d581846a8fbffdb5756ff2

SHA512
534a384f7946db4083e639b8e02d83ac97293c60630b8811a84c85e0330e9c293f05f5cf71e0f3580551e7923bc5a3bfb7f0406432ca3cdb7efeb4a950ac5e8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\roots.sst

Filesize
7KB

MD5
9e5de0fd1f90486a66dee4bfe89a78d7

SHA1
90e3188ef63495aaa71c85d4ff0f23253c834b40

SHA256
8b95ff56d61586582864d05563762615c8705779578dca3c98a303c3b1f4122e

SHA512
60006fa6f57e4d280642d51055f85f8d27b913ce71373de5b928c515c77647295030ab73ab4a55024de4a40c18f200909f49ffb52c26cf554835fc3d4cc348f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rootsupd.inf

Filesize
1KB

MD5
421e60325404f5f29ac04c9b9d59096b

SHA1
aace2fd74d799e8af5c8d5b2646361bb67a1620c

SHA256
571a8da5298aacc37700c747ee5d72b5a7797835140e7a4d4f895e9604574d77

SHA512
86693975b1b187ee65b0a23b1f3f8e05d1a3f61e7e47b060f938fe1602bbad96021847b709e64c2d5a295b72f10f4db587a11a1e7ca0a0b64c3bed7fa683b1d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.sst

Filesize
320KB

MD5
2d9b4498c847715418160bfd7e7c8a2d

SHA1
e0873091d476d2566aa6fc988cb364247c95dc97

SHA256
c49c05b701c390c679e5e3226ec621f22a08155b1065fcfc37b509f648f03b41

SHA512
dcf3208cdd1e4353f82823f796d735c1209f149f183eea827a90753ec55509a1c460a16c120e07c12a5eacf0e67d2661c25638491ecf4403e25d6508983e519b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5D0E7E3A-657E-4d04-B3F8-47F626854EA4}.tmp\KB931125.exe

Filesize
349KB

MD5
4a4d72d34f9da1fc5019e0748fcde2f5

SHA1
f54752ec63369522f37e545325519ee434cdf439

SHA256
83b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca

SHA512
95986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5D0E7E3A-657E-4d04-B3F8-47F626854EA4}.tmp\KB931125.exe

Filesize
349KB

MD5
4a4d72d34f9da1fc5019e0748fcde2f5

SHA1
f54752ec63369522f37e545325519ee434cdf439

SHA256
83b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca

SHA512
95986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5D0E7E3A-657E-4d04-B3F8-47F626854EA4}.tmp\KB931125.exe

Filesize
349KB

MD5
4a4d72d34f9da1fc5019e0748fcde2f5

SHA1
f54752ec63369522f37e545325519ee434cdf439

SHA256
83b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca

SHA512
95986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33

Download Submit
C:\Users\Admin\AppData\Local\Temp\{A0AE2A4F-EA73-4577-9BD5-8A210F8DC935}.tmp\7z.dll

Filesize
1.1MB

MD5
f0fef6362d4886e85a186a5e3766650a

SHA1
65843b7052a4d1b84762479d79445c46834e18b5

SHA256
15b9fe7d408cbf2204039087526e7df947df57b42ea479e303b682e956638816

SHA512
3f6dfd701cf62b77219f8825a2257c4bd7d44ebafc5654b06abaf906ced2571f4eeb04fe22ae6136c14bddebddb12555aa6efd322e779443d57bb122ea786043

Download Submit
C:\Users\Admin\AppData\Local\Temp\{A0AE2A4F-EA73-4577-9BD5-8A210F8DC935}.tmp\7z.dll

Filesize
1.1MB

MD5
f0fef6362d4886e85a186a5e3766650a

SHA1
65843b7052a4d1b84762479d79445c46834e18b5

SHA256
15b9fe7d408cbf2204039087526e7df947df57b42ea479e303b682e956638816

SHA512
3f6dfd701cf62b77219f8825a2257c4bd7d44ebafc5654b06abaf906ced2571f4eeb04fe22ae6136c14bddebddb12555aa6efd322e779443d57bb122ea786043

Download Submit

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads