b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d

Analysis

max time kernel
122s
max time network
165s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d.exe
Size

4.8MB
MD5

ccdb837301e482acf2fe243ec8ff1ad8
SHA1

d4d8f3ba5036c2c35d5edf37f743d402d03e3161
SHA256

b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d
SHA512

0a30c1f93608069883a7188fdf8278ef820b3d11e077443151027719dee255967ddc725e0b4f7ce4234ebb0f83edbc750b3fce465ea7c9da11395bf01b1dae02
SSDEEP

98304:R9+cMYa3Fmo/BZXxkIaPG1f5e1M/Cw/khc5FbKEQ26PVR7m6gZ1MRGNCyI5AxV3d:buFjBZBkI7he1M/Cw/khc5FbKEV6PVRS

Score

8^/10

bootkit persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}	KB931125.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ = "RootsUpdate"	KB931125.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\IsInstalled = "1"	KB931125.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Version = "28,0,2195,0"	KB931125.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ = "RootsUpdate"	KB931125.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\IsInstalled = "1"	KB931125.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Version = "28,0,2195,0"	KB931125.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Locale = "*"	KB931125.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Locale = "*"	KB931125.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}	KB931125.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ComponentID = "Windows Roots Update"	KB931125.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ComponentID = "Windows Roots Update"	KB931125.exe

Executes dropped EXE 10 IoCs

pid	Process
2644	KB931125.exe
2456	updroots.exe
2460	updroots.exe
2700	updroots.exe
324	updroots.exe
1084	KB931125.exe
2132	updroots.exe
1632	updroots.exe
2940	updroots.exe
2220	updroots.exe

Loads dropped DLL 31 IoCs

pid	Process
2624	b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d.exe
2624	b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d.exe
2644	KB931125.exe
2644	KB931125.exe
2644	KB931125.exe
2644	KB931125.exe
2456	updroots.exe
2644	KB931125.exe
2644	KB931125.exe
2460	updroots.exe
2644	KB931125.exe
2644	KB931125.exe
2700	updroots.exe
2644	KB931125.exe
2644	KB931125.exe
324	updroots.exe
2624	b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d.exe
1084	KB931125.exe
1084	KB931125.exe
1084	KB931125.exe
1084	KB931125.exe
2132	updroots.exe
1084	KB931125.exe
1084	KB931125.exe
1632	updroots.exe
1084	KB931125.exe
1084	KB931125.exe
2940	updroots.exe
1084	KB931125.exe
1084	KB931125.exe
2220	updroots.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	KB931125.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	KB931125.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 64 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A59C9B10EC7357515ABB660C4D94F73B9E6E9272	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B172B1A56D95F91FE50287E14D37EA6A4463768A\Blob = 030000000100000014000000b172b1a56d95f91fe50287e14d37ea6a4463768a090000000100000016000000301406082b0601050507030406082b060105050703020b000000010000001400000055005300450052005400720075007300740000002000000001000000a6040000308204a23082038aa003020102021044be0c8b500024b411d336252567c989300d06092a864886f70d01010505003081ae310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d313630340603550403132d55544e2d5553455246697273742d436c69656e742041757468656e7469636174696f6e20616e6420456d61696c301e170d3939303730393137323835305a170d3139303730393137333635385a3081ae310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d313630340603550403132d55544e2d5553455246697273742d436c69656e742041757468656e7469636174696f6e20616e6420456d61696c30820122300d06092a864886f70d01010105000382010f003082010a0282010100b23985a4f27dab413b624637aecdc16075bc3965f94a1a47a2b9cc48cc6a98d54d3519b9a442e5ce49e28a2f1e7cd23107c74eb483649d2e29d5a264c485bd85513579a44e68907b1c7aa492a817f29815f293ccc9a43295bb0c4f30bd98a00b8be56e1ba246fa78bca26fab595ea52fcfcada6daa2febaca1b36aaab72e67358b79e11e6988e2e646cda0a5eabe0bce763a7a0e9beafcda275b3d731f22e64861c64cf369b1a82e1bb6d431202cbc828a8ea40ea5d78943fc165aaf1d71d71159daba870daffaf3e1c2f0a4c5678cd6d6543ade0aa4ba0377b365c8fd1ed37462aa18ca68931ea1857ef54765cbf84d572874d234ff30b6eef66230148c2ceb0203010001a381b93081b6300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e041604148982677dc49d2670004bb450487cde3dae046e7d30580603551d1f0451304f304da04ba0498647687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d436c69656e7441757468656e7469636174696f6e616e64456d61696c2e63726c301d0603551d250416301406082b0601050507030206082b06010505070304300d06092a864886f70d01010505000382010100b16d615da61a7f7cab4ae430fc536f2524c6caede2315c2b0eeeee61556f043ecf39dec51b4994e4eb204cb4e69e502e72d98df5aaa3b34ada561c609780dc82a2ad4abd8a2bff0b09b4c6d7200445e4cd8001baba2b6eceaad792fee4afebf4261d162a7f6c3095372f3312ac7fddc7d1118c5198b2d0a391d0adf69f9e83931e1d42b846af6b66f09b7feae30302e50251c1aad5359d72400389ba311dc51068529edfa285c55c08a678e6534fb1e8b7d3149e93a6c364e3ac7e71cdbc9fe9031bccfbe9ac31c1af7c15740299c3b247a6c23261d7c76f48245127a1d58755f27b8f983d169eee75b6f8d08ef2f3c6ae285ba7f0f33617fcc305d3ca034a54	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5D989CDB159611365165641B560FDBEA2AC23EF1\Blob = 0300000001000000140000005d989cdb159611365165641b560fdbea2ac23ef1090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000004a000000550054004e0020002d0020005500530045005200460069007200730074002d004e006500740077006f0072006b0020004100700070006c00690063006100740069006f006e0073000000200000000100000068040000308204643082034ca003020102021044be0c8b500024b411d336304bc03377300d06092a864886f70d01010505003081a3310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d312b30290603550403132255544e2d5553455246697273742d4e6574776f726b204170706c69636174696f6e73301e170d3939303730393138343833395a170d3139303730393138353734395a3081a3310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d312b30290603550403132255544e2d5553455246697273742d4e6574776f726b204170706c69636174696f6e7330820122300d06092a864886f70d01010105000382010f003082010a0282010100b3fb91a1e4365585ac06345ba09a58b2f8b50f057783ae32b1769268ec234ac9763fe39cb6377903b9ab698d0725b61967e4b01b1873614ae87ecdd32f64e3a67c0cfa1780a30d47894f51712feefc3ff9b8168087899325209a4382692476285935a11dc07f83066416202cd349a485b4c0617f5108f868159180cba5d5ee3b3af484045e6059a78c3472eeb878c5d13b124a6f7e6527b9a455c5b96f43a4c51d2c99c052a4784c15b34098086b43c601b07a7bf56b1c223fcbefffa8d03a4b76159ed2d1c62ee3db571b32a2b86fe886a63f70abe57092ab441e4050fb9ca362e46c6ea0c8dee28042fae92fe8ce32048f7c8db71ca3353c15dd9ec3ae97a50203010001a3819130818e300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414fa86c9dbe0bae978f54ba8d615dff0d3e16a143c304f0603551d1f044830463044a042a040863e687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4e6574776f726b4170706c69636174696f6e732e63726c300d06092a864886f70d01010505000382010100a4f325ccd1d4918322d0cc32ab9b964e349154202534615f2a0215e18baaff7d6451cf0affbc7dd8216a78cb2f516ff8421d33bdebb57b94c3c3a9a02ddfd1291f1dfe8f3fbba8452a7fd16e5524e2bb02fb313fbee8bcec402bf801d45638e4ca4482b56120216765f6f00be734f8a5c29ca35c401f85939506de4fd427a9b6a5fc16cd73313fb86527cfd4531af0ac6e9f4f050c0381a78429c45abd645772ad3bcf3718a698c6ad06b4dc08a304d529a4969a12674a8c60459df1239ab0009c68b59850d3ef8e2e9265b1483e21be15302a0db50ca36b3fae7f57f51f967cdf6fdd82302c651b404acd68b972ec7176ec548e1f850c016afaa638ac1fc484	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\253F775B0E7797AB645F15915597C39E263631D1	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6A6F2A8B6E2615088DF59CD24C402418AE42A3F1\Blob = 0300000001000000140000006a6f2a8b6e2615088df59cd24c402418ae42a3f109000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703080b000000010000005200000065005300690067006e0020004100750073007400720061006c00690061003a0020005000720069006d0061007200790020005500740069006c00690074007900200052006f006f00740020004300410000002000000001000000a8030000308203a43082028ca00302010202106f1c92c453004145ca9f7d896f1823e0300d06092a864886f70d0101040500305d31183016060355040a130f655369676e204175737472616c6961311f301d060355040b13165075626c6963205365637572652053657276696365733120301e060355040313175072696d617279205574696c69747920526f6f74204341301e170d3032303532343030303030305a170d3132303532333233353935395a305d31183016060355040a130f655369676e204175737472616c6961311f301d060355040b13165075626c6963205365637572652053657276696365733120301e060355040313175072696d617279205574696c69747920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a46daef21df44173ae6fc5c44466f3bcb1da860dc675444d467c17c467a707b47c55e30e50f6966741bf8d0603919e0fa7234da76e7de4f899489c7bb4e693a5ecf3ba9254d15aa58ba8698861bb6e60c531a63657ad8e678c0eba25818048d464a5baa046862a259de33ddc1b5a2c0c44352e56e36c7dcd87183b147d2b8f76425d99297d3d4ca5540bc20235854fcdc69e727071ca6b9278cbb87b8e9e3ec2e6a133c571df2d68f58f44f7fe0810d5a0387f914472406a0f049d0f262580390adf19e30b5c1270d5b96016b8945ade34f622ae3ba755a68ec0fbff7d39f7167d4a42f361c96089ee279703af350f602bf0e46e8fde45ecc7940f4e4d13165f0203010001a360305e300f0603551d13040830060101ff020108300b0603551d0f040403020106301d0603551d0e04160414cd1742be54a4b5fad1a8c0364af084016c2a552e301f0603551d23041830168014cd1742be54a4b5fad1a8c0364af084016c2a552e300d06092a864886f70d01010405000382010100070a3943ecce382c0af0a82d1256c3e5dfa0d79a24bff9a9f606b2eff4b786e01ba3705bba9204bd54f3e5d90c73b3112e7ba4c8d37495a04ce0f32d17dcef17ce37e78e9d92593c7f1231e2412d92f8228ffcd9cfe2939860b2c27dac5ea5abfefa05d1f11a1e484c70ffaaa7038d4f73d24b166ce1e3cefa594e3c1fd7acca91020a8df595efc1344929778bf77a53f70e64e4fd5f80b3e3dee89bbd91df5fb22254ae8ebdc28b9470a571b24d5f3bc628ef5c652a20429e5108fec509316a3942dce0166bc797cf9a5f3264e94aa120c449731747d883e64e34d859c262c720d76d11272e1e24ffb1186dcaf215c97f98cb6058758124a3c961ccbb508ba9	updroots.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\99A69BE61AFE886B4D2B82007CB854FC317E1539	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\00EA522C8A9C06AA3ECCE0B4FA6CDC21D92E8099	updroots.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E0AB059420725493056062023670F7CD2EFC6666	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97226AAE4A7A64A59BD16787F27F841C0A001FD0	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\67248980DE775D2C9B04E40307940BADB351F395\Blob = 03000000010000001400000067248980de775d2c9b04e40307940badb351f395090000000100000020000000301e06082b0601050507030106082b0601050507030206082b060105050703040b000000010000000c00000043004500530041004d0000002000000001000000c6030000308203c2308202aaa003020102020101300d06092a864886f70d01010505003048310b30090603550406130246523110300e060355040a0c074e41544958495331173015060355040b0c0e3030303220353432303434353234310e300c06035504030c05434553414d301e170d3039303133303134313933315a170d3139303133303134313933315a3048310b30090603550406130246523110300e060355040a0c074e41544958495331173015060355040b0c0e3030303220353432303434353234310e300c06035504030c05434553414d30820122300d06092a864886f70d01010105000382010f003082010a0282010100a2ac184f006af0eb7444c4f5a3cd07d8935c50d6d3832cf8d67dfe53f587784ced5cde8b8b66899a037ec794120f8ad8bf3d641ec9805f3ced1ae08d0058a116bae33e62c0ad4eae2c5b486768a297f468a9a41d9cc268a0212d23113683a91a40ee20d3b499e398403a0c7fc1709b55cc674ab5c07f452ad12e6ce041fbc37fd544e23613119923733b9dba30c748d4d7a4fccc9c3fa49c53a068948cb1581a5f9fcf793cc4c6dfd95352639e1c48ad996b938881d216fd7742334c64f53dd0ced5d19ee8f79979092dfb3e1f39e9db5a340eea37e9081dad37b976cd9fc9fdf1633285834d96e0e818203715bdf7c5c2add41e4e19cd13da2f4cb251de325f0203010001a381b63081b3300f0603551d130101ff040530030101ff301d0603551d0e0416041470389ecab00deac8cf255380241ae326ce84ff22301f0603551d2304183016801470389ecab00deac8cf255380241ae326ce84ff2230500603551d2004493047304506072a817a01630c0b303a303806082b06010505070201162c68747470733a2f2f636573616d2e6e6174697869732e636f6d2f50432f50435f434553414d5f56312e706466300e0603551d0f0101ff040403020106300d06092a864886f70d0101050500038201010004969c5148da22bac8e65506fdf79a8a8a29c29258b7850788243340aff15a7478eb4133b180d55dbfb697dbe015d322fed934ca2b2e4a0082e23a84282c3a866738f035a73b019c4b6d4ff8f1e18d113a2427317c47ecce4baa4f9987c08b8b855f90cb8103e9a106a260675cd349ad4f81a78305ca0d9d3ece25cb1aa35f6a0558a98f117edf19e3dcf419e86832bc2a04d68aa65a9fa168f8002bc10127a80f0cc4992d3804bccd45b475b027d110d6947b29fc24be6613ad0170e4a6b2991078583e0bf9008349c658b4b70a6850a81a6f28974a2674240342a325e83e35db3ffc647bd70815eeab9004025c65b0559c6a6bf6bd8bd1dc130512801a482f	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474\Blob = 53000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b000000010000003600000047005400450020004300790062006500720054007200750073007400200047006c006f00620061006c00200052006f006f007400000009000000010000002a000000302806082b0601050507030406082b0601050507030206082b0601050507030106082b0601050507030303000000010000001400000097817950d81c9670cc34d809cf794431367ef47420000000010000005e0200003082025a308201c3020201a5300d06092a864886f70d01010405003075310b300906035504061302555331183016060355040a130f47544520436f72706f726174696f6e31273025060355040b131e475445204379626572547275737420536f6c7574696f6e732c20496e632e312330210603550403131a475445204379626572547275737420476c6f62616c20526f6f74301e170d3938303831333030323930305a170d3138303831333233353930305a3075310b300906035504061302555331183016060355040a130f47544520436f72706f726174696f6e31273025060355040b131e475445204379626572547275737420536f6c7574696f6e732c20496e632e312330210603550403131a475445204379626572547275737420476c6f62616c20526f6f7430819f300d06092a864886f70d010101050003818d0030818902818100950fa0b6f0509ce87ac788cddd170e2eb094d01b3d0ef694c08a94c706c89097c8b8641a7a7e6c3c53e1372873607fb29753079f53f96d5894d2af8d6d886780e6edb295cf7231caa51c72ba5c02e76442e7f9a92cd63a0dac8d42aa240139e69c3f0185570d588745f8d385aa936926857048803f1215c779b41f052f3b62990203010001300d06092a864886f70d0101040500038181006deb1b09e95ed951db672261a42a3c4877e3a07ca6de73a21403853dfbab0e30c58316338113089e7b344edf40c874d7b97ddcf476557d9b635418e9f0eaf35cb1d98b421eb9c0954ebafad5e27cf56861bf8eec05975f5bb0d7a38534c424a70d0f9593efcb94d89e1f9d5c856dc7aaae4f1f22b5cd95adbaa7ccf9ab0b7a7f	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4054DA6F1C3F4074ACED0FECCDDB79D153FB901D	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 53000000010000002400000030223020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c00b000000010000001e00000045006e007400720075007300740020002800320030003400380029000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d343120000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551	updroots.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DE3F40BD5093D39B6C60F6DABC076201008976C9	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A0F8DB3F0BF417693B282EB74A6AD86DF9D448A3\Blob = 0b000000010000002c00000050006f00730074005300690067006e0075006d00200052006f006f007400200051004300410020003200000009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070308030000000100000014000000a0f8db3f0bf417693b282eb74a6ad86df9d448a32000000001000000a00500003082059c30820484a003020102020164300d06092a864886f70d01010b0500305b310b300906035504061302435a312c302a060355040a0c23c48c65736bc3a120706fc5a174612c20732e702e205b49c48c2034373131343938335d311e301c06035504031315506f73745369676e756d20526f6f74205143412032301e170d3130303131393038303433315a170d3235303131393038303433315a305b310b300906035504061302435a312c302a060355040a0c23c48c65736bc3a120706fc5a174612c20732e702e205b49c48c2034373131343938335d311e301c06035504031315506f73745369676e756d20526f6f7420514341203230820122300d06092a864886f70d01010105000382010f003082010a0282010100a05cfcc81c5fda07f5b8dd06197927bc61f0baba69e0bc3764f59907a9c40431a34862172b43abe976b7653fad5434de5148d3d77dc6ed5b39d43eb3fd2856cbef53edad5fe972276a47b0c858fc3d3d04759e2d0326cd61d1143bf752860d96bd4c9f65f5c7d239a6666eaa503cb455f2907e2c967214118bf031eb35da536f97de15c17ef44caf997ace0c585404c4cb109f38b33d6b953a961a720837f61a0e9d3dce42cba4306061a96044757f32c6b0df6cb5dbad93094fd770c75354a9e96e72c2d7cba3061a5756ea38e74045b02827babc2cee84063c8856bd37985bac3da3023b37049f7ccbe5769f927337e95aad766ab389647edd4440520a84d30203010001a3820269308202653081a50603551d1f04819d30819a3031a02fa02d862b687474703a2f2f7777772e706f73747369676e756d2e637a2f63726c2f7073726f6f74716361322e63726c3032a030a02e862c687474703a2f2f777777322e706f73747369676e756d2e637a2f63726c2f7073726f6f74716361322e63726c3031a02fa02d862b687474703a2f2f706f73747369676e756d2e7474632e637a2f63726c2f7073726f6f74716361322e63726c3081f10603551d200481e93081e63081e30604551d20003081da3081d706082b060105050702023081ca1a81c754656e746f206b76616c6966696b6f76616e792073797374656d6f767920636572746966696b61742062796c20767964616e20706f646c65207a616b6f6e61203232372f3230303053622e2061206e6176617a6e7963682070726564706973752f54686973207175616c69666965642073797374656d2063657274696669636174652077617320697373756564206163636f7264696e6720746f204c6177204e6f203232372f32303030436f6c6c2e20616e642072656c6174656420726567756c6174696f6e7330120603551d130101ff040830060101ff020101300e0603551d0f0101ff040403020106301d0603551d0e0416041415298cc54569abb8b3c3eafe4bb831d8dcf0e7763081830603551d23047c307a801415298cc54569abb8b3c3eafe4bb831d8dcf0e776a15fa45d305b310b300906035504061302435a312c302a060355040a0c23c48c65736bc3a120706fc5a174612c20732e702e205b49c48c2034373131343938335d311e301c06035504031315506f73745369676e756d20526f6f74205143412032820164300d06092a864886f70d01010b050003820101005e2ada0b40a16a5891202cdc4f6d034de4e4e36e939310492ada3148d2d521b51c7fffacf0baa242cdf3bf2aa82052b1c171af8657fa9770dccd025cadc8cef57ccbff57080bf600474cdfc8148c35d3425b722236df21504dd17f52811f2bf9be2057e2af14918bc2d11117571d311bbf0c4c5c8cd95579685af5fae14c16b5fe13bf0e5b0283e3d0ed59da5cb868c4c04f66becbecf5f38521b99fe81b23307886a498533b33b46b3648b9d3b8e248b4f3b9a14c0a9c96397ed42c887363ac4a766e6240b8d3bc4c67d894ef54284563e8d4bbf1b4cc074bc9e538bda5dd426d40f0012224f4ddd19f4b0312fa4aada2ada2cd377ebe37210afedb3798f2cb	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5F3B8CF2F810B37D78B4CEEC1919C37334B9C774\Blob = 0300000001000000140000005f3b8cf2f810b37d78b4ceec1919c37334b9c774090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b00000001000000380000005300450043004f004d002000540072007500730074002000530079007300740065006d007300200043006f0020004c00740064002e00000053000000010000002400000030223020060a2a83088c9b1b6485510130123010060a2b0601040182373c0101030200c020000000010000007b030000308203773082025fa003020102020100300d06092a864886f70d01010b0500305d310b3009060355040613024a5031253023060355040a131c5345434f4d2054727573742053797374656d7320434f2e2c4c54442e31273025060355040b131e536563757269747920436f6d6d756e69636174696f6e20526f6f74434132301e170d3039303532393035303033395a170d3239303532393035303033395a305d310b3009060355040613024a5031253023060355040a131c5345434f4d2054727573742053797374656d7320434f2e2c4c54442e31273025060355040b131e536563757269747920436f6d6d756e69636174696f6e20526f6f7443413230820122300d06092a864886f70d01010105000382010f003082010a0282010100d0153952b152b3bac55982c45d52ae3a4365804bc7f296bcdb3697d6a6648ca85ef0e30a1cf7df973d4baef65dec21b541abcdb97e769fbef93e3634a03bc1f631114574933d5780c5f98999cae5ab6ad4b5da419010c1d6d64289c2bff43812954c5405f736e445837b1465d6dc0c4dd1de7e0cab3bc415be3a56a65a6f766952a97ab9c8eb6a9a5d52d02d0a6b3516091084d06aca3a06003747e47e574f3f8beb67b888aac5be5355b291c47db9b0851906782edb611afa85f54a91a1e716d58ea239df94b8701f283f8bfc405e63833c832a1a996bcfde596a3bfc6f16d71ffd4a10eb4e82163aac270c53f1add524b06b0350c12d3c16dd4434271a75fb0203010001a3423040301d0603551d0e041604140a85a9776505987c4081f80f972c38f10aec3ccf300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101004c3aa344acb945b1c7937ec80b0a42df64ea1cee596c08ba895f6aca4a959e7a8f07c5da457282710e3ad2cc6fa7b4a123bbf6249fcb17fe8ca6cec2d2dbcc8dfc71fc0329c16c5d335f64b6653b896f187678f5dca2481f193f8e93ebf1fa17eecd4ee3041255d6e5e4ddfb3e057ce21d5ec6a7bc974f683af5e92e0a43b6af575c62687cb7fda38a84a0ac62be2b098734f06a01bb9b29563cfe0037cf236cf14eaab67446126c91ee34d5ec9a91e744be903172d54902f602e5f41feb7cd99655a9ffec8af99947ff355a02aa04cb8a5b87712991bda4b47a0dbd9af55723000721173f4a39d105490ba7b63781a55d8caa335e81287ca77d27eb00ae8d37	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 53000000010000002400000030223020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c00b000000010000001e00000045006e007400720075007300740020002800320030003400380029000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d343120000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551	updroots.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A1E7C600AA4170E5B74BC94F9B9703EDC261B4B9	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c5436090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b00000001000000120000004400690067006900430065007200740000002000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3921C115C15D0ECA5CCB5BC4F07D21D8050B566A	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A1DB6393916F17E4185509400415C70240B0AE6B\Blob = 030000000100000014000000a1db6393916f17e4185509400415c70240b0ae6b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b000000010000008e00000056006500720069005300690067006e00200043006c006100730073002000330020005000750062006c006900630020005000720069006d006100720079002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200028005000430041003300200047003100200053004800410031002900000053000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c02000000001000000400200003082023c308201a502103c9131cb1ff6d01b0e9ab8d044bf12be300d06092a864886f70d0101050500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830323233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c95c599ef21b8a0114b410df0440dbe357af6a45408f840c0bd133d9d911cfee02581f25f72aa84405aaec031f787f9e93b99a00aa237dd6ac85a26345c77227ccf44cc67571d239ef4f42f075df0a90c68e206f980ff8ac235f702936a4c986e7b19a20cb53a585e73dbe7d9afe244533dc7615ed0fa271644c652e816845a70203010001300d06092a864886f70d010105050003818100107252a9051419320841f0c56b0acc7e0f2119cde467dc5fa91be6cae8739d22d8986e73036191c57cb045406e449d8db0b19674612d0da945d2a4922ad69a75976e3f53fd4599601da82b4cf95ea709d87530d7d265603d67d6485575693f91f5480b476922698296bec9c838864a7a2c731948694e6b7c65bf0ffc70ce8890	updroots.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\24BA6D6C8A5B5837A48DB5FAE919EA675C94D217	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9BAAE59F56EE21CB435ABE2593DFA7F040D11DCB	updroots.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4ABDEEEC950D359C89AEC752A12C5B29F6D6AA0C	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\42EFDDE6BFF35ED0BAE6ACDD204C50AE86C4F4FA	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D2441AA8C203AECAA96E501F124D52B68FE4C375	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7998A308E14D6585E6C21E153A719FBA5AD34AD9\Blob = 0300000001000000140000007998a308e14d6585e6c21e153a719fba5ad34ad909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703090b00000001000000640000005400550052004b0054005200550053005400200045006c0065006b00740072006f006e0069006b00200053006500720074006900660069006b0061002000480069007a006d006500740020005300610067006c00610079006900630069007300690000002000000001000000ff030000308203fb308202e3a003020102020101300d06092a864886f70d01010505003081b7313f303d06035504030c3654c39c524b545255535420456c656b74726f6e696b20536572746966696b612048697a6d6574205361c49f6c6179c4b163c4b173c4b1310b300906035504060c025452310f300d06035504070c06414e4b41524131563054060355040a0c4d28632920323030352054c39c524b54525553542042696c676920c4b06c657469c59f696d2076652042696c69c59f696d2047c3bc76656e6c69c49f692048697a6d65746c65726920412ec59e2e301e170d3035303531333130323731375a170d3135303332323130323731375a3081b7313f303d06035504030c3654c39c524b545255535420456c656b74726f6e696b20536572746966696b612048697a6d6574205361c49f6c6179c4b163c4b173c4b1310b300906035504060c025452310f300d06035504070c06414e4b41524131563054060355040a0c4d28632920323030352054c39c524b54525553542042696c676920c4b06c657469c59f696d2076652042696c69c59f696d2047c3bc76656e6c69c49f692048697a6d65746c65726920412ec59e2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100ca5205d66303d81c5fddd27b5df20c60615b6b3b742b780d7d45bd2274e88c03c1c6112a3d95bca994b0bb9197c8697c84c5b4916c6c136aa455ada485e8957eb300af00c20518f5709d368baecbe41b817f9388fb6a55bb7d8592ceba589fdb32c5bd5def224a2f41077e4961b386ec4ea6416e84bc03ecf53b1cc81fc2eea8eeea124a8d14cff30ae05039f90835f81159ade722ea4bca1406de42bab299f32d54881006eae11a3e3d671ffbcefb7c82e8115d4ac1b914ea54d9669b7c897d049a62c9e9523c9e9cefd2f526e4e6e5187c8b6edf6ccc785b4f72b2cb5c3f8c058dd14c8cad92c7e1787f656c4906502c9e32c2d74ac6758a594e756f475ec10203010001a310300e300c0603551d13040530030101ff300d06092a864886f70d0101050500038201010015f555ff3796805921a4fca1154c20f6d45fda0324fccf901af4210a9aee3ab16aefeff860d14c3666451df3660274047b9230a8de0a760fef956ebdc937e61a0dac89485bcc8336c2f5465c598256b4d5fe23b4d8541c44abc4a7e514ce3c41617c43e6cdc481098b24fb5425d616a8960c67076fb35047e31c2428dd2a98a461fedbea1237bc011a3485bd6e4fe791720744851e58ca5444ddf7acb9cb892172db8fc06929972aa3ae1823971c412a8b7c2ac17c90e8a928c0d391c6ad28874068b5ffeca7d2d338189cd37d695df0c6a51e241ba347fc690768e7e49ab4ed0fa1878702ce87d2484ee1bcffcbf1729244640325eade5b6e9fc9f24eacddc7	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\80BF3DE9A41D768D194B293C85632CDBC8EA8CF7\Blob = 0b000000010000003a00000043006f006d005300690067006e00200041006400760061006e00630065006400200053006500630075007200690074007900200043004100000009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030303000000010000001400000080bf3de9a41d768d194b293c85632cdbc8ea8cf720000000010000001f0600003082061b30820403a00302010202107a5de933d0049eb34a1a1774cb169b6d300d06092a864886f70d01010505003027312530230603550403131c436f6d5369676e20416476616e636564205365637572697479204341301e170d3034303332343231353230345a170d3239303332343231353535355a3027312530230603550403131c436f6d5369676e20416476616e63656420536563757269747920434130820220300d06092a864886f70d01010105000382020d003082020802820201009d9c5c3b0184575af42bfe6d14b26cb7ed90d7fb5743a0cf601b592f4d51603d1c49a26a4163abb8ed66be40468daa925b3d2e2bc16198546cbc4cab69fa8d4545812a1a6df8b3f80f63cb8e7ced5429a31418fce1c9b1d854ba9cca2a1bd0acc28918164afe4a04d2d29bb58786c1c97b1f361645b9f0ba86c2778a333142a2ce0c723d12e59138f42767614ccce2f54d2c12f0cdb384c109759f004ff877d3f3326f818f177e3b9b6bf31ee7fa934f0c2e97dd7058137df391838da23d31da63e339767633e6d4660d948e15949c387bdc711fdab5e0d7975a8274de3b06daefc52bf168dd2753f8b9ec8c0f5322e43982e4f9ae61fc18287ec769e968f47ee0d1bce06dc8d6d1ab443161b4ec78352c46dee8f3b63c98b3a91c074a98cd472682f0d491ef1093e768e6526a977eb9209717fa193294239ec773b248e898b5f77556a04b9d77a81a29743858e0c8cdb1331b2ffe989378050174abae42c51b1d2f7c417ca5d360aa50c1f3c8884158f6b59218fdae668e9ce73b9ad1b7dbdac74ccb221b4a3f60df39f6daeaaecc8795b8529b5a9d51450c76ef2941a50ab9f85ec4bd2c4c344847d58bc8cccfd13b58e57ac6fd21ec7729aff35a540ea9a4647cf75cd1a113e53bd45b4b0094c9cb0ddd044fdb68b2b76723f661a5ac0f393e9ac32fa964c312859aa4a252d479fcba23ab091aed3d999dd9e728f80f504f020103a38201433082013f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414e9fa27e5ed4b217064d671aa7ce5821c30d20d7a304d0603551d1f044630443042a040a03e863c687474703a2f2f66656469722e636f6d7369676e2e636f2e696c2f63726c2f436f6d5369676e416476616e636564536563757269747943412e63726c301006092b0601040182371501040302010030420603551d20043b3039303706092a030405060708090a302a302806082b06010505070201161c687474703a2f2f7777772e636f6d7369676e2e636f2e696c2f637073305b06082b06010505070101044f304d304b06082b06010505073002863f687474703a2f2f66656469722e636f6d7369676e2e636f2e696c2f6361636572742f436f6d5369676e416476616e636564536563757269747943412e637274300d06092a864886f70d010105050003820201009c8d5d9a0611a16e16184fcbb2023b928f1d26a5cbeb48ee551daa10e0694ec1fe3200de0fce0db463bce0621ae0f7f5a9e5c954148b40f8adf36d02ec8e7bdca5799201b5ffa159633911b5be52ae74dad921a312d8c795f8db6f5655bf9512bd3223c7c96c6501effb748ebb24864f7dddf05a8f3b848c797529f486b6d3c10c5915c20357ab3d48d72c459440dce0a94b5fcc10d796bfa99c032a64f2bc7ef8a5a799912705fe49a7d8ad0a86363c0e3da6e17c6a81117b45bb688d3531fd2653413e3c6e6b1ed8ab2d898199c61f97f35af51f61bdfe1559930adefa51fa46df46f4fc626c58a30cdec9191ec01c5b383b418f05310eaeed2c5db70fdc39c45f22b3a5b2583024bff909adf0961b376f4066feb72a89d5c6e37e0358b07d38e68aab3ff581f30a41770273eda754dd07315cb6b576927477b96fa609ba0edd0ce776c44bbecb3bd545c089e32b777a6298c35bfc7d575e8eeedd1b50216d91bf195c8f97792ac18b616faa5e52f5e94f349830bd1c07c3b7c47c81d9a3433266c62dbc395ba95d89eb042b449547f952f44f05eea32a63110d1ebac4f84a5b504051772ef4e4dff10314e67969da584482581483913403d77a6d6ad1322229911b1ae40bbd32152720bf1a6f5282d3f92f490f906c018049ae18ee322cce11c7fea004986894f0fc8bc52c6f87fdd9c2c41ce92dcc0eac9ff5f1fc92388d	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\342CD9D3062DA48C346965297F081EBC2EF68FDC\Blob = 0b000000010000008e00000041007500730074007200690061006e00200053006f0063006900650074007900200066006f007200200044006100740061002000500072006f00740065006300740069006f006e00200047004c004f00420041004c00540052005500530054002000430065007200740069006600690063006100740069006f006e00200053006500720076006900630065000000090000000100000074000000307206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030606082b0601050507030706082b0601050508020206082b06010505070308060a2b0601040182370a0304060a2b0601040182370a030c06082b06010505070309030000000100000014000000342cd9d3062da48c346965297f081ebc2ef68fdc200000000100000002080000308207fe308205e6a003020102020100300d06092a864886f70d01010505003081d4310b3009060355040613024154310f300d060355040713065669656e6e613110300e0603550408130741757374726961313a3038060355040a13314152474520444154454e202d20417573747269616e20536f636965747920666f7220446174612050726f74656374696f6e312a3028060355040b1321474c4f42414c54525553542043657274696669636174696f6e2053657276696365311430120603550403130b474c4f42414c54525553543124302206092a864886f70d0109011615696e666f40676c6f62616c74727573742e696e666f301e170d3036303830373134313233355a170d3336303931383134313233355a3081d4310b3009060355040613024154310f300d060355040713065669656e6e613110300e0603550408130741757374726961313a3038060355040a13314152474520444154454e202d20417573747269616e20536f636965747920666f7220446174612050726f74656374696f6e312a3028060355040b1321474c4f42414c54525553542043657274696669636174696f6e2053657276696365311430120603550403130b474c4f42414c54525553543124302206092a864886f70d0109011615696e666f40676c6f62616c74727573742e696e666f30820222300d06092a864886f70d01010105000382020f003082020a0282020100d21247ec5f98e80d861549c4ddec9ef16ccd51b6fb954f8bc4903d5333b1d313c548e2a5bff5f403840f9c7871f69297f15b5975183f270b512f5c68c7a1eb00f3f6953d69c37ec2acc40a36727a5ba6d0f7017b28c72ac73260ee59b8d70b27ddb345052b7b64a7735ce893029768ecfc84db9ed4d58147c69cc0ac97cb19ea87a50aa3b87524e750270dab16f9565db18101167df3e9e124f30821b9baac5d9ec748797f6acadf3977046d1b6e3acd7fce5c48ac123c59f26acf8048e1f600677820e0fdb5647b1797b3e527dd456b9b619906bef2e79ea46d8b3b6b0c81eeb46fa1be1a12414b9ead0ef946b45ad103009416c0c0f3acfb7cbc96c029d8f9331689a30e1d95d903d4210cdd56084965c88dab211f54bb99bcf1445b7b0018fd2a1958d205c9d9293625fe77ee6b59544f0814a299094557ad07de22fc871ca0efa079dd0a7dc07f35e80c664de3b56a1659715bf390b0525e9102c7a8b9c2046f9e4fb4002dec08ecae406ef029272239b6cda08610ba0b35ec7b5a0db679c3fac7adc1fbebed2b840deadef9eb9a59336cc12b128cb83ec53623381ad6779390d677756a581917a1158e6e760ea373e15c9549dbc10f9414c5d5621b99ab38d5676ed2a919e15a3a876a483f9196e3c6c5276b57743198f63e7171ed7edeb04d2cf3ee8fdb7b68d7104429adecab5059529a6c6a72144d161451f7d77e1f0203010001a38201d7308201d3301d0603551d0e04160414c001d5e0781f2f743ae3ebc02152a604ee26cba4308201010603551d230481f93081f68014c001d5e0781f2f743ae3ebc02152a604ee26cba4a181daa481d73081d4310b3009060355040613024154310f300d060355040713065669656e6e613110300e0603550408130741757374726961313a3038060355040a13314152474520444154454e202d20417573747269616e20536f636965747920666f7220446174612050726f74656374696f6e312a3028060355040b1321474c4f42414c54525553542043657274696669636174696f6e2053657276696365311430120603550403130b474c4f42414c54525553543124302206092a864886f70d0109011615696e666f40676c6f62616c74727573742e696e666f820100300f0603551d130101ff040530030101ff300b0603551d0f0404030201c630110603551d20040a300830060604551d2000303d0603551d11043630348115696e666f40676c6f62616c74727573742e696e666f861b687474703a2f2f7777772e676c6f62616c74727573742e696e666f303d0603551d12043630348115696e666f40676c6f62616c74727573742e696e666f861b687474703a2f2f7777772e676c6f62616c74727573742e696e666f300d06092a864886f70d01010505000382020100153b88835e0ede3ef03e5ddc2da14afa28a5d607a52448ce9e79e8799a5c248e5872144185c745ee3c28693849ae228dbb8c056dae65bb87b97e763b28636ad66f3330887e5505bab91503981d62d2cec00f6e1c9a34eee4af1f62d1ecb479cfcf69928a58fdc1c7760b5ccd5234486be50b7fc93212df980a16d93356168fdf433fd7bd3fc51ec5ad21ac872c9ae41c1f8503ac8bc7b7336249c1f8aa2b4e5d873e7652ae597e31e17cba528b5890d780460b3436deef11c95c2246c23ca77f62046fdf3e488eea0b3e08ac181a52d6f1f6d4622f03b99ad63c537f5526c6352b2174b0899054e401885c9c852a9a655e4b57f2801cec67349a46dc0276fe72377209b1f0238f58b3027dee780eb93d73122d559f1763afaed8ae73b6c7506a85c1db7dfb945970c6c3076c56c5b007fc4e7d931db927c0b095d5e77c05bcf70f0ab3f46e1557491bb51400a4302b5af45658bf7634a23dfe0126f0ddb86df0a4e7bc20f65108f6e337895736f6f72ffecdb864bdead7a6d0ff78ef7ee11c1e547e0f3419811073d2e3780617b6d251fb357876da778337413e2d46a87e86de56f4ca909eb4adb01e45183c34880287e8f03691ebf2e7b5d204b92eb85d8d1d9a2e0b1619cd76a4abfbd1e2a3a2dc847d7bea50eaf5b2043b89523ab2c3194fb926b1bcbc2cb2e181a6b361b5f445602f2c75c5c82d884b26bb70ee3b7f012d	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B38FECEC0B148AA686C3D00F01ECC8848E8085EB	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DBAC3C7AA4254DA1AA5CAAD68468CB88EEDDEEA8	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D2EDF88B41B6FE01461D6E2834EC7C8F6C77721E	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D23209AD23D314232174E40D7F9D62139786633A\Blob = 5300000001000000230000003021301f06092b06010401f022010630123010060a2b0601040182373c0101030200c00b0000000100000012000000470065006f00540072007500730074000000090000000100000020000000301e06082b0601050507030406082b0601050507030106082b06010505070303030000000100000014000000d23209ad23d314232174e40d7f9d62139786633a2000000001000000240300003082032030820289a003020102020435def4cf300d06092a864886f70d0101050500304e310b30090603550406130255533110300e060355040a130745717569666178312d302b060355040b1324457175696661782053656375726520436572746966696361746520417574686f72697479301e170d3938303832323136343135315a170d3138303832323136343135315a304e310b30090603550406130255533110300e060355040a130745717569666178312d302b060355040b1324457175696661782053656375726520436572746966696361746520417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c15db158670862eea09a2d1f086d911468980a1efeda046f13846221c3d17cce9f05e0b801f04e34ece28a950464acf16b535f05b3cb6780bf42028efedd0109ece100144ffcfbf00cdd43ba5b2be11f80709915579316f10f976ab7c268231ccc4d5930ac511e3baf2bd6ee63457bc5d95f50d2e3500f3a88e7bf14fde0c7b90203010001a38201093082010530700603551d1f046930673065a063a061a45f305d310b30090603550406130255533110300e060355040a130745717569666178312d302b060355040b1324457175696661782053656375726520436572746966696361746520417574686f72697479310d300b0603550403130443524c31301a0603551d1004133011810f32303138303832323136343135315a300b0603551d0f040403020106301f0603551d2304183016801448e668f92bd2b295d747d82320104f3398909fd4301d0603551d0e0416041448e668f92bd2b295d747d82320104f3398909fd4300c0603551d13040530030101ff301a06092a864886f67d074100040d300b1b0556332e3063030206c0300d06092a864886f70d01010505000381810058ce29eafcf7deb5ce02b917b585d1b9e3e095cc25310d00a6926e7fb692639e5095d19a6fe411de63856e98eea8ff5ac8d355b2667157dec021eb3d2aa72349010486427bfcee7fa21652b56767d340db3b2658b228773dae147761d6fa2a6627a00dfaa7735cea70f1942165445ffafcef2968a9a28779ef79ef4fac077738	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85A408C09C193E5D51587DCDD61330FD8CDE37BF\Blob = 03000000010000001400000085a408c09c193e5d51587dcdd61330fd8cde37bf090000000100000016000000301406082b0601050507030406082b060105050703010b0000000100000036000000440065007500740073006300680065002000540065006c0065006b006f006d00200052006f006f0074002000430041002000320000002000000001000000a30300003082039f30820287a003020102020126300d06092a864886f70d01010505003071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f742043412032301e170d3939303730393132313130305a170d3139303730393233353930305a3071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f74204341203230820122300d06092a864886f70d01010105000382010f003082010a0282010100ab0ba335e08b2914b11485af3c10e4396f355d4aaeddea618d9549f46f64a31a6066a4a9402284d9d4a5e578930e6801adb94d5c3aced3b8a84240dfcfa3ba82596a921bac1c9ada082b2527f9692347f1e0eb2c7a9bf51302d07e347cc29e3c0059abf5da0cf5323c2bac50dad6c3de8394caa80c99320e0848565b6afbdae1585801495f72413c1506018e5dadaab893b4cd9eeba7e86a2d5234db3aef5c7551dadbf331f9ee719832c45415440cf99b55edaddf1808a0a3868a49ee53058f194cd5de58799bd26a1c42abc5d5a7cf680f96e4e161987661c8917cd63e00e2915087e19d0ae6ad97d21dc63a7dcbbcda0334d58e5b01f56a07b716b66e4a7f0203010001a3423040301d0603551d0e0416041431c3791bbaf553d717e0897a2d176c0ab32b9d33300f0603551d13040830060101ff020105300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100946459ad3964e729eb13fe5ac38b1357c80424f07477c060e367fbe989a683bf96827c6ed4c33def9e806ebb29b4987ab13b54eb3917477e1a8e0bfc1f31593104b2ce17f32cc7623655e222d88955b49848aa64fad61c36d844785a5a233a5797f57a304fae9f6a4c4b2b8ea003e33ee0a9d4d27bd2b3a8e2723cad9eff8059e49b45b4f63bb0cd39199832e5ea216190e431218e34b1f72f354a8510dae78a3721be5963e0f285883153d45414857079f42e067727752f1fb88af9fec5bad836e483ece765b7bf635af346af819437d4418cd623d61ecff5681b4463a25abaa73559a1e570059b0e235799940a6dba3963288692f31884d8fbd1cf05566457	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85\Blob = 0b00000001000000320000004d006900630072006f0073006f00660074002000540069006d0065007300740061006d007000200052006f006f007400000009000000010000000c000000300a06082b06010505070308030000000100000014000000245c97df7514e7cf2df8be72ae957b9e04741e852000000001000000b1020000308202ad30820216020101300d06092a864886f70d010104050030819e3120301e060355040a13174d6963726f736f6674205472757374204e6574776f726b311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e312d302b060355040b13244d6963726f736f66742054696d65205374616d70696e67205365727669636520526f6f74312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e301e170d3937303531333136313235395a170d3939313233303233353935395a30819e3120301e060355040a13174d6963726f736f6674205472757374204e6574776f726b311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e312d302b060355040b13244d6963726f736f66742054696d65205374616d70696e67205365727669636520526f6f74312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e30819f300d06092a864886f70d010101050003818d0030818902818100b75a38f51f37cca943c4dc2418bef28552b41d5b5f18b90b8f4b6da8ffcd40506cd3a0d35c47c2b9f786e4cd7d350569371faf3ddd1ffd8f1534c2c479cc59748a6f8c0ec3e811eb8438479853e1f10c0de4010cf01b1e20da2a7a3dc215528e8aff7b32bf581e25988326cb8ac9c4071424bc499ed77ab3871a2533bc6d08470203010001300d06092a864886f70d010104050003818100505bc56b6f8d525b0dc9bdac347398ca0a87caae4c4aba14a4eb52709521e0b5a1604ef743025101af1e3a70cebf18b686289967eb08e897405c1682fdb825fb366f6f763ec54c8ee2a751facac163ba5e8324470b9372f6449acea7953a8f50109e1db15916abcf3edf838bc7fac36bdc649f402b1f452404ae492ff6df0c91	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E3D73606996CDFEF61FA04C335E98EA96104264A\Blob = 0b000000010000001a00000044002d0054005200550053005400200047006d00620048000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308030000000100000014000000e3d73606996cdfef61fa04c335e98ea96104264a2000000001000000eb040000308204e7308203cfa00302010202030326da300d06092a864886f70d01010505003052310b300906035504061302444531153013060355040a0c0c442d547275737420476d6248312c302a06035504030c23442d5452555354205175616c696669656420526f6f74204341203120323030373a504e301e170d3037303630383131343734365a170d3132303630383131343734365a3052310b300906035504061302444531153013060355040a0c0c442d547275737420476d6248312c302a06035504030c23442d5452555354205175616c696669656420526f6f74204341203120323030373a504e30820124300d06092a864886f70d010101050003820111003082010c028201010089d9ffd3ff37fc57881560c1bd2f681080b72d59a5a24ac70ad62f8e40377b2a32aac6b6130d20e74ffe3f0e6eadf954cf6b050bfe69f2fabc813fdeedb333bb392c74c434f6b4fac3d3d258ca79708f63e39534f839579f01748b979cadea1cbb65fd4ae62438493e9eb2c650e35cd63be9873977d9a41e0728a05d92872b4c8b75c54003bd3f400d943c3b14a7e0ae72bd2bebd2f1b0de08e2d1a411d638c24ef212771fcf48460bf817339b831f08b805e746534b887b87fcd2a33d4572e90e19b4058a6a1f370c0f0cccc8a8b95b02baf3b8a30d0fc314eb6b7b3781ea9e58d1b0b7474b053104e94c0aa1c09214bd2337d221f6e4c0ec4e997f8d8de851020500e9cc4529a38201c2308201be300f0603551d130101ff040530030101ff301d0603551d0e041604142c4cf69a2a9f288201c1990611afb34b7cb79afe303806082b06010505070101042c302a302806082b06010505073001861c687474703a2f2f7175616c2e6f6373702e642d74727573742e6e657430170603551d200410300e300c060a2b06010401a534021f0130330603551d11042c302a8110696e666f40642d74727573742e6e65748616687474703a2f2f7777772e642d74727573742e6e6574301806082b06010505070103040c300a3008060604008e460101300e0603551d0f0101ff0404030201063081d90603551d1f0481d13081ce3081cba081c8a081c5867f6c6461703a2f2f6469726563746f72792e642d74727573742e6e65742f434e3d442d54525553542532305175616c6966696564253230526f6f7425323043412532303125323032303037253341504e2c4f3d442d5472757374253230476d62482c433d44453f63657274696669636174657265766f636174696f6e6c6973748642687474703a2f2f7777772e642d74727573742e6e65742f63726c2f642d74727573745f7175616c69666965645f726f6f745f63615f315f323030375f706e2e63726c300d06092a864886f70d0101050500038201010069a9f184c8b6069d1a170765f3aa479cf772aa3daf2666e514210ece1b893e8a54c8ff36c91d2c8a11e5cdc772a4845b1e5bc33535b1b16d4baa08d4d9d4e2fd074be4565bf6ca70c875ba9c7e440e058afdd61b74d3bbd2e55ae4daf60fb21f8d54cc1565fe761a2c10b9c6d424263b0cad68496f63acac585ed617b906680cb430cce1b7e63fc0eed20f4da0d8a25f7c80c8e0178a54f7450872774a4bb329a093a0e1ca43c1732dbbdab492f15ce61026d588f186e73e1b622726ccbbcecc30decfd8baff8c82371e6c4584d923b58696970ec7aa228d4fa2fb2903b01adc105463bd9cd69e9ce41f329790d0d79abb79a3238fb475ae64c87797fa2c238d	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\51A44C28F313E3F9CB5E7C0A1E0E0DD2843758AE\Blob = 0b000000010000002200000041002d00540072007500730074002d006e005100750061006c002d00300031000000090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b0601050508020206082b0601050507030903000000010000001400000051a44c28f313e3f9cb5e7c0a1e0e0dd2843758ae2000000001000000610300003082035d30820245a003020102020300e242300d06092a864886f70d01010505003055310b30090603550406130241543110300e060355040a1307412d547275737431193017060355040b1310412d54727573742d6e5175616c2d30313119301706035504031310412d54727573742d6e5175616c2d3031301e170d3034313133303233303030305a170d3134313133303233303030305a3055310b30090603550406130241543110300e060355040a1307412d547275737431193017060355040b1310412d54727573742d6e5175616c2d30313119301706035504031310412d54727573742d6e5175616c2d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100fff51c80119e9e1e6858ccd277dbc7f48e67525058ba12a46a3b16f78c734f4c8a4af36091eb3e659929d940d52e08f0fe86d6cd65f7ddd83295074e8d3b2675db370e302823e06b64668a84d333e93d3ddba68139e6791965efea5845ffeb8c33fcbff811d92f28348a1bf52c3fbe4cb660956399b6120ef7455151cf871c0483291de97897312a4a4743b59398e5f9e4ac4df7de1c7aee7c6adb5bd8f04c9ff0ee1f3d0e51b4df1ea2140270f435cfaca953547b37d8cf4699c8fb2ccc3a2c1ddfe41c2a11e2d66882ce8d2990e681d42c267ec4f2365f2a53434950bf536ba71e6bb5938704e25a8976c83f3c71dd9ccb7f3cc696cd91fac23e664d18ba150203010001a3363034300f0603551d130101ff040530030101ff30110603551d0e040a04084e59cec702328730300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100ebd23d475854f466e5f6f57b5bb007429509025140befd88b7f798f29da8b9050f55a4998a468ab4062b083fdaaf37d7078dd07adf9d33a0a91ec9fc8a4611bd029e3e35efdc4bdff82d5bc702408a6727655e96f9b34e4e9768f255e58f19267cdf99e52f97cef2b6b6d52d3f812d60e55ac47c3698f30d6ef0de63e7e82648819f72988c669b31a47c9a866aa1fe687e3e224bf5b26a64d9b62eaffdf2b19f5bc823efee5a47315790d3e7eafd1cba27d0d605d15837d7b5a1fa0583579f55668f9d7302436fe91e62a305628aa9efb4869191aee354bc346624418dd7f6b3474640db2dfa4a6039b2e8d6a7a4e1351075b5fec352140b38dea659289110c6	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9F744E9F2B4DBAEC0F312C50B6563B8E2D93C311	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6A174570A916FBE84453EED3D070A1D8DA442829	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474	updroots.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\80BF3DE9A41D768D194B293C85632CDBC8EA8CF7	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\ED8DC8386C4886AEEE079158AAC3BFE658E394B4	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F5C27CF5FFF3029ACF1A1A4BEC7EE1964C77D784\Blob = 030000000100000014000000f5c27cf5fff3029acf1a1a4bec7ee1964c77d78409000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090b0000000100000014000000430065007200740052005300410030003100000020000000010000004e0400003082044a30820332a003020102020103300d06092a864886f70d01010505003041310b3009060355040613024b52310d300b060355040a13044b495341310f300d060355040b1306524f4f5443413112301006035504031309436572745253413031301e170d3030303330323135303030305a170d3130303330333134353935395a3041310b3009060355040613024b52310d300b060355040a13044b495341310f300d060355040b1306524f4f544341311230100603550403130943657274525341303130820122300d06092a864886f70d01010105000382010f003082010a0282010100cecfede1e8561dc94b32609b2ab7978761063468cb17aec078c5c6115b4b7c97abb96c4e2f00f6532ce9e19c5a906a3d7a3838355aad1c0a5985bbf563670913e9264fd83c5def5342de4562e43ecd72a4fab3c0e01f8e94e2652d55c115922c6ff343d43505053437a02cb4735bf12726949af5ba12ccfa7835a2ad54d5668f11eaa6194dd71335547b9197034763b0a90f68bed2f49eea8db57b44b5b92d38c900e3e5bfc675890399ff8c4b080fc20531a44d1711cec3750f6bb05fd0ac86ad7de9a088b9c612d6c03a2cd26f6c271daaff459bc603100269f906ef9f22a0383882c82411aca19e8f4dbe785fdfba3f83037d51a3f8c75da891681f1e72dd0203010001a382014b30820147301d0603551d0e04160414ff8a46723358e8488822aa1768da1648098b3591301f0603551d23041830168014ff8a46723358e8488822aa1768da1648098b3591300e0603551d0f0101ff04040302010630150603551d20040e300c300a06082a831a8c9a44020130300603551d1104293027a42530233121301f06035504030c18ed959ceab5adeca095ebb3b4ebb3b4ed98b8ec84bced84b030300603551d1204293027a42530233121301f06035504030c18ed959ceab5adeca095ebb3b4ebb3b4ed98b8ec84bced84b030120603551d130101ff040830060101ff020101300c0603551d240405300380010030580603551d1f0451304f304da04ba04986476c6461703a2f2f6469727379732e726f6f7463612e6f722e6b723a3338392f434e3d524f4f542d5253412d43524c2c204f553d524f4f5443412c204f3d4b4953412c20433d4b52300d06092a864886f70d010105050003820101002c3ca4236c42f8892847507ce3e6e7232d3636c6882a9198fb1e7c0fab9d11ad75ace45c6b31117433626fd4069111c67274982fb062fb3429af14f2c664e0bfabcb57b9619cf3624d3379d7662a51ccdc00540501567e8cb68e13f42d9951e19a78bc55514a49da5b0b82fb433ddacd9309cbb5a309c3b07d5948a29bd8fb37c36f0e37ea0597bfd26ea1c8e8c3fbf3ad32c855923442e0d412e5d4ed218ae79892ff5cd7a566aabff13a7c2dc2e0553505da916a0753d185b194c7260d1b682908c121930f6ba260b853af44d9645dd36e9b8412783118da73bfac24f8ab2dbf0e7eba7b09ca5a89a82c52cc4c74add95fb3b7d605f7415f71e56619062579	updroots.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9FAD91A6CE6AC6C50047C44EC9D4A50D92D84979	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8D1784D537F3037DEC70FE578B519A99E610D7B0\Blob = 0b000000010000005c000000470065006f005400720075007300740020005000720069006d006100720079002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790020002d002000470032000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080300000001000000140000008d1784d537f3037dec70fe578b519a99e610d7b02000000001000000b2020000308202ae30820235a00302010202103cb2f4480a00e2feeb243b5e603ec36b300a06082a8648ce3d040303308198310b300906035504061302555331163014060355040a130d47656f547275737420496e632e31393037060355040b133028632920323030372047656f547275737420496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313630340603550403132d47656f5472757374205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732301e170d3037313130353030303030305a170d3338303131383233353935395a308198310b300906035504061302555331163014060355040a130d47656f547275737420496e632e31393037060355040b133028632920323030372047656f547275737420496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313630340603550403132d47656f5472757374205072696d6172792043657274696669636174696f6e20417574686f72697479202d2047323076301006072a8648ce3d020106052b810400220362000415b1e8fd031543e5aceb87371162efd28336527d45570b4a8d7b543b3a6e5f1502c050a6cf252f7dca48b8c750631c2a21087c9a36d80bfed126c55831302825f35d5da3b8b6a5b492ed6c2c9febdd4389a23c4b48911d50ec26dfd6602ebd21a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414155f35575155fb25b2ad0369fc01a3fabe1155d5300a06082a8648ce3d04030303670030640230649659a6e809de8bbafa5a8888f01f91d346a8f24a4c0263fb6c5f38db2e4193a90ee69ddc311cb2a0a7181c79e1c73602303a56af9a746cf6fb83e033d3085fa19cc25b9f46d6b6cb910663a206e733ac3ea88112d0cbbad0920bb69e96aa040f8a	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E619D25B380B7B13FDA33E8A58CD82D8A88E0515	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CFF810FB2C4FFC0156BFE1E1FABCB418C68D31C5	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8025EFF46E70C8D472246584FE403B8A8D6ADBF5\Blob = 0b000000010000003a00000054004300200054007200750073007400430065006e00740065007200200043006c00610073007300200033002000430041002000490049000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080300000001000000140000008025eff46e70c8d472246584fe403b8a8d6adbf52000000001000000ae040000308204aa30820392a003020102020e4a4700010002e5a05dd63f0051bf300d06092a864886f70d01010505003076310b3009060355040613024445311c301a060355040a1313544320547275737443656e74657220476d624831223020060355040b1319544320547275737443656e74657220436c6173732033204341312530230603550403131c544320547275737443656e74657220436c6173732033204341204949301e170d3036303131323134343135375a170d3235313233313232353935395a3076310b3009060355040613024445311c301a060355040a1313544320547275737443656e74657220476d624831223020060355040b1319544320547275737443656e74657220436c6173732033204341312530230603550403131c544320547275737443656e74657220436c617373203320434120494930820122300d06092a864886f70d01010105000382010f003082010a0282010100b4e0bb51bb395c8b04c54c791c23863110634355273fc645c7a43dec090d1a1e20c2561ede1b370730222f6ff106f1abadd6c8ab61a32f43c4b0b22dfcc396697b7e8ae4ccc03912904260c9cc3568eeda5f90565fcd1c4d5b5849eb0e014f64fa2c3c8958d82f2ee2b068e9223b7589d6441a65f21b97261d286dace8bd591d2b24f6d68403668824007860f1f8abfe02b26bfb22fb35e616d1adf62e12e4fa356ae519b95ddb3b1e1afbd3ff151408d8096aba459d1479607daf408a0773b39396d374348d3a3729de5cecf5ee2e31c220dcbef14f7f2352d95be264d99caa0708b545bdd1d031c1ab549fa9d2c3626003f1bb394a924a3d0ab99dc5a0fe370203010001a382013430820130300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414d4a2fc9fb3c3d803d3575c07a4d024a7c0f200d43081ed0603551d1f0481e53081e23081dfa081dca081d98635687474703a2f2f7777772e747275737463656e7465722e64652f63726c2f76322f74635f636c6173735f335f63615f49492e63726c86819f6c6461703a2f2f7777772e747275737463656e7465722e64652f434e3d5443253230547275737443656e746572253230436c61737325323033253230434125323049492c4f3d5443253230547275737443656e746572253230476d62482c4f553d726f6f7463657274732c44433d747275737463656e7465722c44433d64653f63657274696669636174655265766f636174696f6e4c6973743f626173653f300d06092a864886f70d010105050003820101003660e470f7062043d9231a42f2f8a3b2b94d8ab4f3c29a55317cc43b679ab4df4d0e8a934a178b1b8dca89e1cf3a1eac1df19c32b48e5976a241852537a013d0f57c4ed5ea96e26e72c1bb2afe6c6ef8919846fcc91b575beac81a3b3fb051983c07da2c5901da8b44e8e174fda768dd54ba8346ecc846b5f8af97c03b091c8fce72963d335670bc96cbd8d57d209a839f1adc39f1c572a31103fd3b425229dbe801f79b5e8cd68d864e19fabc1cbec521a5879e782e36db0971a37234f86ce30609f25e56a5d3dd98fad4e606f4f0b620634bea29bdaa82661efb81aaa737ad1318e692c381c133bb881ea1e7e2b4bd316c0e513d6ffb965680e23617d1dce4	updroots.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\971D3486FC1E8E6315F7C6F2E12967C724342214\Blob = 0b000000010000002800000056002e012000520065006700690073007400720073012000430065006e0074007200610073000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308030000000100000014000000971d3486fc1e8e6315f7c6f2e12967c72434221420000000010000008e0600003082068a30820472a003020102021003a3a457b5f0f3864a1163e898ff169c300d06092a864886f70d0101050500308198310b3009060355040613024c54312d302b060355040a132456492052656769737472752043656e74726173202d20492e6b2e20313234313130323436312e302c060355040b132552656769737472752043656e74726f20536572746966696b6176696d6f2043656e74726173312a30280603550403132156492052656769737472752043656e7472617320524353432028526f6f74434129301e170d3038303732313131343734365a170d3234303732313131343734365a308198310b3009060355040613024c54312d302b060355040a132456492052656769737472752043656e74726173202d20492e6b2e20313234313130323436312e302c060355040b132552656769737472752043656e74726f20536572746966696b6176696d6f2043656e74726173312a30280603550403132156492052656769737472752043656e7472617320524353432028526f6f7443412930820222300d06092a864886f70d01010105000382020f003082020a0282020100c899f222c7b387152ea7cb4d46ab6797cf0f737703f7647c76483220f4a3d8599d14a91fa01e910e0dadf5fe6792911320214d0a556e71faac17cb00fd0e500233dba9d8bd611afde01057b155796019b454799efb8030e2c842c9520208d8ac2fc371415402f5818a12e36902a587a1707d05bea562bf05b00896476f7f938aade0acd342debde68f14e57328a0039b41fae53ef739742e64f49f4bc0f57899546be51520fce9327240ab6575bc3c4634d2f81061c70c78c77cc01151d10536fbf89cff2db8e5712d49f05748b3938e9cfb3ac94b6d31d752d556e9842e91d4021db2800581c580ca29c13467b9af043043f6af4247defc012ee8429cbeb20b14e434dcddad53847ad80356d1c20cd49729f84cf2b51cdf9d83ae5f5a254ba2b028e5bf5a0bd09ca89c702a6d0e2ee127bfad0b6f11d3f8462df497444bcab0c8e6366f22ba8ee4529516ec446ad4501e9828f968a4bade9e30eda2c952a1c9358a40e18d9b9bfdf1468ba4c74f7060518df292a9ceba8c2f49521267d0f5ab0425407403e2d8ada1745861b7b50ef37f252c1163aff112c3f4a4739a64aceea6068ff2bc9cac28a95c15d333add036c821706bbc2a1fd5abb8015876fc3b114dfbf21c482411fd4d8f1929ae6be86d5eb2a10d78ced2638374b4cd294cbf9b70884f120d45e7be0f65c4d63824e44a158bd16aeabb36a1a190a553c8a5d6650203010001a381cd3081ca300e0603551d0f0101ff040403020106302f06082b06010505070103042330213008060604008e460101300b060604008e46010302010a3008060604008e460104300f0603551d130101ff040530030101ff301d0603551d0e04160414bc733e2f9c910cbb8fcd77993ecc85e4cc586811301006092b0601040182371501040302010030450603551d20043e303c303a060b2b0601040181f137010101302b302906082b06010505070201161d687474703a2f2f7777772e726373632e6c742f7265706f7369746f7279300d06092a864886f70d0101050500038202010019782c51135fbc994e5ca701fcdeb6fea91d8631117b7a998ab38892a560d2046339bcaf8ed8f12b457232293c2de2d9d83d74fa473587dc100036413dedaa7eb2ccc41ae931b4f591d1844ae7f5dccf46670299afb877fa7eed216f962314713fd058beaadb432c37a01d066934f04f8f75eeb3d201bbec1ce98fa989eff8d41b410299bef05fba8e2cc22170de5181d8f7bcb8c33383c397ca0973c4e977c872f45cad0f0d8aeaedd20a01ceeb579d15f02915ef599cafac9282700c98d8229d2f9835a9d18a89bcd59d55c22e9e072546f6924d50fa3d89f2df93bf9394d0d9af57a3f366e68ef1e8a01b1806935a2c890d36c4fa20b3dc28f56aee8f319b5938d84e6aa02321e486abe5fb60a3d1cd5a2c4249a60e55242535fdd23aaf6b58a691465f69cbbd7e269bde08bd1eec9ea6f89c75a44036954b224fc6b67d7251bce3c268cdcde58bbec0c24f9b6e65ce16b70888c787deff328ccbeb4241acfbd7cf0143f86fc0d60bf0f792e9cb455d64b1f7ca3cbb890896c9da0ee1712a0feca4422de36a0f4747b053a6d685509730d78c2e5f4622d0acce3c5e9c1e7283fd0ca7f81732bb61dee34f2f188e82b5871b7405304abf6a1e483c5428b15d9d925f9b10e32e228aafdd36647f1376478335951a948ff5c4536d39bdd58bf5cacf1843050193a436de30d214f3b064b5cace95f7ba74ec8a733e52d35e5300	updroots.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0483ED3399AC3608058722EDBC5E4600E3BEF9D7	updroots.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5F4E1FCF31B7913B850B54F6E5FF501A2B6FC6CF	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c00b0000000100000012000000440069006700690043006500720074000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8E1032E9245944F84791983EC9E829CB1059B4D3	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D2441AA8C203AECAA96E501F124D52B68FE4C375\Blob = 0b000000010000005200000049002e00430041002000132020005100750061006c00690066006900650064002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000d2441aa8c203aecaa96e501f124d52b68fe4c3752000000001000000220500003082051e30820406a003020102020400a037a0300d06092a864886f70d01010b05003081b7310b300906035504061302435a313a303806035504030c31492e4341202d205175616c69666965642043657274696669636174696f6e20417574686f726974792c2030392f32303039312d302b060355040a0c245072766ec3ad20636572746966696b61c48d6ec3ad206175746f726974612c20612e732e313d303b060355040b0c34492e4341202d20416363726564697465642050726f7669646572206f662043657274696669636174696f6e205365727669636573301e170d3039303930313030303030305a170d3139303930313030303030305a3081b7310b300906035504061302435a313a303806035504030c31492e4341202d205175616c69666965642043657274696669636174696f6e20417574686f726974792c2030392f32303039312d302b060355040a0c245072766ec3ad20636572746966696b61c48d6ec3ad206175746f726974612c20612e732e313d303b060355040b0c34492e4341202d20416363726564697465642050726f7669646572206f662043657274696669636174696f6e20536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100b53684cb4282f0cf65e2549a58732ce3eb155752f0cf225888840d782aefd471e6fd8a4621d63f67ae3471e6a792342f217ee6db704ae0e482e8a3bc919600df3a293b3e8614238a5763ef2ee91b73e7368a617a90b1c4bfaa8d03c5b184f6d1df12b09470f0076ca15b3a3b577415803446f37b2e82a427b4a602dcb9e54c66c9a4d3fe033ef68293bd007527fc8061164e24b1cf25612d8bf460b2f42b2674a4813fbf29f70f0bc7bbc32ea90382dd7fcc1adc51699249bec013f04f11e32bc9057521d23a9e51a70615a45ce61fe8649d6b2270f3a6edbb10bbbe20ca36b6e9e381e3411692c67a7a3b77ada35c780df898770fd86c915eec48e4c52401cb0203010001a382012e3082012a300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201063081e70603551d200481df3081dc3081d90604551d20003081d03081cd06082b060105050702023081c01a81bd54656e746f20636572746966696b6174206a6520767964616e206a616b6f206b76616c6966696b6f76616e792073797374656d6f767920636572746966696b617420706f646c65207a616b6f6e6120632e203232372f323030302053622e207620706c61746e656d207a6e656e692f54686973206973207175616c69666965642073797374656d206365727469666963617465206163636f7264696e6720746f20437a65636820416374204e6f2e203232372f3230303020436f6c6c2e301d0603551d0e0416041479cbd023e93a677091744fd351e2e020fde128fb300d06092a864886f70d01010b050003820101007d95a536d788586811cf65fb5b0d2ff674818b59d99d49b8f53996c9f0b20f04cc588cfa0432acc047be2dc3de938ba69645ae5674e59a4ba23faa26c42856612405575f99a4c767b01852c9fb41a8f9e4f19e32ce9e1545d95dacfb9edb9bc73c8fafdb4ba223e83b29707118a5f8e387ae21136af4692a590e31b328533a629aac08937ca987b65f5aa618c2d0c2f35d8c6fa73f308938eb94132a485ade79e590cb5ea4b917b66306395fc8366311f4b612cf4876893c6a57f9eb7322f7fa3e05ae3ac0c60e924dcfd48954d11a826a375b9628a8002283ced02ab9b38d53582e655cd5f2db8c0125736c978bfc6001ec4093c1ed51b8aacb62d82530a23d	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\394FF6850B06BE52E51856CC10E180E882B385CC\Blob = 0b000000010000003c000000450071007500690066006100780020005300650063007500720065002000650042007500730069006e006500730073002000430041002d0032000000090000000100000020000000301e06082b0601050507030406082b0601050507030106082b06010505070303030000000100000014000000394ff6850b06be52e51856cc10e180e882b385cc2000000001000000240300003082032030820289a00302010202043770cfb5300d06092a864886f70d0101050500304e310b300906035504061302555331173015060355040a130e457175696661782053656375726531263024060355040b131d45717569666178205365637572652065427573696e6573732043412d32301e170d3939303632333132313434355a170d3139303632333132313434355a304e310b300906035504061302555331173015060355040a130e457175696661782053656375726531263024060355040b131d45717569666178205365637572652065427573696e6573732043412d3230819f300d06092a864886f70d010101050003818d0030818902818100e43939931e52061b2836f8b2a329c5ed8eb211bdfeebe7b474c28fff05e7d99d06bf12c83f0ef2d6d124b211ded173098ad4b12c98090d1e5046b283a6458d6268bb851b207032aa40cda6965fc471373f04f3b7412439071a1e2e6158a0120be5a5dfc5abea3771cc1cc8373ab99752a7acc56a24944e9c7bcfc06ad6df21bd0203010001a38201093082010530700603551d1f046930673065a063a061a45f305d310b300906035504061302555331173015060355040a130e457175696661782053656375726531263024060355040b131d45717569666178205365637572652065427573696e6573732043412d32310d300b0603550403130443524c31301a0603551d1004133011810f32303139303632333132313434355a300b0603551d0f040403020106301f0603551d23041830168014509e0beaaf5eb92048a6506acbfdd8207aa78276301d0603551d0e04160414509e0beaaf5eb92048a6506acbfdd8207aa78276300c0603551d13040530030101ff301a06092a864886f67d074100040d300b1b0556332e3063030206c0300d06092a864886f70d0101050500038181000c8682ade84e1af58e8927e235583d29b4078f365095bf6ec19eebc490b285a8bbb742e00f0739dffb9e90b2d1c13e539f0344b07e4bf46fe47c1fe7e2b1e4b89aefc3bdcede0b3234d9de28ed336bc4d4d73d1258ab7d092dcb70f5138a94a127a4d670c56d94b5c97d9da0d2c60849d9669ba6d3f40bdcc52657e19130eacd	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\68ED18B309CD5291C0D3357C1D1141BF883866B1	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\96974CD6B663A7184526B1D648AD815CF51E801A\Blob = 03000000010000001400000096974cd6b663a7184526b1d648ad815cf51e801a090000000100000016000000301406082b0601050507030406082b060105050703030b000000010000001200000056006500720069005300690067006e00000020000000010000004502000030820241308201aa021100caf6c1f570e2e9036b73fc06921c2af1300d06092a864886f70d010102050030613111300f06035504071308496e7465726e657431173015060355040a130e566572695369676e2c20496e632e31333031060355040b132a566572695369676e20496e646976696475616c20536f667477617265205075626c697368657273204341301e170d3936303430393030303030305a170d3034303130373233353935395a30613111300f06035504071308496e7465726e657431173015060355040a130e566572695369676e2c20496e632e31333031060355040b132a566572695369676e20496e646976696475616c20536f667477617265205075626c69736865727320434130819f300d06092a864886f70d010101050003818d0030818902818100c17aca65a72dd50f4f6c4732f8737786e53df26f7990b5de4fd21479334bb20e46fd88722ac2fc649e618f6bc05be8f01104da7aba72f6ec5daffbf197f114d228e328855c7bbd8aa27fc233b56d0b92780b387174857f3dbab92fefbe27480d3822c956308d77fa5d2c5a9c97ce7030e9515fa68be49596a5a01777f193b8290203010001300d06092a864886f70d010102050003818100c08f9fd77f0e26f747fd657b63920646cce05e4b8158b397ec05181315d697102a7ff856add80e7abf274845079f2522ac7012066937805858d88a345a07c627dac6fb9eb17d6420804ff4a1157b1961afc6abc02665fe8c07873f1ac48eb24044107e2c617afeada3c8beccbd5eaaafacc5bf1167582a32f325ddb67443c07c	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6A6F2A8B6E2615088DF59CD24C402418AE42A3F1	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 53000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	updroots.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeRestorePrivilege	2644	KB931125.exe
Token: SeRestorePrivilege	2644	KB931125.exe
Token: SeRestorePrivilege	2644	KB931125.exe
Token: SeRestorePrivilege	2644	KB931125.exe
Token: SeRestorePrivilege	2644	KB931125.exe
Token: SeRestorePrivilege	2644	KB931125.exe
Token: SeRestorePrivilege	2644	KB931125.exe
Token: SeRestorePrivilege	1084	KB931125.exe
Token: SeRestorePrivilege	1084	KB931125.exe
Token: SeRestorePrivilege	1084	KB931125.exe
Token: SeRestorePrivilege	1084	KB931125.exe
Token: SeRestorePrivilege	1084	KB931125.exe
Token: SeRestorePrivilege	1084	KB931125.exe
Token: SeRestorePrivilege	1084	KB931125.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2644	2624	b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d.exe	30
PID 2624 wrote to memory of 2644	2624	b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d.exe	30
PID 2624 wrote to memory of 2644	2624	b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d.exe	30
PID 2624 wrote to memory of 2644	2624	b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d.exe	30
PID 2624 wrote to memory of 2644	2624	b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d.exe	30
PID 2624 wrote to memory of 2644	2624	b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d.exe	30
PID 2624 wrote to memory of 2644	2624	b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d.exe	30
PID 2644 wrote to memory of 2456	2644	KB931125.exe	31
PID 2644 wrote to memory of 2456	2644	KB931125.exe	31
PID 2644 wrote to memory of 2456	2644	KB931125.exe	31
PID 2644 wrote to memory of 2456	2644	KB931125.exe	31
PID 2644 wrote to memory of 2456	2644	KB931125.exe	31
PID 2644 wrote to memory of 2456	2644	KB931125.exe	31
PID 2644 wrote to memory of 2456	2644	KB931125.exe	31
PID 2644 wrote to memory of 2460	2644	KB931125.exe	32
PID 2644 wrote to memory of 2460	2644	KB931125.exe	32
PID 2644 wrote to memory of 2460	2644	KB931125.exe	32
PID 2644 wrote to memory of 2460	2644	KB931125.exe	32
PID 2644 wrote to memory of 2460	2644	KB931125.exe	32
PID 2644 wrote to memory of 2460	2644	KB931125.exe	32
PID 2644 wrote to memory of 2460	2644	KB931125.exe	32
PID 2644 wrote to memory of 2700	2644	KB931125.exe	33
PID 2644 wrote to memory of 2700	2644	KB931125.exe	33
PID 2644 wrote to memory of 2700	2644	KB931125.exe	33
PID 2644 wrote to memory of 2700	2644	KB931125.exe	33
PID 2644 wrote to memory of 2700	2644	KB931125.exe	33
PID 2644 wrote to memory of 2700	2644	KB931125.exe	33
PID 2644 wrote to memory of 2700	2644	KB931125.exe	33
PID 2644 wrote to memory of 324	2644	KB931125.exe	34
PID 2644 wrote to memory of 324	2644	KB931125.exe	34
PID 2644 wrote to memory of 324	2644	KB931125.exe	34
PID 2644 wrote to memory of 324	2644	KB931125.exe	34
PID 2644 wrote to memory of 324	2644	KB931125.exe	34
PID 2644 wrote to memory of 324	2644	KB931125.exe	34
PID 2644 wrote to memory of 324	2644	KB931125.exe	34
PID 2624 wrote to memory of 1084	2624	b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d.exe	35
PID 2624 wrote to memory of 1084	2624	b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d.exe	35
PID 2624 wrote to memory of 1084	2624	b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d.exe	35
PID 2624 wrote to memory of 1084	2624	b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d.exe	35
PID 2624 wrote to memory of 1084	2624	b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d.exe	35
PID 2624 wrote to memory of 1084	2624	b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d.exe	35
PID 2624 wrote to memory of 1084	2624	b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d.exe	35
PID 1084 wrote to memory of 2132	1084	KB931125.exe	36
PID 1084 wrote to memory of 2132	1084	KB931125.exe	36
PID 1084 wrote to memory of 2132	1084	KB931125.exe	36
PID 1084 wrote to memory of 2132	1084	KB931125.exe	36
PID 1084 wrote to memory of 2132	1084	KB931125.exe	36
PID 1084 wrote to memory of 2132	1084	KB931125.exe	36
PID 1084 wrote to memory of 2132	1084	KB931125.exe	36
PID 1084 wrote to memory of 1632	1084	KB931125.exe	37
PID 1084 wrote to memory of 1632	1084	KB931125.exe	37
PID 1084 wrote to memory of 1632	1084	KB931125.exe	37
PID 1084 wrote to memory of 1632	1084	KB931125.exe	37
PID 1084 wrote to memory of 1632	1084	KB931125.exe	37
PID 1084 wrote to memory of 1632	1084	KB931125.exe	37
PID 1084 wrote to memory of 1632	1084	KB931125.exe	37
PID 1084 wrote to memory of 2940	1084	KB931125.exe	38
PID 1084 wrote to memory of 2940	1084	KB931125.exe	38
PID 1084 wrote to memory of 2940	1084	KB931125.exe	38
PID 1084 wrote to memory of 2940	1084	KB931125.exe	38
PID 1084 wrote to memory of 2940	1084	KB931125.exe	38
PID 1084 wrote to memory of 2940	1084	KB931125.exe	38
PID 1084 wrote to memory of 2940	1084	KB931125.exe	38
PID 1084 wrote to memory of 2220	1084	KB931125.exe	39

C:\Users\Admin\AppData\Local\Temp\b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d.exe
"C:\Users\Admin\AppData\Local\Temp\b52fe4aabbe5a4cc22efcb855adb6dfb1fc10ddb2ec4fdf178ff012ccbd5942d.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Users\Admin\AppData\Local\Temp\{AC18CB46-577B-4997-B7FC-03B2AC4F807F}-TemporaryCache\KB931125.exe
  "C:\Users\Admin\AppData\Local\Temp\{AC18CB46-577B-4997-B7FC-03B2AC4F807F}-TemporaryCache\KB931125.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system certificate store
    PID:2456
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system certificate store
    PID:2460
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2700
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:324
- C:\Users\Admin\AppData\Local\Temp\{0623A817-C6BF-47c5-AFB3-B8D6A0849AE7}-TemporaryCache\KB931125.exe
  "C:\Users\Admin\AppData\Local\Temp\{0623A817-C6BF-47c5-AFB3-B8D6A0849AE7}-TemporaryCache\KB931125.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system certificate store
    PID:2132
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system certificate store
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system certificate store
    PID:2940
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL

Filesize
89KB

MD5
a64e4b204d44548eeb5c3d86eca2ad70

SHA1
e3245bf6dbb2e56d71a9cbad2697aa4fa0df6bbe

SHA256
985a5603ebf94539ac11549999f83b5e6dc008180994898c5daa6fd31ae1e9dc

SHA512
dca4099318954bab5f1204645be0d0e8fea0c2e97ee95496fa884fbed627e376358623fa94c39bf0abe97d07d46a7e6c5e1081496cdd1987e07e595995a46cd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF16.DLL

Filesize
2KB

MD5
7210d5407a2d2f52e851604666403024

SHA1
242fde2a7c6a3eff245f06813a2e1bdcaa9f16d9

SHA256
337d2fb5252fc532b7bf67476b5979d158ca2ac589e49c6810e2e1afebe296af

SHA512
1755a26fa018429aea00ebcc786bb41b0d6c4d26d56cd3b88d886b0c0773d863094797334e72d770635ed29b98d4c8c7f0ec717a23a22adef705a1ccf46b3f68

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF32.DLL

Filesize
4KB

MD5
88d01717dc4f1119ea925ff0217c5f49

SHA1
7da9c2e12283800f9896c1f15f789539529e00ec

SHA256
c6407f5792a945bf0948de191e6c54c4fbd2abcc0af3994140fb4319f685dbbd

SHA512
39ecd9d2bb8b4edf88b8882640ec49c061fa34496c026ad19adf4bc4462de3949c72ad00bcc2ca27d53596221c026e978f875bb6cf7e0e8c2d884c1d37a83781

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\authroots.sst

Filesize
73KB

MD5
bb49ccc10926cdb601eba81afef749a2

SHA1
a4766c9aea8d211e9632148fd4b625cece195be9

SHA256
f013ee3b7fede9a95844e83e83ee298d38cba6efce5a5cafcd8b95255c32f86c

SHA512
94c2809727039d1ed07a3742a4b2f9300e865ea7c49bc1fcf547a30238eeecc88d8dd06a2d4f3112317f948908b9af082b50f412a41a2bcb48d5e30d6d8ecbba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\authroots.sst

Filesize
73KB

MD5
bb49ccc10926cdb601eba81afef749a2

SHA1
a4766c9aea8d211e9632148fd4b625cece195be9

SHA256
f013ee3b7fede9a95844e83e83ee298d38cba6efce5a5cafcd8b95255c32f86c

SHA512
94c2809727039d1ed07a3742a4b2f9300e865ea7c49bc1fcf547a30238eeecc88d8dd06a2d4f3112317f948908b9af082b50f412a41a2bcb48d5e30d6d8ecbba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\delroots.sst

Filesize
9KB

MD5
7b32871e409608ff887b6cf4d87debb0

SHA1
191f9ea1298ee52dbd6f977b3584109a064f57b9

SHA256
3f01268547364d2d60a0f65b46757cccfd9225fc39d581846a8fbffdb5756ff2

SHA512
534a384f7946db4083e639b8e02d83ac97293c60630b8811a84c85e0330e9c293f05f5cf71e0f3580551e7923bc5a3bfb7f0406432ca3cdb7efeb4a950ac5e8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\delroots.sst

Filesize
9KB

MD5
7b32871e409608ff887b6cf4d87debb0

SHA1
191f9ea1298ee52dbd6f977b3584109a064f57b9

SHA256
3f01268547364d2d60a0f65b46757cccfd9225fc39d581846a8fbffdb5756ff2

SHA512
534a384f7946db4083e639b8e02d83ac97293c60630b8811a84c85e0330e9c293f05f5cf71e0f3580551e7923bc5a3bfb7f0406432ca3cdb7efeb4a950ac5e8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\roots.sst

Filesize
7KB

MD5
9e5de0fd1f90486a66dee4bfe89a78d7

SHA1
90e3188ef63495aaa71c85d4ff0f23253c834b40

SHA256
8b95ff56d61586582864d05563762615c8705779578dca3c98a303c3b1f4122e

SHA512
60006fa6f57e4d280642d51055f85f8d27b913ce71373de5b928c515c77647295030ab73ab4a55024de4a40c18f200909f49ffb52c26cf554835fc3d4cc348f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\roots.sst

Filesize
7KB

MD5
9e5de0fd1f90486a66dee4bfe89a78d7

SHA1
90e3188ef63495aaa71c85d4ff0f23253c834b40

SHA256
8b95ff56d61586582864d05563762615c8705779578dca3c98a303c3b1f4122e

SHA512
60006fa6f57e4d280642d51055f85f8d27b913ce71373de5b928c515c77647295030ab73ab4a55024de4a40c18f200909f49ffb52c26cf554835fc3d4cc348f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rootsupd.inf

Filesize
1KB

MD5
421e60325404f5f29ac04c9b9d59096b

SHA1
aace2fd74d799e8af5c8d5b2646361bb67a1620c

SHA256
571a8da5298aacc37700c747ee5d72b5a7797835140e7a4d4f895e9604574d77

SHA512
86693975b1b187ee65b0a23b1f3f8e05d1a3f61e7e47b060f938fe1602bbad96021847b709e64c2d5a295b72f10f4db587a11a1e7ca0a0b64c3bed7fa683b1d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.sst

Filesize
320KB

MD5
2d9b4498c847715418160bfd7e7c8a2d

SHA1
e0873091d476d2566aa6fc988cb364247c95dc97

SHA256
c49c05b701c390c679e5e3226ec621f22a08155b1065fcfc37b509f648f03b41

SHA512
dcf3208cdd1e4353f82823f796d735c1209f149f183eea827a90753ec55509a1c460a16c120e07c12a5eacf0e67d2661c25638491ecf4403e25d6508983e519b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.sst

Filesize
320KB

MD5
2d9b4498c847715418160bfd7e7c8a2d

SHA1
e0873091d476d2566aa6fc988cb364247c95dc97

SHA256
c49c05b701c390c679e5e3226ec621f22a08155b1065fcfc37b509f648f03b41

SHA512
dcf3208cdd1e4353f82823f796d735c1209f149f183eea827a90753ec55509a1c460a16c120e07c12a5eacf0e67d2661c25638491ecf4403e25d6508983e519b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{0623A817-C6BF-47c5-AFB3-B8D6A0849AE7}-TemporaryCache\KB931125.exe

Filesize
349KB

MD5
4a4d72d34f9da1fc5019e0748fcde2f5

SHA1
f54752ec63369522f37e545325519ee434cdf439

SHA256
83b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca

SHA512
95986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33

Download Submit
C:\Users\Admin\AppData\Local\Temp\{0623A817-C6BF-47c5-AFB3-B8D6A0849AE7}-TemporaryCache\KB931125.exe

Filesize
349KB

MD5
4a4d72d34f9da1fc5019e0748fcde2f5

SHA1
f54752ec63369522f37e545325519ee434cdf439

SHA256
83b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca

SHA512
95986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33

Download Submit
C:\Users\Admin\AppData\Local\Temp\{AC18CB46-577B-4997-B7FC-03B2AC4F807F}-TemporaryCache\KB931125.exe

Filesize
349KB

MD5
4a4d72d34f9da1fc5019e0748fcde2f5

SHA1
f54752ec63369522f37e545325519ee434cdf439

SHA256
83b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca

SHA512
95986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33

Download Submit
C:\Users\Admin\AppData\Local\Temp\{AC18CB46-577B-4997-B7FC-03B2AC4F807F}-TemporaryCache\KB931125.exe

Filesize
349KB

MD5
4a4d72d34f9da1fc5019e0748fcde2f5

SHA1
f54752ec63369522f37e545325519ee434cdf439

SHA256
83b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca

SHA512
95986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33

Download Submit
C:\Users\Admin\AppData\Local\Temp\{AC18CB46-577B-4997-B7FC-03B2AC4F807F}-TemporaryCache\KB931125.exe

Filesize
349KB

MD5
4a4d72d34f9da1fc5019e0748fcde2f5

SHA1
f54752ec63369522f37e545325519ee434cdf439

SHA256
83b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca

SHA512
95986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL

Filesize
89KB

MD5
a64e4b204d44548eeb5c3d86eca2ad70

SHA1
e3245bf6dbb2e56d71a9cbad2697aa4fa0df6bbe

SHA256
985a5603ebf94539ac11549999f83b5e6dc008180994898c5daa6fd31ae1e9dc

SHA512
dca4099318954bab5f1204645be0d0e8fea0c2e97ee95496fa884fbed627e376358623fa94c39bf0abe97d07d46a7e6c5e1081496cdd1987e07e595995a46cd5

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL

Filesize
89KB

MD5
a64e4b204d44548eeb5c3d86eca2ad70

SHA1
e3245bf6dbb2e56d71a9cbad2697aa4fa0df6bbe

SHA256
985a5603ebf94539ac11549999f83b5e6dc008180994898c5daa6fd31ae1e9dc

SHA512
dca4099318954bab5f1204645be0d0e8fea0c2e97ee95496fa884fbed627e376358623fa94c39bf0abe97d07d46a7e6c5e1081496cdd1987e07e595995a46cd5

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
\Users\Admin\AppData\Local\Temp\{0623A817-C6BF-47c5-AFB3-B8D6A0849AE7}-TemporaryCache\KB931125.exe

Filesize
349KB

MD5
4a4d72d34f9da1fc5019e0748fcde2f5

SHA1
f54752ec63369522f37e545325519ee434cdf439

SHA256
83b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca

SHA512
95986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33

Download Submit
\Users\Admin\AppData\Local\Temp\{0623A817-C6BF-47c5-AFB3-B8D6A0849AE7}-TemporaryCache\KB931125.exe

Filesize
349KB

MD5
4a4d72d34f9da1fc5019e0748fcde2f5

SHA1
f54752ec63369522f37e545325519ee434cdf439

SHA256
83b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca

SHA512
95986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33

Download Submit
\Users\Admin\AppData\Local\Temp\{8D97F41C-ECC0-46bf-AC96-8080EBEE23C6}-TemporaryCache\7z.dll

Filesize
1.1MB

MD5
f0fef6362d4886e85a186a5e3766650a

SHA1
65843b7052a4d1b84762479d79445c46834e18b5

SHA256
15b9fe7d408cbf2204039087526e7df947df57b42ea479e303b682e956638816

SHA512
3f6dfd701cf62b77219f8825a2257c4bd7d44ebafc5654b06abaf906ced2571f4eeb04fe22ae6136c14bddebddb12555aa6efd322e779443d57bb122ea786043

Download Submit
\Users\Admin\AppData\Local\Temp\{AC18CB46-577B-4997-B7FC-03B2AC4F807F}-TemporaryCache\KB931125.exe

Filesize
349KB

MD5
4a4d72d34f9da1fc5019e0748fcde2f5

SHA1
f54752ec63369522f37e545325519ee434cdf439

SHA256
83b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca

SHA512
95986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33

Download Submit
\Users\Admin\AppData\Local\Temp\{AC18CB46-577B-4997-B7FC-03B2AC4F807F}-TemporaryCache\KB931125.exe

Filesize
349KB

MD5
4a4d72d34f9da1fc5019e0748fcde2f5

SHA1
f54752ec63369522f37e545325519ee434cdf439

SHA256
83b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca

SHA512
95986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33

Download Submit
memory/2624-147-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads