Analysis
-
max time kernel
367s -
max time network
626s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2024 14:50
Static task
static1
Behavioral task
behavioral1
Sample
.html
Resource
win10v2004-20240426-en
General
-
Target
.html
-
Size
147KB
-
MD5
ae16c0e6b3a18a28bf0a0974f1622568
-
SHA1
106a2deebd06e2931be677b09d4f818d68c76d74
-
SHA256
b941e34ee71c1eb4c2bb473adc99c62643c9be13bb6c67b0aa3308d61cbdbddd
-
SHA512
407ac0936b5e5890c6e4f213e410cdb3fda8efec318128de1b3068b7626cd144ba27ee2ce7c381a6013760bd5964ee4c9e321251d50e6c3b94c7b24d80d63867
-
SSDEEP
1536:olkud8TPV9vK4DNvGR4Dbll1qKf+30vD932Os4DjHhqiS:2kPT3V+CllQHKNHhqiS
Malware Config
Extracted
crimsonrat
185.136.161.124
Signatures
-
CrimsonRAT main payload 1 IoCs
Processes:
resource yara_rule C:\ProgramData\Hdlharas\dlrarhsiva.exe family_crimsonrat -
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Modifies WinLogon for persistence 2 TTPs 58 IoCs
Processes:
winupdate.exewinupdate.exeBlackkomet.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" Blackkomet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe -
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 5012 bcdedit.exe 1336 bcdedit.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 14 IoCs
Processes:
QHActiveDefense.exe360TS_Setup.exeEaInstHelper64.exeQHActiveDefense.exeNetworkMon.exedescription ioc process File created C:\Windows\SysWOW64\drivers\360AvFlt.sys QHActiveDefense.exe File created C:\Windows\system32\drivers\BAPIDRV64.sys 360TS_Setup.exe File created C:\Windows\system32\drivers\360elam64.sys EaInstHelper64.exe File created C:\Windows\system32\drivers\360AvFlt.sys 360TS_Setup.exe File opened for modification C:\Windows\system32\drivers\360elam64.sys EaInstHelper64.exe File opened for modification C:\Windows\system32\drivers\360FsFlt.sys QHActiveDefense.exe File opened for modification C:\Windows\SysWOW64\drivers\360AvFlt.sys QHActiveDefense.exe File opened for modification C:\Windows\system32\drivers\etc\hosts QHActiveDefense.exe File opened for modification C:\Windows\system32\drivers\etc\hosts NetworkMon.exe File created C:\Windows\system32\drivers\360Box64.sys 360TS_Setup.exe File created C:\Windows\system32\drivers\360AntiHacker64.sys 360TS_Setup.exe File created C:\Windows\system32\drivers\360netmon.sys 360TS_Setup.exe File created C:\Windows\system32\drivers\360FsFlt.sys QHActiveDefense.exe File created C:\Windows\system32\drivers\360Camera64.sys 360TS_Setup.exe -
Modifies Installed Components in the registry 2 TTPs 6 IoCs
Processes:
KB931125-rootsupd.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A} KB931125-rootsupd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ = "RootsUpdate" KB931125-rootsupd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\IsInstalled = "1" KB931125-rootsupd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Version = "41,0,2195,0" KB931125-rootsupd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Locale = "*" KB931125-rootsupd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ComponentID = "Windows Roots Update" KB931125-rootsupd.exe -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 4868 netsh.exe -
Office macro that triggers on suspicious action 2 IoCs
Office document macro which triggers in special circumstances - often malicious.
Processes:
resource yara_rule C:\Windows\Temp\KkAVLBEeZPpF0QqG\xl\vbaProject.bin office_macro_on_action C:\Windows\Temp\F01QG289UKkAVLlB\xl\vbaProject.bin office_macro_on_action -
Sets file to hidden 1 TTPs 64 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid process 6788 attrib.exe 11308 attrib.exe 17812 15400 9000 attrib.exe 5664 attrib.exe 5208 attrib.exe 9064 7344 7288 attrib.exe 2272 11736 15556 10496 2468 7776 18200 8296 attrib.exe 13132 attrib.exe 6668 attrib.exe 3660 1232 attrib.exe 2208 attrib.exe 2864 attrib.exe 3888 attrib.exe 3908 attrib.exe 12316 attrib.exe 9032 12956 3864 16432 8100 attrib.exe 4568 attrib.exe 9644 attrib.exe 14032 attrib.exe 11652 11776 attrib.exe 1640 attrib.exe 9444 attrib.exe 15272 16224 8948 17060 5576 attrib.exe 8920 15364 17184 15564 15668 11064 8544 attrib.exe 8208 attrib.exe 10028 attrib.exe 8204 attrib.exe 6152 attrib.exe 7456 attrib.exe 14424 8476 attrib.exe 15756 16916 16788 6744 attrib.exe 8860 attrib.exe 14240 attrib.exe -
Sets service image path in registry 2 TTPs 15 IoCs
Processes:
QHSafeMain.exe360TS_Setup.exeQHActiveDefense.exeQHSafeTray.exeEaInstHelper64.exeQHActiveDefense.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360FsFlt\ImagePath = "system32\\DRIVERS\\360FsFlt.sys" QHSafeMain.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\ImagePath = "\"C:\\Program Files (x86)\\360\\Total Security\\safemon\\QHActiveDefense.exe\"" 360TS_Setup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360FsFlt\ImagePath = "system32\\DRIVERS\\360FsFlt.sys" QHActiveDefense.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360netmon\ImagePath = "system32\\DRIVERS\\360netmon.sys" QHSafeTray.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360elam64\ImagePath = "system32\\DRIVERS\\360elam64.sys" EaInstHelper64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360AvFlt\ImagePath = "system32\\drivers\\360AvFlt.sys" QHActiveDefense.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BAPIDRV\ImagePath = "system32\\DRIVERS\\BAPIDRV64.sys" 360TS_Setup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360Box64\ImagePath = "system32\\DRIVERS\\360Box64.sys" 360TS_Setup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360AvFlt\ImagePath = "system32\\DRIVERS\\360AvFlt.sys" QHActiveDefense.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360FsFlt\ImagePath = "system32\\DRIVERS\\360FsFlt.sys" QHActiveDefense.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360Camera\ImagePath = "System32\\Drivers\\360Camera64.sys" QHActiveDefense.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360elam64\ImagePath = "system32\\DRIVERS\\360elam64.sys" QHSafeTray.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360AntiHacker\ImagePath = "System32\\Drivers\\360AntiHacker64.sys" 360TS_Setup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360AvFlt\ImagePath = "system32\\DRIVERS\\360AvFlt.sys" 360TS_Setup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHProtected\ImagePath = "\"C:\\Program Files (x86)\\360\\Total Security\\safemon\\WscReg.exe\"" 360TS_Setup.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
winupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exeQHSafeTray.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exe360TS_Setup_Mini_WW.Bing.CPI202305_6.6.0.1054.exewinupdate.exeBlackkomet.exewinupdate.exewinupdate.exeQHSafeMain.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exe360TS_Setup.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exeCrimsonRAT.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exeCrimsonRAT.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exeCrimsonRAT.exewinupdate.exewinupdate.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation QHSafeTray.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 360TS_Setup_Mini_WW.Bing.CPI202305_6.6.0.1054.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Blackkomet.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation QHSafeMain.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 360TS_Setup.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation CrimsonRAT.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation CrimsonRAT.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation CrimsonRAT.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation winupdate.exe -
Drops startup file 3 IoCs
Processes:
NJRat.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe NJRat.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe NJRat.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe\:SmartScreen:$DATA NJRat.exe -
Executes dropped EXE 64 IoCs
Processes:
360TS_Setup_Mini_WW.Bing.CPI202305_6.6.0.1054.exe360TS_Setup.exe360TS_Setup.exePowerSaver.exeWscReg.exeWscReg.exeEaInstHelper64.exeQHActiveDefense.exeQHActiveDefense.exeQHSafeTray.exeQHWatchdog.exePopWndLog.exeQHSafeTray.exePopWndLog.exeQHWatchdog.exeQHSafeTray.exeKB931125-rootsupd.exeupdroots.exeupdroots.exeupdroots.exeupdroots.exeQHSafeMain.exePromoUtil.exe360InstantSetup.exe360TsLiveUpd.exePromoUtil.exe360boxmain.execefutil.execefutil.execefutil.exe360DeskAna.exe360DeskAna.exe360DeskAna64.exe360DeskAna64.exe360DeskAna64.exe360DeskAna64.exe360DeskAna64.exe360DeskAna64.exe360DeskAna64.exe360DeskAna64.exe360DeskAna64.exe360DeskAna64.execefutil.exeNJRat.exeCrimsonRAT.exedlrarhsiva.exeBlackkomet.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exeNJRat.exewinupdate.exeCrimsonRAT.exeCrimsonRAT.exewinupdate.exedlrarhsiva.exedlrarhsiva.exewinupdate.exewinupdate.exepid process 4248 360TS_Setup_Mini_WW.Bing.CPI202305_6.6.0.1054.exe 5460 360TS_Setup.exe 3004 360TS_Setup.exe 372 PowerSaver.exe 828 WscReg.exe 2728 WscReg.exe 2412 EaInstHelper64.exe 4264 QHActiveDefense.exe 3644 QHActiveDefense.exe 3184 QHSafeTray.exe 5276 QHWatchdog.exe 4780 PopWndLog.exe 3976 QHSafeTray.exe 2648 PopWndLog.exe 4464 QHWatchdog.exe 2160 QHSafeTray.exe 3448 KB931125-rootsupd.exe 4716 updroots.exe 4328 updroots.exe 4456 updroots.exe 5180 updroots.exe 4268 QHSafeMain.exe 512 PromoUtil.exe 3764 360InstantSetup.exe 772 360TsLiveUpd.exe 6540 PromoUtil.exe 6912 360boxmain.exe 7328 cefutil.exe 7524 cefutil.exe 7888 cefutil.exe 6952 360DeskAna.exe 6960 360DeskAna.exe 7056 360DeskAna64.exe 7088 360DeskAna64.exe 7100 360DeskAna64.exe 7112 360DeskAna64.exe 7144 360DeskAna64.exe 7164 360DeskAna64.exe 7196 360DeskAna64.exe 7208 360DeskAna64.exe 7216 360DeskAna64.exe 408 360DeskAna64.exe 5108 cefutil.exe 4812 NJRat.exe 5000 CrimsonRAT.exe 2296 dlrarhsiva.exe 3076 Blackkomet.exe 1456 winupdate.exe 3648 winupdate.exe 6520 winupdate.exe 6944 winupdate.exe 7704 winupdate.exe 7640 winupdate.exe 5020 winupdate.exe 5140 winupdate.exe 6152 NJRat.exe 1456 winupdate.exe 4116 CrimsonRAT.exe 8152 CrimsonRAT.exe 7116 winupdate.exe 4948 dlrarhsiva.exe 8148 dlrarhsiva.exe 1656 winupdate.exe 4672 winupdate.exe -
Loads dropped DLL 64 IoCs
Processes:
360TS_Setup_Mini_WW.Bing.CPI202305_6.6.0.1054.exe360TS_Setup.exe360TS_Setup.exeregsvr32.exeregsvr32.exePowerSaver.exeWscReg.exeQHActiveDefense.exeQHActiveDefense.exeQHSafeTray.exepid process 4248 360TS_Setup_Mini_WW.Bing.CPI202305_6.6.0.1054.exe 5460 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 876 regsvr32.exe 544 regsvr32.exe 372 PowerSaver.exe 2728 WscReg.exe 4264 QHActiveDefense.exe 4264 QHActiveDefense.exe 4264 QHActiveDefense.exe 4264 QHActiveDefense.exe 4264 QHActiveDefense.exe 4264 QHActiveDefense.exe 4264 QHActiveDefense.exe 4264 QHActiveDefense.exe 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe 3184 QHSafeTray.exe 3644 QHActiveDefense.exe 3184 QHSafeTray.exe 3644 QHActiveDefense.exe 3184 QHSafeTray.exe 3644 QHActiveDefense.exe 3184 QHSafeTray.exe 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe 3184 QHSafeTray.exe 3644 QHActiveDefense.exe 3184 QHSafeTray.exe 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe -
Modifies system executable filetype association 2 TTPs 2 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SD360 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SD360\ = "{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}" regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}\InprocServer32\ = "C:\\Program Files (x86)\\360\\Total Security\\MenuEx64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Unexpected DNS network traffic destination 26 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 54.194.132.159 Destination IP 54.194.213.124 Destination IP 54.194.132.159 Destination IP 54.194.132.159 Destination IP 52.208.34.209 Destination IP 54.194.132.159 Destination IP 54.194.132.159 Destination IP 54.194.213.124 Destination IP 54.194.132.159 Destination IP 54.194.132.159 Destination IP 54.194.132.159 Destination IP 54.194.132.159 Destination IP 52.18.36.18 Destination IP 54.194.132.159 Destination IP 54.194.132.159 Destination IP 54.194.132.159 Destination IP 52.18.36.18 Destination IP 54.194.132.159 Destination IP 54.194.132.159 Destination IP 54.194.213.124 Destination IP 54.194.132.159 Destination IP 54.72.160.25 Destination IP 54.194.132.159 Destination IP 54.194.213.124 Destination IP 54.194.132.159 Destination IP 52.208.34.209 -
Adds Run key to start application 2 TTPs 64 IoCs
Processes:
notepad.exewinupdate.exewinupdate.exewinupdate.exenotepad.exewinupdate.exenotepad.exewinupdate.exenotepad.exewinupdate.exewinupdate.exenotepad.exenotepad.exenotepad.exewinupdate.exeQHActiveDefense.exewinupdate.exewinupdate.exenotepad.exeNJRat.exenotepad.exewinupdate.exenotepad.exewinupdate.exewinupdate.exenotepad.exenotepad.exewinupdate.exenotepad.exenotepad.exenotepad.exewinupdate.exewinupdate.exenotepad.exewinupdate.exenotepad.exenotepad.exewinupdate.exenotepad.exewinupdate.exenotepad.exenotepad.exenotepad.exewinupdate.exe360TS_Setup.exenotepad.exewinupdate.exewinupdate.exenotepad.exeBlackkomet.exewinupdate.exenotepad.exenotepad.exewinupdate.exenotepad.exewinupdate.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\QHSafeTray = "\"C:\\Program Files (x86)\\360\\Total Security\\safemon\\360Tray.exe\" /start" QHActiveDefense.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b9584a316aeb9ca9b31edd4db18381f5 = "\"C:\\Users\\Admin\\Desktop\\NJRat.exe\" .." NJRat.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\QHSafeTray = "\"C:\\Program Files (x86)\\360\\Total Security\\safemon\\360Tray.exe\" /start" 360TS_Setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" Blackkomet.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe -
Checks for any installed AV software in registry 1 TTPs 46 IoCs
Processes:
360TS_Setup.exeQHActiveDefense.exeQHSafeMain.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\ErrorControl 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Group 360TS_Setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira QHActiveDefense.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\NOD\CurrentVersion\Info QHActiveDefense.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira 360TS_Setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast 360TS_Setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Doctor Web\InstalledComponents 360TS_Setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Doctor Web\InstalledComponents QHActiveDefense.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira QHActiveDefense.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Doctor Web\InstalledComponents QHActiveDefense.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\NOD\CurrentVersion\Info 360TS_Setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast 360TS_Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense 360TS_Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Parameters QHSafeMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\WOW64 QHActiveDefense.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense QHActiveDefense.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Eset\NOD\CurrentVersion\Info 360TS_Setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\DisplayName 360TS_Setup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\ObjectName = "LocalSystem" 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Type 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\FailureCommand QHActiveDefense.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\ObjectName 360TS_Setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast QHActiveDefense.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense QHSafeMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Type QHActiveDefense.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\ImagePath QHActiveDefense.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Doctor Web\InstalledComponents 360TS_Setup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\DisplayName = "360 Total Security" 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Start 360TS_Setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast QHActiveDefense.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\ImagePath QHSafeMain.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Group = "TDI" 360TS_Setup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\ImagePath = "\"C:\\Program Files (x86)\\360\\Total Security\\safemon\\QHActiveDefense.exe\"" 360TS_Setup.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Start = "2" 360TS_Setup.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Type = "16" 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Alias QHActiveDefense.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Eset\NOD\CurrentVersion\Info QHActiveDefense.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Parameters QHActiveDefense.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense 360TS_Setup.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\ErrorControl = "1" 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\ImagePath 360TS_Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense QHActiveDefense.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast QHActiveDefense.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
360boxmain.exeQHSafeMain.exe360TS_Setup.exeQHActiveDefense.exeQHSafeTray.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 360boxmain.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA QHSafeMain.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA QHActiveDefense.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA QHSafeTray.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
QHSafeMain.exedescription ioc process File opened for modification C:\Users\Admin\Favorites\desktop.ini QHSafeMain.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini QHSafeMain.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
NetworkMon.exeQHActiveDefense.exeQHSafeTray.exedescription ioc process File opened (read-only) \??\E: NetworkMon.exe File opened (read-only) \??\S: NetworkMon.exe File opened (read-only) \??\s: NetworkMon.exe File opened (read-only) \??\p: QHActiveDefense.exe File opened (read-only) \??\a: QHActiveDefense.exe File opened (read-only) \??\K: QHActiveDefense.exe File opened (read-only) \??\U: QHActiveDefense.exe File opened (read-only) \??\Y: QHActiveDefense.exe File opened (read-only) \??\n: QHActiveDefense.exe File opened (read-only) \??\x: QHActiveDefense.exe File opened (read-only) \??\o: NetworkMon.exe File opened (read-only) \??\G: NetworkMon.exe File opened (read-only) \??\Q: NetworkMon.exe File opened (read-only) \??\t: NetworkMon.exe File opened (read-only) \??\q: QHActiveDefense.exe File opened (read-only) \??\y: QHActiveDefense.exe File opened (read-only) \??\L: QHActiveDefense.exe File opened (read-only) \??\P: QHActiveDefense.exe File opened (read-only) \??\S: QHActiveDefense.exe File opened (read-only) \??\F: QHSafeTray.exe File opened (read-only) \??\O: QHActiveDefense.exe File opened (read-only) \??\V: QHActiveDefense.exe File opened (read-only) \??\A: QHActiveDefense.exe File opened (read-only) \??\w: QHActiveDefense.exe File opened (read-only) \??\V: NetworkMon.exe File opened (read-only) \??\x: NetworkMon.exe File opened (read-only) \??\z: NetworkMon.exe File opened (read-only) \??\u: NetworkMon.exe File opened (read-only) \??\t: QHActiveDefense.exe File opened (read-only) \??\Q: QHActiveDefense.exe File opened (read-only) \??\X: NetworkMon.exe File opened (read-only) \??\g: NetworkMon.exe File opened (read-only) \??\r: NetworkMon.exe File opened (read-only) \??\y: NetworkMon.exe File opened (read-only) \??\N: QHActiveDefense.exe File opened (read-only) \??\Z: QHActiveDefense.exe File opened (read-only) \??\H: NetworkMon.exe File opened (read-only) \??\W: NetworkMon.exe File opened (read-only) \??\v: NetworkMon.exe File opened (read-only) \??\Y: NetworkMon.exe File opened (read-only) \??\w: NetworkMon.exe File opened (read-only) \??\f: QHActiveDefense.exe File opened (read-only) \??\r: QHActiveDefense.exe File opened (read-only) \??\I: QHActiveDefense.exe File opened (read-only) \??\J: QHActiveDefense.exe File opened (read-only) \??\T: QHActiveDefense.exe File opened (read-only) \??\M: NetworkMon.exe File opened (read-only) \??\U: NetworkMon.exe File opened (read-only) \??\e: NetworkMon.exe File opened (read-only) \??\g: QHActiveDefense.exe File opened (read-only) \??\i: QHActiveDefense.exe File opened (read-only) \??\z: QHActiveDefense.exe File opened (read-only) \??\W: QHActiveDefense.exe File opened (read-only) \??\X: QHActiveDefense.exe File opened (read-only) \??\i: NetworkMon.exe File opened (read-only) \??\h: QHActiveDefense.exe File opened (read-only) \??\I: NetworkMon.exe File opened (read-only) \??\N: NetworkMon.exe File opened (read-only) \??\O: NetworkMon.exe File opened (read-only) \??\L: NetworkMon.exe File opened (read-only) \??\T: NetworkMon.exe File opened (read-only) \??\s: QHActiveDefense.exe File opened (read-only) \??\E: QHActiveDefense.exe File opened (read-only) \??\H: QHActiveDefense.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
Processes:
flow ioc 783 raw.githubusercontent.com 784 raw.githubusercontent.com 264 raw.githubusercontent.com 265 raw.githubusercontent.com -
Writes to the Master Boot Record (MBR) 1 TTPs 15 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
PopWndTracker.exeQHSafeMain.exe360TS_Setup.exePopWndLog.exe360InstantSetup.exeQHSafeTray.exeQHActiveDefense.exeQHSafeTray.exeQHSafeTray.exePromoUtil.exe360TsLiveUpd.exe360boxmain.exePopWndTracker.exe360TS_Setup_Mini_WW.Bing.CPI202305_6.6.0.1054.exeNetworkMon.exedescription ioc process File opened for modification \??\PhysicalDrive0 PopWndTracker.exe File opened for modification \??\PhysicalDrive0 QHSafeMain.exe File opened for modification \??\PhysicalDrive0 360TS_Setup.exe File opened for modification \??\PhysicalDrive0 PopWndLog.exe File opened for modification \??\PhysicalDrive0 360InstantSetup.exe File opened for modification \??\PhysicalDrive0 QHSafeTray.exe File opened for modification \??\PhysicalDrive0 QHActiveDefense.exe File opened for modification \??\PhysicalDrive0 QHSafeTray.exe File opened for modification \??\PhysicalDrive0 QHSafeTray.exe File opened for modification \??\PhysicalDrive0 PromoUtil.exe File opened for modification \??\PhysicalDrive0 360TsLiveUpd.exe File opened for modification \??\PhysicalDrive0 360boxmain.exe File opened for modification \??\PhysicalDrive0 PopWndTracker.exe File opened for modification \??\PhysicalDrive0 360TS_Setup_Mini_WW.Bing.CPI202305_6.6.0.1054.exe File opened for modification \??\PhysicalDrive0 NetworkMon.exe -
Drops file in System32 directory 64 IoCs
Processes:
winupdate.exeattrib.exenotepad.exenotepad.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exeattrib.exewinupdate.exeattrib.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exeattrib.exeattrib.exenotepad.exeattrib.exeQHActiveDefense.exenotepad.exeattrib.exeattrib.exenotepad.exewinupdate.exenotepad.exenotepad.exeattrib.exeattrib.exenotepad.exewinupdate.exenotepad.exewinupdate.exewinupdate.exeattrib.exeattrib.exewinupdate.exenotepad.exewinupdate.exewinupdate.exewinupdate.exeattrib.exeattrib.exenotepad.exenotepad.exeattrib.exewinupdate.exeattrib.exewinupdate.exewinupdate.exeattrib.exewinupdate.exewinupdate.exeattrib.exenotepad.exeattrib.exewinupdate.exewinupdate.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe attrib.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe notepad.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe notepad.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt\ winupdate.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe attrib.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt attrib.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt attrib.exe File opened for modification C:\Windows\SysWOW64\Windupdt attrib.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe notepad.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe attrib.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\360safe\LogInfo\New360_formal_73201815467_848_1.log2 QHActiveDefense.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe notepad.exe File opened for modification C:\Windows\SysWOW64\Windupdt attrib.exe File opened for modification C:\Windows\SysWOW64\Windupdt attrib.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe notepad.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe notepad.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe notepad.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe attrib.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe attrib.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe notepad.exe File opened for modification C:\Windows\SysWOW64\Windupdt\ winupdate.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe notepad.exe File opened for modification C:\Windows\SysWOW64\Windupdt\ winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt\ winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe attrib.exe File opened for modification C:\Windows\SysWOW64\Windupdt attrib.exe File opened for modification C:\Windows\SysWOW64\Windupdt\ winupdate.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe notepad.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt\ winupdate.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe attrib.exe File opened for modification C:\Windows\SysWOW64\Windupdt attrib.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe notepad.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe notepad.exe File opened for modification C:\Windows\SysWOW64\Windupdt attrib.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt attrib.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe attrib.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt attrib.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\360safe\antiadwa\memo20240514.dat QHActiveDefense.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe notepad.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe attrib.exe File opened for modification C:\Windows\SysWOW64\Windupdt\ winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt\ winupdate.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe -
Drops file in Program Files directory 64 IoCs
Processes:
360TS_Setup.exeQHActiveDefense.exedescription ioc process File created C:\Program Files (x86)\360\Total Security\i18n\hi\ipc\NetDefender.dll.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\safemon\360AV.tpi 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\deepscan\AVE\360KP.dll 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\pl\deepscan\DsRes64.dll 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\safemon\acls.ini 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\pt\safemon\360procmon.dll.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\ja\Dumpuper.exe.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\fr\safemon\360SafeCamera.tpi.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\config\newui\themes\smurf\smurf.ui 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\360ShellPro.exe 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\ipc\360Box_win10.sys 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\ru\safemon\bp.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\deepscan\MiniRame.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\config\lang\en\SysSweeper.ui.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\netmon\netdrv\50\360netmon_50.sys 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\ru\deepscan\dsconz.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\pl\safemon\safemon.dll.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\config\newui\themes\default\360EvtMgr\360EvtMgr_theme.ui 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\softmgr\SML\SMLLauncher64.dll 360TS_Setup.exe File opened for modification C:\Program Files (x86)\360\Total Security\deepscan\dslc.dat QHActiveDefense.exe File created C:\Program Files (x86)\360\Total Security\config\tools\nodes\360Central.xml 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\deepscan\lcrd.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\safemon\urllib.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\safemon\wd.ini 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\it\ipc\360ipc.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\zh-TW\ipc\appmon.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\endata\lm_1001.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\safemon\FilePrivacy.tpi 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\360Central.exe 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\QHFileSmasher.exe 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\deepscan\rmt.exe 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\pl\deepscan\dsconz.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\ja\deepscan\ssr.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\ja\ipc\Sxin.dll.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\deepscan\BAPIDRV64.sys 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\fr\deepscan\dsurls.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\vi\safemon\spsafe.dll.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\Utils\360WifiProtect.dll 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\pt\ipc\regmon.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\config\tools\nodes\TraceClean.xml 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\config\newui\themes\default\DeviceMgr\DeviceMgr_theme.ui 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\zh-TW\ipc\Sxin64.dll.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\en\safemon\UDiskScanEngine.dll.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\es\ipc\yhregd.dll.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\pt\ipc\yhregd.dll.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\es\deepscan\DsRes.dll 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\filemon\fr9.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\zh-TW\deepscan\cloudsec3.dll.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\ru\ipc\filemgr.dll.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\ipc\ipcService.dll 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\ipc\360AntiHacker.sys 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\de\safemon\webprotection_firefox\plugins\nptswp.dll.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\vi\ipc\Sxin.dll.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\softmgr\SML\SMLCore.dll 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\zh-TW\deepscan\dsconz.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\libleakres.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\ja\safemon\360procmon.dll.locale 360TS_Setup.exe File opened for modification C:\Program Files (x86)\360\Total Security\safemon\360SelfProtection_old.sys 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\tr\safemon\bp.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\ru\deepscan\DsRes.dll 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\safemon\SomProxy.dll 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\ja\safemon\360SafeCamera.tpi.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\pl\safemon\Safemon64.dll.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\hi\safemon\UDiskScanEngine.dll.locale 360TS_Setup.exe -
Drops file in Windows directory 2 IoCs
Processes:
EaInstHelper64.exedescription ioc process File created C:\Windows\ELAMBKUP\360elam64.sys EaInstHelper64.exe File opened for modification C:\Windows\ELAMBKUP EaInstHelper64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 15 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3628 6712 WerFault.exe notepad.exe 7432 5616 WerFault.exe notepad.exe 11008 10548 WerFault.exe notepad.exe 12024 11968 WerFault.exe notepad.exe 11524 8124 WerFault.exe notepad.exe 6884 10660 WerFault.exe notepad.exe 12512 12384 WerFault.exe notepad.exe 12932 9944 WerFault.exe notepad.exe 3972 10036 WerFault.exe notepad.exe 8380 8204 WerFault.exe notepad.exe 1572 5664 WerFault.exe notepad.exe 11292 15300 18200 17916 18200 17772 17424 18200 -
NSIS installer 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\360_install_20240514145253_240726562\temp_files\Utils\CondrvFix.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\360_install_20240514145253_240726562\temp_files\Utils\CondrvFix.exe nsis_installer_2 -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
QHSafeMain.exeQHSafeTray.exeQHActiveDefense.exe360TS_Setup.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 QHSafeMain.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString QHSafeMain.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 QHSafeTray.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString QHSafeTray.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 QHActiveDefense.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString QHActiveDefense.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 360TS_Setup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies data under HKEY_USERS 54 IoCs
Processes:
QHActiveDefense.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\360Safe QHActiveDefense.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\360Safe\360Scan\NetProbe\5 = "1" QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs QHActiveDefense.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\360Safe\360Scan\NetProbe\1 = "1" QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\360Safe\360Scan\NetProbe QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\360Safe\360Scan\NetProbe QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\360Safe\360Scan QHActiveDefense.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\360Safe\360Scan\NetProbe\3 = "1" QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople QHActiveDefense.exe -
Modifies registry class 64 IoCs
Processes:
regsvr32.exeBlackkomet.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exe360TS_Setup.exeQHSafeTray.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exemsedge.exewinupdate.exewinupdate.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SD360 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}\ProgID\ = "MenuEx.SD360MN.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B09C75BE-F1AE-47BA-BC47-19F5C0A15B33}\TypeLib\ = "{FF9EAEBA-7783-4904-99E3-F3E322C0F648}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Blackkomet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FF9EAEBA-7783-4904-99E3-F3E322C0F648}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B09C75BE-F1AE-47BA-BC47-19F5C0A15B33}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\SD360 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B09C75BE-F1AE-47BA-BC47-19F5C0A15B33}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\Cleanup\Icon = "\"C:\\Program Files (x86)\\360\\Total Security\\QHSafeMain.exe\",0" 360TS_Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{086F171D-5ED1-4ED2-B736-CFF3AD6A128E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FF9EAEBA-7783-4904-99E3-F3E322C0F648}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\360TotalSecurity.ext.1\shell\open\command\ = "\"C:\\Program Files (x86)\\360\\Total Security\\safemon\\QHSafeTray.exe\" %1" QHSafeTray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SD360 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FF9EAEBA-7783-4904-99E3-F3E322C0F648}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\360\\Total Security" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\360TotalSecurity.ext.1\shell QHSafeTray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\360TotalSecurity.ext.1\shell\open\command QHSafeTray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MenuEx.SD360MN.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B09C75BE-F1AE-47BA-BC47-19F5C0A15B33}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B09C75BE-F1AE-47BA-BC47-19F5C0A15B33}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\Cleanup\command 360TS_Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MenuEx.SD360MN.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\SD360\ = "{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B09C75BE-F1AE-47BA-BC47-19F5C0A15B33}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MenuEx.SD360MN.1\CLSID\ = "{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MenuEx.SD360MN regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MenuEx.SD360MN\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FF9EAEBA-7783-4904-99E3-F3E322C0F648}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B09C75BE-F1AE-47BA-BC47-19F5C0A15B33}\ = "ISD360MN" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\.TotalSecurity QHSafeTray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\Cleanup 360TS_Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B09C75BE-F1AE-47BA-BC47-19F5C0A15B33}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540404634-651139247-2967210625-1000\{2C192B8C-6B90-4A30-8742-4BB6274334B1} msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\Cleanup\command\ = "\"C:\\Program Files (x86)\\360\\Total Security\\QHSafeMain.exe\" /runclean" 360TS_Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\SD360\ = "{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MenuEx.SD360MN\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B09C75BE-F1AE-47BA-BC47-19F5C0A15B33} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SD360\ = "{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MenuEx.SD360MN\CLSID\ = "{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}\InprocServer32\ = "C:\\Program Files (x86)\\360\\Total Security\\MenuEx64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe -
Processes:
cefutil.exeupdroots.exeupdroots.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4812BD923CA8C43906E7306D2796E6A4CF222E7D\Blob = 140000000100000014000000c617d0bca8ea0243f21b06995d2b9020b9d79ce40300000001000000140000004812bd923ca8c43906e7306d2796e6a4cf222e7d09000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090b000000010000002c000000510075006f0056006100640069007300200052006f006f0074002000430041002000330020004700330000000f0000000100000020000000d09aacd3381f4d4ff6f99f9d2d7bfb522b5b969a2d573348ee029a01df64e3162000000001000000640500003082056030820348a00302010202142ef59b0228a7db7affd5a3a9eebd03a0cf126a1d300d06092a864886f70d01010b05003048310b300906035504061302424d31193017060355040a131051756f5661646973204c696d69746564311e301c0603550403131551756f566164697320526f6f742043412033204733301e170d3132303131323230323633325a170d3432303131323230323633325a3048310b300906035504061302424d31193017060355040a131051756f5661646973204c696d69746564311e301c0603550403131551756f566164697320526f6f74204341203320473330820222300d06092a864886f70d01010105000382020f003082020a0282020100b3cb0e10678eea1497a7322a0a56367f684cc7b36f3a231491ff197fa5caaceeb3769d7ae98b1bab6b31dbfa0b534cafc5a51a793c8a4cffacdf25de4ed982320b44decadb8caca36e16833ba6644b3289fb1616387eeb43e2d3744ac2620a730add49b357d2b00a859d713cdea3cbc032f3013920431b35d153b3b1eec59369823e16b52846a1deea8909ed43b805468a86f55947be1b6f012110b9fda9d228ca103909ca1336cf9cadad4074792b023f34fffa20697dd3ee61f5bab3e730d0372386726145294859686f77a62e81be074d6fafcec44513911470068f1f9ff88769b10eefc38919ebea1c61fc7a6c8adcd6030b9e26ba12ddd45439ab26a333ea7581da2dcd0f4fe403d1ef15971b6b90c5029093660221b147de8b9a4a80b9558fb5a22fc0d63367da7ec4a7b40444eb47fbe658b9f70cf07b2bb1c07029c340622d3b4869dc233c48eb7b0979a96ddaa83098cf80720388a65b46ae72797c08032165aeb7e11ca5b12aa231de6604f7c074e871deff3d59cc9626128b8595571aab6b750b443d11283c7b61b7e28f674fe5ec3c4c60806957381e015b8d55e8c7dfc0cc77233449757cf69811eb2ddeed412e1405027fe0fe20eb35e711ac22ce573ddec9306d100385cdf1ff8c16b5c1b23e886c607f904f95f7f62dad01390704fa75807dbf4950edefc9c47c1ceb807edbb6d0dd13fec9d39cd7b297a90203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c617d0bca8ea0243f21b06995d2b9020b9d79ce4300d06092a864886f70d01010b050003820201003461d956b51287554ddda3353146bba40772bc5f6162e8a5fb0b37b13cb6b3fa299d7f02f5a4c9a893b77a7128698f73e15290dad5be3ae5b7766a568021df5de6e93a9ee53ef6a269c72a0ab01847dc20707d52a33e597cc1bac9c8154061ca72d670acd2b7f01ce48629f0ceef6863d0b5208a15619a7e8698b4c9c276fbccba3016cca361c67413e56befa315ea03fe138b64e4d3c1d2e884fb49d1104d7966ebaafdf48d311e7014addcde67134c811561bcb7d9917771198160bbf058a5b59c0bf78f225527c04b016d3b990dd41d9b63672fd0ee0dca66bc944fa6adedfcee63ac573f6525cfb2868fd008ffb876146edee527ecab78b553b9b63fe820f9d2a8be6146ca878c84f3f9f1a0689b221e81269b10049171c0061fdca0d3b956a7e3982d7f839ddf8c2b9c328e3294f0013c222a9f43c22ec3983907387bfc5e00421ff33226798384f6e5f0c15112c00b1e04230c54a54c2f49c54ad1b66e600d6bfc6b8b852464b7890eab25475b3ccf7e49bdc7e90ac6daf77e0e1708d34897d07192f00f393e346a1c7dd8f222aebb69f433b4a64855d10f0e26e8ecb60b2da78535cdfd59c89fd1cd3e5a2934b93d84ceb165d4599191567521c1779ef97ae1609dd3ad0418f47ceb5e938f534a2229f8482b3e4d86ac5b7fcb06995960d85865958d44d1f77f7e277f7dae80f5074cb63e9c715499044bfd58f998f4 cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B72FFF92D2CE43DE0A8D4C548C503726A81E2B93\Blob = 1900000001000000100000007c8e1304ab7484ebb4bab9eebbc4cd2d0f0000000100000014000000c6d62908148da43de8b8f6f8eeadc17dd0a8aac3030000000100000014000000b72fff92d2ce43de0a8d4c548c503726a81e2b93090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001c000000440053005400200052006f006f0074004300410020005800310000001400000001000000140000001dea652c00eda3222321f906de8e78c082130d2f2000000001000000dc030000308203d8308202c0021100d01e408b0000027c0000000200000001300d06092a864886f70d01010505003081a9310b3009060355040613027573310d300b0603550408130455746168311730150603550407130e53616c74204c616b65204369747931243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e3111300f060355040b13084453544341205831311630140603550403130d44535420526f6f7443412058313121301f06092a864886f70d010901161263614064696773696774727573742e636f6d301e170d3938313230313138313835355a170d3038313132383138313835355a3081a9310b3009060355040613027573310d300b0603550408130455746168311730150603550407130e53616c74204c616b65204369747931243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e3111300f060355040b13084453544341205831311630140603550403130d44535420526f6f7443412058313121301f06092a864886f70d010901161263614064696773696774727573742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d2c626b6e7a53dc1c468d5506f53c56f491309b8af2c488d146aa3175f5af9d32e752fd82862d1932ffc4dd4ab87e508c799e7923f75bdeb25b415c19b193dd2448dd774206d37028f69935b8ac4199df4b20efc166cb9b1059283d1852c60943e4555a0d9ab0821e660e83b74f299505168d0032db180bea3d852b044cd434a708e588595e14e2cd62d416fd684e7c89844ca47db2c24a56926cf6bb82762c3f4c97a9223ed136782ae452e45e57e723f859d946210e63c91a1ad7700e015ecf38480727a8e6e6097c724591034835be1a5a469b657351c7859c6d32f3a7367ee94ca04130562067023b3f47cee45d9640b5b49aaa443ce26c444126cb8dd790203010001300d06092a864886f70d01010505000382010100a237b23f69fbd7867954493195332bf3d1091449626086a5b011e250c21d06573e2de83364be9baaad5f1b4dd49995a28b9ac96272b569ead958ab35ed15a243d6b6bc07796564737dd779ca7bd55a51c6e15304968d38cfa317ac39716b01c38b533c63e9ee79c0e4be9232647ab31f979462bdeab2201595fb97f2782f63364038e3460f1dddac95cae74b907bb14ba9d4c5eb9adaaad5a39414468d2d1ff33ad6933af63e79fce8e6b075edee3dc970c75daa814b46251cc76c15e3954e0faa3237940a172492138458d2636f2bf7e65b620b1317b00d524cfefe6f5ce2916e1dfda462d768fa8e7a4fd208da93dcf092117ad0dc72930c7393628568d0f4 cefutil.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F373B387065A28848AF2F34ACE192BDDC78E9CAC cefutil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A9822E6C6933C63C148C2DCAA44A5CF1AAD2C42E\Blob = 1900000001000000100000001caf645fc193ffecb3eb8d46631a01bb0f0000000100000040000000ede6a61ca180765034086dbe66a2f90fef463d9f44aaebe48029f0d555947d9d3075769f62d1c03707a585e269197d4b669cdd643dfe6c80636291a253c00270030000000100000014000000a9822e6c6933c63c148c2dcaa44a5cf1aad2c42e090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b0601050507030606082b06010505070307060a2b0601040182370a03040b000000010000005a0000000e204100750074006f00720069006400610064006500200043006500720074006900660069006300610064006f007200610020005200610069007a002000420072006100730069006c00650069007200610020007600320000001400000001000000140000000c39203ab7011fcbd7287d41a0c7fa4aad3224be2000000001000000a5060000308206a130820489a003020102020101300d06092a864886f70d01010d0500308197310b300906035504061302425231133011060355040a130a4943502d42726173696c313d303b060355040b1334496e7374697475746f204e6163696f6e616c206465205465636e6f6c6f67696120646120496e666f726d6163616f202d20495449313430320603550403132b4175746f72696461646520436572746966696361646f7261205261697a2042726173696c65697261207632301e170d3130303632313139303435375a170d3233303632313139303435375a308197310b300906035504061302425231133011060355040a130a4943502d42726173696c313d303b060355040b1334496e7374697475746f204e6163696f6e616c206465205465636e6f6c6f67696120646120496e666f726d6163616f202d20495449313430320603550403132b4175746f72696461646520436572746966696361646f7261205261697a2042726173696c6569726120763230820222300d06092a864886f70d01010105000382020f003082020a0282020100ba46a40edde740f2b5a07c52955745fc6d84f38601c98503ad98abd2f25e0599c9bb6f6267fd7744b903073cd21b0062d4702c42837966ab9956ae81bc6a49bdf3740f62b7eb5b07669442249d46ac9a421830f024a85141eaab95f1a82b027869b529275e9c2e73c6fe23a5e3a6cefd6c1b6b0054eb00ad4f3a4c3ce70a885bda5e9a0b56e4b554381df20a93644ec3419253202acffc746ed4db333862e4fe8e4c581cf78f2a4dffc592d90952bdcf70009d699a336a888745219916510d34df82bdb469a87c7cd4ddd3f2155c4bc55810ea8519cb3622582a720c9a96decacf085161bfb40529062b8690fee94dc3040547cbcf76d97f71a6877b1540e4338078071da4f28e9b403bc97250df69bef02c961f90b5d5ae74e365b48c1ae96a1bfb725cc58254eae05307c4cc12e9f7ded72fd4482f473f266104b1129a336bb5864b132bd0869d47ed69fbfc841266f856e50e8a6c76c46b1a7ac2a05a12d1238958017c0858da158e15d97e7d37b6a445f50385cc47fa8b7945b8666233d3264ade1ce9d47fe66d26b93c7dcd0f280a290f9bdd63abb9a6471a84d785a4036506044b528d8334427f318e112ee6b36795407e977a4000f9116c833858ad03335ba6c4c1c5b0ac0da906f0a6690134b6e9f894484f3ea67509ec4ac53be0c95eb032ff9f6959cf3c306f0dce2757ec5a1b68ffec4f6f78323e79c5b45d957f0203010001a381f53081f2304e0603551d200447304530430605604c010100303a303806082b06010505070201162c687474703a2f2f61637261697a2e69637062726173696c2e676f762e62722f44504361637261697a2e706466303f0603551d1f043830363034a032a030862e687474703a2f2f61637261697a2e69637062726173696c2e676f762e62722f4c435261637261697a76322e63726c301f0603551d230418301680140c39203ab7011fcbd7287d41a0c7fa4aad3224be301d0603551d0e041604140c39203ab7011fcbd7287d41a0c7fa4aad3224be300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106300d06092a864886f70d01010d05000382020100599a1469186d7d2943707d769b61df778e1a76e4a9d6cb76a4160c4c9412c690d18103c5ad06d92d44bcb20976098039670018346d060ae6b5105948ba7560fc3f8e1d1855702b9e4b95ac89ab0a77247b61c4c791268e46135137b68c270ad30df09a2b228383b3bd8335ad9b3cbc788329356136f8117133205463534501d8135a843bd7661324b7c446c522d87324ee1c131796c825e81b1ecfdf85506d3ceaf7509e1b97dea76bdbd673d2cf7c50c0b08ce553127a8639ac355b67c7ead4fbd1c25dea0e977398ae29bfe43af30436502cedde1edb85e81d8409eef3a683335b6f47794f48b5fcb82613abaab3f46111fb4567f31d3e6efe2a4b26441a9fb1a2e03cdae0e4053a78acfba8a14dbf5d2c772990cd131def0628d8b714f35bc8c99ea77e31128a7862c4d105bc060263042b0d89dde45c5b328044d442ec2af3f2408731d53ee20a320c148dd5726d0be6fd8de4a8f3058d7517779b0ab9fa9092996588326743058e2d0b15bb35f161e8d96777ed16e5e8012d6b343f8e83b3f7ea0f4a1e3e35849d8c80343fa995e8c3adc4cd9eca14162c199ee4368bb9b9a34225073ec3e5d5684fa0661ca6b3b6731c901a3f40b91a56427087ff6f2d0f11fd1efff78530150ee31731ee2795ccc9e9991e97c76d5b07b5056a3df245dfba827924702e9b821f66a9a56d27ccf62aa2d15f856fe0469daad2a54e550e cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5A4D0E8B5FDCFDF64E7299A36C060DB222CA78E4\Blob = 1900000001000000100000009e5a165b56f0e0b1ff9e34c176996c450f00000001000000140000007f61704a69779e272d209ac1d4d1bf9e43aebbb20300000001000000140000005a4d0e8b5fdcfdf64e7299a36c060db222ca78e409000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703090b00000001000000440000005600690073006100200049006e0066006f0072006d006100740069006f006e002000440065006c0069007600650072007900200052006f006f00740020004300410000001400000001000000140000004f8ada76ff6777239aa6807d7ddb887585f7817a2000000001000000fd030000308203f9308202e1a00302010202105b57d7a84cb0afd9d36f4ba031b4d6e2300d06092a864886f70d01010505003079310b3009060355040613025553310d300b060355040a130456495341312f302d060355040b13265669736120496e7465726e6174696f6e616c2053657276696365204173736f63696174696f6e312a3028060355040313215669736120496e666f726d6174696f6e2044656c697665727920526f6f74204341301e170d3035303632373137343234325a170d3235303632393137343234325a3079310b3009060355040613025553310d300b060355040a130456495341312f302d060355040b13265669736120496e7465726e6174696f6e616c2053657276696365204173736f63696174696f6e312a3028060355040313215669736120496e666f726d6174696f6e2044656c697665727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c91100e11fd09247e92f1d1c62381afc48483d9a5c847d0c66c45915f3fa0b6213b5ffd673e32d803e324cad32a225ef9e2dddf9a0ad1202b7183be476062b805efa44e2456705108d0f65c78da0453d390db5ef585a32edd4e094267dcff4edd829e4b6ff68c4a82691e1d8fc2c9fa42060d52f31b61d89946311d2e83f18c3b9cc036e7a064ebf8dfca792ede52a3e76ed8697e44c150a843f0a8de6e252a807b456d981e2059d43ca27063d9900cd91ef7416ed45b4220b76bc0e0969288db5a006fd8ff9f155d61c681babbac3b4d2b5477d17d24255d2b18089bdd14b00772e91bb6ce8db22e715e66420268563a00d5ed39c3a835c7f2a635398e191570203010001a37d307b300f0603551d130101ff040530030101ff30390603551d2004323030302e060567810302013025301506082b060105050702011609312e322e332e342e35300c06082b060105050702023000300e0603551d0f0101ff040403020106301d0603551d0e041604144f8ada76ff6777239aa6807d7ddb887585f7817a300d06092a864886f70d010105050003820101000945b541d5077432727600cf998b7eb5e9671bf4aef833da7f572b7a0ce5378ddb25a268b0c3fb3708e8258fc7d877b85cb59be6b5c4925fb11f553253017b9ad694a316c6c44bedf213d949307875ada6cd78302af5ee1f2cc5e508f2d61381d3fa5259a17d011a5528927b4ce250746281b05d93cb87d208ba992e07f16eac0cb1df6ccac5c8deb0d78c885e92abdb81e2f33ea66bfa97e0161c0208b48c4169792e5deeed093dc11d3de0367a8e3ebe2425424544b71f269b1f83a533455cd8afa320db05ffae0eafb18db517fd1d8109beb3f11c8371977255c21623e0049e68ee0ac2155bc2dc3de1373f5eb19c7b10e8739942deb022e3f519ab07980b cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2964B686135B5DFDDD3253A89BBC24D74B08C64D\Blob = 190000000100000010000000315b0ac2ad3a489eccf56d5a00e6b11b0f0000000100000014000000a6b11123adfd3e4b022fed9949cd96b7bb451aca0300000001000000140000002964b686135b5dfddd3253a89bbc24d74b08c64d090000000100000040000000303e06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a03040b000000010000002000000041002d004300450052005400200041004400560041004e004300450044000000140000000100000014000000377f3e3e997160ca24d4911379d07429b4a824d82000000001000000d7060000308206d3308205bba003020102020100300d06092a864886f70d01010505003081cc310b30090603550406130241543110300e0603550408130741757374726961310f300d060355040713065669656e6e61313a3038060355040a13314152474520444154454e202d20417573747269616e20536f636965747920666f7220446174612050726f74656374696f6e31253023060355040b131c412d434552542043657274696669636174696f6e2053657276696365311830160603550403130f412d4345525420414456414e434544311d301b06092a864886f70d010901160e696e666f40612d636572742e6174301e170d3034313032333134313431345a170d3131313032333134313431345a3081cc310b30090603550406130241543110300e0603550408130741757374726961310f300d060355040713065669656e6e61313a3038060355040a13314152474520444154454e202d20417573747269616e20536f636965747920666f7220446174612050726f74656374696f6e31253023060355040b131c412d434552542043657274696669636174696f6e2053657276696365311830160603550403130f412d4345525420414456414e434544311d301b06092a864886f70d010901160e696e666f40612d636572742e617430820122300d06092a864886f70d01010105000382010f003082010a0282010100ddeb97232fa69dfe8160a6caf901f993aefdb5416a793f23959c4c7b0f1e3621eec3d2a8c560732fa2a4b0afb9b8aec66adc3eb1b0189ed10613cd0ff898358400cc7be16be55d1b73a412de0915b5f5025bf448bdf30cdfda31be6a8998e80f9c953b1fafa798bb6cabad6dbfd915262ff6e18e705d6de875eb7bdac179ec4a06eacefcc3405454b35c327812f5b659ce6746dff77a25b906828345ffc0dc8020495bfb7426b708cf2a695c8395b54cf33abad4f3acee5204f746d925e648c6ec3107a456fd1f47d3398d6ff3e811a1a3bada00343c28b2b205598f08157987b7280835d67ce7ca5783bf5f7cb8adc3735a17206623271d85a4a594bc0b80130203010001a38202bc308202b8301d0603551d0e04160414377f3e3e997160ca24d4911379d07429b4a824d83081f90603551d230481f13081ee8014377f3e3e997160ca24d4911379d07429b4a824d8a181d2a481cf3081cc310b30090603550406130241543110300e0603550408130741757374726961310f300d060355040713065669656e6e61313a3038060355040a13314152474520444154454e202d20417573747269616e20536f636965747920666f7220446174612050726f74656374696f6e31253023060355040b131c412d434552542043657274696669636174696f6e2053657276696365311830160603550403130f412d4345525420414456414e434544311d301b06092a864886f70d010901160e696e666f40612d636572742e6174820100300f0603551d130101ff040530030101ff300b0603551d0f0404030201e630470603551d250440303e06082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a0304301106096086480186f84201010404030200ff30510603551d20044a3048304606082a28001801010103303a303806082b06010505070201162c687474703a2f2f7777772e612d636572742e61742f63657274696669636174652d706f6c6963792e68746d6c303b06096086480186f8420108042e162c687474703a2f2f7777772e612d636572742e61742f63657274696669636174652d706f6c6963792e68746d6c30190603551d1104123010810e696e666f40612d636572742e6174302f0603551d1204283026810e696e666f40612d636572742e61748614687474703a2f2f7777772e612d636572742e617430450603551d1f043e303c303aa038a036863468747470733a2f2f7365637572652e612d636572742e61742f6367692d62696e2f612d636572742d616476616e6365642e636769300d06092a864886f70d0101050500038201010025f522f81f746dabbdfbf7e4ee3cbd212f71568476537c5121411d6cf7251028ce0cef681b701e48ca670b7997f0563ad8dbbc77d18c3b7b8a394111cc4e3ab342d5f7f2307c07ad7a6f7dfe98a50e709f198860441c5118861ccaabb845f45a4b8336048ac1e7ec817b36ede7816ae1e034655c4d81f5ae61eefd9c8ba4bc4ec894363c2cc0d43cd6deb5a4217f76a2027b95345d5ab6f1c142f55c68a7c679da43be3eff2d2923d24d12fee2736b6993079132991e75a2d69ac0b5fa8adf29379bb20ebd68c682c7ba3a8cd38d46647fed355a3dff3f93a839d9c1d9f585a342fba9db66f9ad6c46279af92d9e2f08f985e3e4f896eb6351801afe51ae4138 cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6969562E4080F424A1E7199F14BAF3EE58AB6ABB\Blob = 5300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520034000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080300000001000000140000006969562e4080f424a1e7199f14baf3ee58ab6abb2000000001000000e5010000308201e130820187a00302010202112a38a41c960a04de42b228a50be8349802300a06082a8648ce3d040302305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523431133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523431133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3059301306072a8648ce3d020106082a8648ce3d03010703420004b8c679d38f6c250e9f2e39191c03a4ae9ae539070916ca63b1b986f88a57c157ce42fa73a1f76542ff1ec100b26e730effc721e518a4aad9713fa8d4b9ce8c1da3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041454b07bad45b8e2407ffb0a6efbbe33c93ca384d5300a06082a8648ce3d0403020348003045022100dc92a1a013a6cf03b0e6c4219790fa14572d03ecee3cd36ecaa86c76bca2debb022027a88527359b56c6a3f247d2b76e1b020017aa67a61591defa94ec7b0bf89f84 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B38FECEC0B148AA686C3D00F01ECC8848E8085EB\Blob = 0f0000000100000014000000ef8b3f0c89f556961efde20191f5e0e3ae1ca048030000000100000014000000b38fecec0b148aa686c3d00f01ecc8848e8085eb09000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090b000000010000004000000044004900520045004300430049004f004e002000470045004e004500520041004c0020004400450020004c004100200050004f004c00490043004900410000002000000001000000c3050000308205bf308203a7a003020102021000d28570fdaea7d65f118415c631b5cb300d06092a864886f70d0101050500305d310b300906035504061302455331283026060355040a0c1f444952454343494f4e2047454e4552414c204445204c4120504f4c49434941310d300b060355040b0c04444e49453115301306035504030c0c4143205241495a20444e4945301e170d3036303231363130333732355a170d3336303230383232353935395a305d310b300906035504061302455331283026060355040a0c1f444952454343494f4e2047454e4552414c204445204c4120504f4c49434941310d300b060355040b0c04444e49453115301306035504030c0c4143205241495a20444e494530820222300d06092a864886f70d01010105000382020f003082020a02820201008000ad0cc3a32007a363fff734a0cdee6a5408175db10115a7e6b95f8a71ff0cc21dea37f3de937fd6054d84b2d5d71c0cf4c49170400e5ac898a480e80d33c007f3b7f5aca1387ac0665424fc52cc302af2c3c4a12c76bfc1c0bf82f19bf0687a1340c897bc1c2507080ab796efcc2954e0e6652deab22eb10969124e30d5d8f8bc00802f4d930fcd2e571b33bb9f304ec4a5cb79a7fbe23418b6209e1b9f5da7c93aad4564b318ce11129c6d1e554528849c57674df9cbe28b8f5809d439ffc836d238e20c657f150e7dc107dda922df9100c46c713474dc39eaea4f44697f58db580a52712beca91d507433f9296afafe99f4e7cc45456dca5a25a212e3ced7380539f01a09f57659ce626f7a340d2cd1bc0412ec3d53c8fad002cbce3d21b5c5e0393365cf3953c99b46f99d33f359800841be6f4ba0fa4acea4761c85e2afaf149d65acf77f97e43349a6afbece2b37f12ec173059c9c604c9d300d97549e8162bbe7e02ff7140714a97791e9dc91958ed3889033476f71c31469faa62d011e1bead32ee27f0bdccfe722f0f141a30192e580d3bea962a855880b3434ecdc2115aaefd6225e89f55192132a6f8016d9b10dd92ef810b8c2fe5245339c1d387cdc15693473bfa02cbb117b94cdf8372d6f3def835ac61e9b74498fd9c28dbe167650c85ad12516f6f6cc8c9c5a309e65bed09a4893d7fa680d753187f9f70203010001a37b3079300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604148e45f49f73c5ff2f1b05db0147601b038a81b7ba30370603551d200430302e302c0604551d20003024302206082b060105050702011616687474703a2f2f7777772e646e69652e65732f647063300d06092a864886f70d0101050500038202010075e573c951512f8b19a087e9ffae3636a6fc411fe31ed7716019c66f9a0230bd6271ad73fe912d4ee4264044a9ae7826233169dc9a73961e49510be0efc1b843ef719cee41b7c5501f32849e2286f1f71f8fd9ad2b4eda972897bb969a1af8b1d97a04f3549912199615806739ff025f7afc5542505ae6b9a2ffb8a8621e14cdd93fbea36548c53bd737ce0dfa2890dabff9e35147257d4ad3674d87aa62bc5eec7a80447cf79f0abd655794caf21166d6527fe43a707504cd3b97d43672f75156bf34f5d241e1b4daa843fe6b124912b45dcf2242968c0823268cb2104e5daa53ee012f75e5b9a21133c4d76afdf80eca6e82d9e7bb59234eb5f9111d2f6b23f57b1120ea4112903246db313ba9c15b73683a461b8cfe97b756b96199cc4ef083fa37f1de1c9d1c718b0393c3c473822ea8981d64a29a8cf754084dcfea81cbf55b099963af758c96f87935d5dceb41817938845e6ff16f6276db91ce5a8560391d5be22a2f4325dbc27a24d315b0a2f18ca07d6b480913ffa24c668aec705209538c30ccb8d5ba24dc30993ea15eb7df81acec37be4e9b2758de7ea19b547f06b62fe43250fde710bba8cdda181bd463663dea517139f49c3edf5af4dac74c26ed8bb521ba347902736110da9831a860cb7e07a7d0b70543895bcd8526d9b051aff78c52aa12a758df929b67f29df2e6f46931f416e7de775b1edd9a0501ad cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 0f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000002500000030233021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c00b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b002000430041000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030703000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e2000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c cefutil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1632478D89F9213A92008563F5A4A7D312408AD6\Blob = 0f0000000100000020000000d5b12bb9975454057e6e629d9507a5a033ef1c11af5e2a567dc3c939dc2057b10300000001000000140000001632478d89f9213a92008563f5a4a7d312408ad6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b0000000100000012000000430041002000836c1a903968c18b664e00005300000001000000230000003021301f06092b06010401829b510230123010060a2b0601040182373c0101030200c020000000010000005c0500003082055830820340a003020102021050706bcdd813fc1b4e3b3372d211488d300d06092a864886f70d01010b05003046310b300906035504061302434e311a3018060355040a1311576f5369676e204341204c696d69746564311b301906035504030c12434120e6b283e9809ae6a0b9e8af81e4b9a6301e170d3039303830383031303030315a170d3339303830383031303030315a3046310b300906035504061302434e311a3018060355040a1311576f5369676e204341204c696d69746564311b301906035504030c12434120e6b283e9809ae6a0b9e8af81e4b9a630820222300d06092a864886f70d01010105000382020f003082020a0282020100d049211e25fc87c12ac2acdb7686064ee7d07434dced6535fc50d6883fa4f07feb0f5f792f89b1fdbc635837939b38f8b75ba9fad871c7b4bc80978d6c4bf150d52a29aaa8197a96e6958e74ed970a5775f405db6d0b39b9017faaf6d6da6ce605e0a44d52fcdbd074b7118c7b8d4fff8783aeff050313575037fe8c9652104c5fbf947169d9963e0c434fbe30c09f39744f06455da3d656396807cc874f50779371d94408b18a34e989acdb9b4ee1d9e452458c2e141f916b191d68292c56c4e21e135764f061e3b911dfb0e157a01badd75fd1afdb2b2d3fd0688e0fea9f0f8b35581b131cf4de35a10a5dd6eadf126fc0fb69074672dc81f6042317e04d75e1726fb028eb9be1e183a19f4a5dafcc9bfa0220b6186277913ba3d565addc7c90771c4441a44a8beb9572e9f60964dca82d9f7478e8c1a209639cefa0db4f9d95ab204fb7b0f7875ca6a0e43738c75ce3350f2cada380a2ec2e5dc0cfed8b05c2e6736ef689d5f5d2468eea6d631b1e8ac97da6f89cebe5d563854d73666911fec80ef4c1c76649537ee4196bf1e97a59a36d7ec517e627c6ef1bdb6ffc0d4d0601b40e5c30465560af38653aca47baac2ccc461fb246963ff3ed2605ee77a16a6b7e2d6d585c4ad48e67b8f1dad5468a27f911f2c942fe4ededf1f5cc4a486871633a1a71718a50de405e52bc22b0ba29590b9fd603c4e893ee79cee1fbb010203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414e04dbfdc9b415d13e864f0a7e915a4e181c1ba31300d06092a864886f70d01010b050003820201006a8a703859b6da8b18c8be2ad3b619d566297a5dcd5b2f731c264ea37d6fabb7294da6e9a51183a73973af104492e6255d4f61fac806be4e4beffef331fec67c700a4158dae8994b96c978bc987c0229ed0980e60a3a82022ae2c92fc8561926ee781c23fdf793654ee7f39898afcdddd99e408831283aab2e0bb0ac0c24fa7a2698f3126110f45d17f77ee2789754e28ce829ba8c1032bddd336b38867e393d0e0372a75d798f458a59ae5b216e3146d5598dcf155fdd3125cfdb60d6814472290257f696d4d6ffea29db39c5b82c8a1a8dcecbe742318605680e9e14dd0090ba694508db6e908186a72a053fe68439f8b7f9575f4ca4795a100c5ed56bff355f05511e6ca375a9cf5083d37cf466f7828d3d0c7de8df7ba80e1b2c9cae407087daeda716825abe356c204e2261d9bc517acd7a61dc4b11f9fe6734cf2e0466615c5797238cf3861b48df2aafa7c1ffd88e3e03bbd82ab0fa1425b2516b8643852e072316808d4cfbb4633bccc374ed1ba31efe350f5f7c1d1686f50ec395f12faf5d253b51e6d7764138d14b033928a51e9172d47dab9733c4d33ee069b62879a0098d1cd1ff41724806fc9a2ee720f99ba2de89edae3c09afca57b392897040e42f4fc2708340d7242c6be7091fd3d5c7c108f4db0e3b1c070b4311842186e980d475d8abf10262c1b17e5561cf13d726b0d79ccb298b384a0b0e908dbaa1 cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D904080A4929C838E9F185ECF7A22DEF99342407\Blob = 14000000010000001400000073cda2fe1f45c864c57a2044d03105906b7485650b000000010000005e0000004100670065006e006300650020004e006100740069006f006e0061006c0065002000640065002000430065007200740069006600690063006100740069006f006e00200045006c0065006300740072006f006e0069007100750065000000090000000100000048000000304606082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030606082b0601050507030706082b06010505080202030000000100000014000000d904080a4929c838e9f185ecf7a22def993424070f00000001000000100000000a70d60ef4eefea3b1293ca8d172b15b2000000001000000ed050000308205e9308204d1a003020102020100300d06092a864886f70d0101040500308199310b300906035504061302544e310d300b060355040a1304414e4345311c301a060355040b141343657274696669636174696f6e202620504b49313730350603550403132e4167656e6365204e6174696f6e616c652064652043657274696669636174696f6e20456c656374726f6e697175653124302206092a864886f70d0109011615616e63654063657274696669636174696f6e2e746e301e170d3032303832313039303331375a170d3337303831323039303331375a308199310b300906035504061302544e310d300b060355040a1304414e4345311c301a060355040b141343657274696669636174696f6e202620504b49313730350603550403132e4167656e6365204e6174696f6e616c652064652043657274696669636174696f6e20456c656374726f6e697175653124302206092a864886f70d0109011615616e63654063657274696669636174696f6e2e746e30820122300d06092a864886f70d01010105000382010f003082010a0282010100b66d550f5c418d73c06345006e4109fb507473299c27e8edf6fd8458493829b290057de6d51a1a013c58d6840b454b2af8d85055d5d7c07ab8b2c86e46cb7c4b6dd5f3be7cdf549ba43485a81dfbe69d602d1ff87c10653fef2a24e3bdfd93bb09029ee7aa050a97ea402cae14a36f55aa4dc8b85b21eeddbd99305eb1500fffcb864ce8cfa03e148f1516d8e3096e62e7db8e6aabb84fa5c5e43d8138e9c17ec163c31556d6c45e565ceebfdb0a6f0703c40474a09cd04230ad28d59688747eeb2163041e2e3123f88cb66d505fe56c6e5ae367eb88daaee48a4e784f1c595f15b6be2a78edeaed7934fcfa8c454bd971f349f4626c3d7abb438ea47dd53ca90203010001a382023830820234300f0603551d130101ff040530030101ff301d0603551d0e0416041473cda2fe1f45c864c57a2044d03105906b7485653081c60603551d230481be3081bb801473cda2fe1f45c864c57a2044d03105906b748565a1819fa4819c308199310b300906035504061302544e310d300b060355040a1304414e4345311c301a060355040b141343657274696669636174696f6e202620504b49313730350603550403132e4167656e6365204e6174696f6e616c652064652043657274696669636174696f6e20456c656374726f6e697175653124302206092a864886f70d0109011615616e63654063657274696669636174696f6e2e746e820100300b0603551d0f0404030201c630200603551d11041930178115616e63654063657274696669636174696f6e2e746e30200603551d12041930178115616e63654063657274696669636174696f6e2e746e301106096086480186f842010104040302000730470603551d1f0440303e303ca03aa038863668747470733a2f2f7777772e63657274696669636174696f6e2e746e2f6367692d62696e2f7075622f63726c2f636163726c2e63726c304506096086480186f84201040438163668747470733a2f2f7777772e63657274696669636174696f6e2e746e2f6367692d62696e2f7075622f63726c2f636163726c2e63726c304506096086480186f84201030438163668747470733a2f2f7777772e63657274696669636174696f6e2e746e2f6367692d62696e2f7075622f63726c2f636163726c2e63726c300d06092a864886f70d0101040500038201010004037af67f7a5c3ee0858544b0fdefeda69c9c7f2324fd0d0e121f796ae8da2e102ba429025ae011cf76ef76464d25c466150b0132fb4f9e7cb087f351ad524db20b19fe141400d64ad18fa0fa13fabb3524710aeb4b7bbe899ee3b26538b6f56c8429c6cbc9e5ec1f942a5aa01105f8762d0e7429e0493deb3d29eaf6bc1546fbadc76b8fa6d893c758277b77b61114b97499a38cd700c7c3db5ad6dbe428cba04bfb20ba7bbb2e8f82b2289ce84afd40ce38b2ed700854cb1b9e8e43637dcfac040113a2f3c7ae7d8eac59a0be77d6ad1c0fabd9a309e39551222c1ab91137db3c68b4b9bda23bb00fa652bd2dbe4771f2ff41e47f03864fba69b892f5e398 cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D6BF7994F42BE5FA29DA0BD7587B591F47A44F22\Blob = 140000000100000014000000f2cb8de235ef1043c4da7bcafaeb8903a122afb8030000000100000014000000d6bf7994f42be5fa29da0bd7587b591f47a44f22090000000100000040000000303e06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a03040b000000010000001c00000050006f00730074006100200043004100200052006f006f00740000000f0000000100000014000000e32638c0c98734d2c1e568fab93443b1ae37675b2000000001000000230700003082071f30820607a003020102020448fc7ef5300d06092a864886f70d01010505003081ae31123010060a0992268993f22c6401191602727331153013060a0992268993f22c6401191605706f73746131123010060a0992268993f22c64011916026361311630140603550403130d436f6e66696775726174696f6e3111300f060355040313085365727669636573311c301a060355040313135075626c6963204b6579205365727669636573310c300a06035504031303414941311630140603550403130d506f73746120434120526f6f74301e170d3038313032303132323230385a170d3238313032303132353230385a3081ae31123010060a0992268993f22c6401191602727331153013060a0992268993f22c6401191605706f73746131123010060a0992268993f22c64011916026361311630140603550403130d436f6e66696775726174696f6e3111300f060355040313085365727669636573311c301a060355040313135075626c6963204b6579205365727669636573310c300a06035504031303414941311630140603550403130d506f73746120434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a8f2bd88bec0af44be9b4aa2631cd656ab1d29b21caa151e45d1ac9da061d535f9e45a83366343de385715fcf09462f40780578357a8b315bcfb4d23785fdaf6c78116beabdfe7dc8353732bb6dd63888d45f30ddd7dbfe888b066c1435d37d26da19c9a46c3b33fd0c2a08a942e83a63cc360bd2ccc1e8b6382764128e4156b5c0c6139553841cac866e8c7b89752102670b707b7091ea6135eae995a266f643decc4d3a5b95c7664ad637d8883e24bcc0dded4c6d30842f55b17f571e1912d039f9e1cdc8b72a4e847641087643073d8f2b4f157269357cbb6c70d888b1dcf05305d04d67637e8203257bf0f9c33c6088cf6b4c2a906b05b30a11e2d12ba3f0203010001a38203413082033d300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201063081ba0603551d200481b23081af3081ac060b2b06010401fa380a0a010130819c303006082b060105050702011624687474703a2f2f7777772e63612e706f7374612e72732f646f6b756d656e746163696a61306806082b06010505070202305c1a5a4f766f206a6520656c656b74726f6e736b6920736572746966696b617420524f4f54204341207365727665726120536572746966696b6163696f6e6f672074656c6120506f7374653a2022506f73746120434120526f6f74222e301106096086480186f8420101040403020007308201bc0603551d1f048201b3308201af3081c9a081c6a081c3a481c03081bd31123010060a0992268993f22c6401191602727331153013060a0992268993f22c6401191605706f73746131123010060a0992268993f22c64011916026361311630140603550403130d436f6e66696775726174696f6e3111300f060355040313085365727669636573311c301a060355040313135075626c6963204b6579205365727669636573310c300a06035504031303414941311630140603550403130d506f73746120434120526f6f74310d300b0603550403130443524c313081e0a081dda081da8681a36c6461703a2f2f6c6461702e63612e706f7374612e72732f636e3d506f7374612532304341253230526f6f742c636e3d4149412c636e3d5075626c69632532304b657925323053657276696365732c636e3d53657276696365732c636e3d436f6e66696775726174696f6e2c64633d63612c64633d706f7374612c64633d72733f63657274696669636174655265766f636174696f6e4c69737425334262696e6172798632687474703a2f2f736572746966696b6174692e63612e706f7374612e72732f63726c2f506f7374614341526f6f742e63726c302b0603551d1004243022800f32303038313032303132323230385a810f32303238313032303132353230385a301f0603551d23041830168014f2cb8de235ef1043c4da7bcafaeb8903a122afb8301d0603551d0e04160414f2cb8de235ef1043c4da7bcafaeb8903a122afb8301d06092a864886f67d0741000410300e1b0856372e313a342e3003020490300d06092a864886f70d010105050003820101007046a1c8e41705660f9de24331481d929019c4850185166ef892ce7bae5216c4978d0a287dd5cb6ce3d5e50e324fc8682d34083d73a893422933460c4467f1d09a9c6901e591f10dc9693c334b4e19936333052921a1d8ff3e54ab9ef6a17a02d7dcffa53e5478f9d3c1ca1295f9899e14e2f2a144b2cbe92d7535cc9655bb380b8826dad6acefd352a20b4b3a53da4b2253ccca2a249a62aac4329a7edcccc1b26ccd8fd9b4c0cff502c08c2b845b1b40bc10d050e161d666569a0491a5e3d5bda02e2281b1d938dae4a8875f3c460496dec99a3bbfad786c1d4949b469b9700f059256b6fdafaef8202d4723cfb61ccdc49b804ef9bf31c054bebb317ff33e cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\339B6B1450249B557A01877284D9E02FC3D2D8E9\Blob = 19000000010000001000000052613e8b6ed25f3954b899fc88fe132e0f0000000100000014000000b02f56ccec49800699c31fa897a9e0eac24f28900b00000001000000300000004300680061006d006200650072007300690067006e00200047006c006f00620061006c00200052006f006f0074000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308030000000100000014000000339b6b1450249b557a01877284d9e02fc3d2d8e9140000000100000014000000439c369fb09e304dc6ce5fad10abe503a5faa9142000000001000000c9040000308204c5308203ada003020102020100300d06092a864886f70d0101050500307d310b300906035504061302455531273025060355040a131e41432043616d65726669726d61205341204349462041383237343332383731233021060355040b131a687474703a2f2f7777772e6368616d6265727369676e2e6f72673120301e06035504031317476c6f62616c204368616d6265727369676e20526f6f74301e170d3033303933303136313431385a170d3337303933303136313431385a307d310b300906035504061302455531273025060355040a131e41432043616d65726669726d61205341204349462041383237343332383731233021060355040b131a687474703a2f2f7777772e6368616d6265727369676e2e6f72673120301e06035504031317476c6f62616c204368616d6265727369676e20526f6f7430820120300d06092a864886f70d01010105000382010d00308201080282010100a270a2d09f42ae5b17c7d87dcf1483fc4fc9a1b713af8ad79e3e040a928b6056fab4322f884da16008f4b7094ea0492f49d6d3df9d975a9f940470ec3f59d9b7cc668b9852280902dfc52f848d7a9777bfec409d2572abb53f3298fbb7b7fc7284e53587f955faa31f0e6f2e28dd69a0d94210c6f8b544c2d0437fdbbce4a23c6a55780a77a9d8ea1932b72ffe5c3f1beeb198eccaad7a6945e3960f55f6e6ed75ea65e83256934689a8258a6506ee6bbf7907d0f1b7afed2c4d92bbc0a85fa7677d04f2150870ac92d67d04d233fb4cb60b0bfb1ac9c48d03a97e5cf250ab12a5a1cf4850a5efd2c81a13fab07fb1821c776a0f5fdc0b958fef437ee6450925020103a38201503082014c30120603551d130101ff040830060101ff02010c303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e6368616d6265727369676e2e6f72672f6368616d6265727369676e726f6f742e63726c301d0603551d0e04160414439c369fb09e304dc6ce5fad10abe503a5faa914300e0603551d0f0101ff040403020106301106096086480186f8420101040403020007302a0603551d1104233021811f6368616d6265727369676e726f6f74406368616d6265727369676e2e6f7267302a0603551d1204233021811f6368616d6265727369676e726f6f74406368616d6265727369676e2e6f7267305b0603551d20045430523050060b2b0601040181872e0a01013041303f06082b060105050702011633687474703a2f2f6370732e6368616d6265727369676e2e6f72672f6370732f6368616d6265727369676e726f6f742e68746d6c300d06092a864886f70d010105050003820101003c3b7091f904542791e1ededfe687f615de541654f32f11805946a1cde1f70db3e7b320234b50c6ca18a7ca5f48fffd4d8ad17d52d04d13f5880e2815988bec0e3469324fe90bd26a2302de89726573589749618f615e2af2419560202b2ba0f14eac68a66c18645558bbe92be9ca404c7493c9ee8297a89d7feafff68f5a51790bdac99cca58657096746dbd616c246f1e4a950f58fd19215d35f3ec600493a6e58b2d1d1270d25c832f82011cd7d32334894544cdddc79c4309feb8eb855b5d7885cc56a243db2d3050351c607efcc1472743d6e72ce18288c4aa077e5092b454447acb7677f018a055a93bea1c1fff8e70e67a44749765d75901af5268ff0 cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CFE4313DBA05B8A7C30063995A9EB7C247AD8FD5\Blob = 0b00000001000000200000006900700073004300410020004d00610069006e00200052006f006f0074000000090000000100000040000000303e06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a0304030000000100000014000000cfe4313dba05b8a7c30063995a9eb7c247ad8fd52000000001000000f2050000308205ee308204d6a003020102020100300d06092a864886f70d01010505003081ae310b3009060355040613024553310f300d060355040813064d6164726964310f300d060355040713064d6164726964312f302d060355040a13264950532043657274696669636174696f6e20417574686f7269747920732e6c2e206970734341310e300c060355040b13056970734341311b3019060355040313126970734341204d61696e20434120526f6f74311f301d06092a864886f70d01090116106d61696e30314069707363612e636f6d301e170d3039303930373134353433365a170d3239313232353134353433365a3081ae310b3009060355040613024553310f300d060355040813064d6164726964310f300d060355040713064d6164726964312f302d060355040a13264950532043657274696669636174696f6e20417574686f7269747920732e6c2e206970734341310e300c060355040b13056970734341311b3019060355040313126970734341204d61696e20434120526f6f74311f301d06092a864886f70d01090116106d61696e30314069707363612e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100953025b27d224cda3f16c267df65cceb459247659eac76cf6c6ac9ce03cda3c33872e36da56ba55287e662a5fb017def6744cbb641ef0b607d4afd22eda1e3f49db24260ce360d295979ee62077ab9134dc4633597b6a6f5068ced19653f8c26347feee829968bab7c768014c427519c63bf2a9486188f909e85fd1ad97470d07fec1da42c7a51c58114ab55b36295830f83486886b7ef3f068b8ea568c2a359a699504b0dbc5c7215e0b2458b1e59c92a4f5bd6a2bfc17fbda8a6a27d7c2904e11bba42c16cced9bbba54303d2787c19cb80fb2db5f44809a6a434d16d3dcc470a88e98681ce232c3b147208b0b6a8a9fff55c18fbd76792e789b3008702e6f0203010001a38202133082020f301d0603551d0e0416041461ed398d6b3ce136c6cfdb41fc1b435157cb4d6b3081db0603551d230481d33081d0801461ed398d6b3ce136c6cfdb41fc1b435157cb4d6ba181b4a481b13081ae310b3009060355040613024553310f300d060355040813064d6164726964310f300d060355040713064d6164726964312f302d060355040a13264950532043657274696669636174696f6e20417574686f7269747920732e6c2e206970734341310e300c060355040b13056970734341311b3019060355040313126970734341204d61696e20434120526f6f74311f301d06092a864886f70d01090116106d61696e30314069707363612e636f6d820100300c0603551d13040530030101ff300b0603551d0f04040302010630470603551d250440303e06082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a0304301b0603551d110414301281106d61696e30314069707363612e636f6d301b0603551d120414301281106d61696e30314069707363612e636f6d303a0603551d1f04333031302fa02da02b8629687474703a2f2f63726c6d61696e30312e69707363612e636f6d2f63726c2f6d61696e30312e63726c303606082b06010505070101042a3028302606082b06010505073001861a687474703a2f2f63726c6d61696e30312e69707363612e636f6d300d06092a864886f70d01010505000382010100469c0f62b6da3d1c693ebe22c1e97e20efc9eefac6109e655d4fb844b3d42169564f727e62de9b49879de3c860ad6fb006371d40e17d3ad013d697e28776f71f4dd3832d0ab98859d221cfe6c0768fb5496bf93ccd5e2ba9e9a42913cf0afa9d932ddb38e1722a0d3b2f7097bdd9b304b1a26efa6f84cf60713b9ae385d87fb80d321ba0fa05641668243b9bf8cc2a00117fc02adc3de929947102a3186e2c0c3005ce98964d1af65163a146f42f8f511f3dae8752fdc03b93c88c72d171c899ea7da40c8c9f31877af7db95f0bf6f45cfac85dfd1465e6542934a1017741805025a4c9237e1e22d430aba9aaa444c87cdc494dc6f1b6ac7129264b700f8254d updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A14B48D943EE0A0E40904F3CE0A4C09193515D3F cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4054DA6F1C3F4074ACED0FECCDDB79D153FB901D\Blob = 0f0000000100000014000000099773b4b119d2f275ba56bea630d0f4ffd1e5900300000001000000140000004054da6f1c3f4074aced0feccddb79d153fb901d090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e00000044005300540020004100430045005300200043004100200058003600000020000000010000000d04000030820409308202f1a00302010202100d5e990ad69db778ecd807563b8615d9300d06092a864886f70d0101050500305b310b30090603550406130255533120301e060355040a13174469676974616c205369676e61747572652054727573743111300f060355040b13084453542041434553311730150603550403130e4453542041434553204341205836301e170d3033313132303231313935385a170d3137313132303231313935385a305b310b30090603550406130255533120301e060355040a13174469676974616c205369676e61747572652054727573743111300f060355040b13084453542041434553311730150603550403130e445354204143455320434120583630820122300d06092a864886f70d01010105000382010f003082010a0282010100b93df52cc994dc758a955d63e884777666b959915c46dd923e9ff90e03b43d6192bd2326b563ee92d29ed63cc80d905f6481b1a8080d4cd8f9d3052852b40125c5951c0c7e3e108475cfc1199163cfe8a89188b94352bb80b155898b31fad0b776be413d309aa422251773e81ee2d3ac2abd5b3821d52a4bd7557de33a55bdd76d6b02576be6477c08c882badea7873da16db83056c2b302815f2df5e29a301828b866d3cb01966fea8a4555d6e09dff672b1702a64e1a6a110b7eb77be798d68c766fc13bdb50937ee5d08e1f37b8bdbac69f6ce97c33f2323c2647fa272402c97e1d5b8842136a357c7d35e92e66917293d53226c474f553a3b35d9af609cb0203010001a381c83081c5300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201c6301f0603551d11041830168114706b692d6f70734074727573746473742e636f6d30620603551d20045b30593057060a608648016503020101013049304706082b06010505070201163b687474703a2f2f7777772e74727573746473742e636f6d2f6365727469666963617465732f706f6c6963792f414345532d696e6465782e68746d6c301d0603551d0e041604140972064e18430fe5d6ccc36a8b317b788fa883b8300d06092a864886f70d01010505000382010100a3d88ed6b2dbce05e732cd01d30403e576e4562b9c9990e808306cdf7d3deee5bfb524408449e1d128aec4c23a533088f1f5776e51cafaff99af245f1ba0fdf2ac84cadfa9f05f042ead16bf219710813de3ff878d32dc94e5478a5e6a13c994953dd2eec83495d080d4ad320880543ce0bd5253d7527cb2693f7f7acf6a74cafa042a9c4c5a06a5e920ad45660f69f1ddbfe9e3328bfae0c1864d723c2ed893780a2af8d8d2273d19895f5a7b8a3bcc0cda51aec70bf72bb03705ecbc5723e238d29b68f35612884f427cb831c4b5dbe4c82134e9481135eefac79257c59f34e4c7f6f70e0b4c9c68787b7131c7eb1ee06741f3b7a0a7cde57a33366afa9a2b cefutil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D8A6332CE0036FB185F6634F7D6A066526322827 cefutil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\20D80640DF9B25F512253A11EAF7598AEB14B547 cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F17F6FB631DC99E3A3C87FFE1CF1811088D96033\Blob = 14000000010000001400000029c590ab25af11e461bfa3ff886191e60efe9c815300000001000000230000003021301f060960861803000301010530123010060a2b0601040182373c0101030200c00b00000001000000640000005400dc0052004b0054005200550053005400200045006c0065006b00740072006f006e0069006b00200053006500720074006900660069006b0061002000480069007a006d00650074002000530061001f016c0061007900310163003101730031010000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000f17f6fb631dc99e3a3c87ffe1cf1811088d960330f0000000100000014000000399890e6c8e9ddbce5a03cacdf9907ec990191d82000000001000000410400003082043d30820325a003020102020101300d06092a864886f70d01010505003081bf313f303d06035504030c3654c39c524b545255535420456c656b74726f6e696b20536572746966696b612048697a6d6574205361c49f6c6179c4b163c4b173c4b1310b3009060355040613025452310f300d06035504070c06416e6b617261315e305c060355040a0c5554c39c524b54525553542042696c676920c4b06c657469c59f696d2076652042696c69c59f696d2047c3bc76656e6c69c49f692048697a6d65746c65726920412ec59e2e20286329204172616cc4b16b2032303037301e170d3037313232353138333731395a170d3137313232323138333731395a3081bf313f303d06035504030c3654c39c524b545255535420456c656b74726f6e696b20536572746966696b612048697a6d6574205361c49f6c6179c4b163c4b173c4b1310b3009060355040613025452310f300d06035504070c06416e6b617261315e305c060355040a0c5554c39c524b54525553542042696c676920c4b06c657469c59f696d2076652042696c69c59f696d2047c3bc76656e6c69c49f692048697a6d65746c65726920412ec59e2e20286329204172616cc4b16b203230303730820122300d06092a864886f70d01010105000382010f003082010a0282010100abb73e0a8cc8a55815e68aef273d4ab4e825d3cd33c220dc19ee883f4d62f0dd13778f61a92ab5d4f2b93158293b2f3f6a9c6f737625ee342080eeeab7f0c40acd2b8694c9e360b14452b25a29b4919783d8b7a6142f2949a2f30506fbb44fdaa16c9a669ff04309caea728feb00d73539d75617471730f4bebf3fc268af3640c1a9f4a9a7e8106b088af7861edc9a2a1506f6a3f0f4e0c714d4517fcfb4db6daf4796179b7771d8a7719d240cf6943f8531124fbaee4e82b8b93e8f23375ecca2aa75f7186f09d3aea7542834fbe1e03b607da0be798986c89f2df90a4bc450a2e7fd7916c77a0b18cfce4cef7dd6076f98f1afb1c17ad78135b8aa17b4e0cb0203010001a3423040301d0603551d0e0416041429c590ab25af11e461bfa3ff886191e60efe9c81300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100100ddaf83aec28d1149582b1122c517a4125364c9fec3f1f849d65545ca8160240fa6e1a3784ef729d860a559d5628ac662cd03a5693340725ad08b08fc80f0959ca9d981ce554f8b9457f6a976f88684d4a06263788020eb6c6d67299ce6b77da6231a4561fae5f8d77da5df688fc1ad99eb581f032b8e388d09cf36aa0b99b145935364fcff38e5e5d17ad1595d8ddb2d5156e004eb34bcf6694e4e0cdb505da63578be5b3aadbc02e1c9044db1a5d18a4eebe045b99d5715f55656462d5a29b045986c86277e77c82456a3d17bfec9d750caea36f5ad32f9836f4f0f519ab115dc8a6e32a586a4209c3bd922666320d5d085574ff8c98d00aa6846ad1397d cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\132D0D45534B6997CDB2D5C339E25576609B5CC6\Blob = 0b000000010000001200000056006500720069005300690067006e00000009000000010000002a000000302806082b0601050507030306082b0601050507030106082b0601050507030206082b06010505070304030000000100000014000000132d0d45534b6997cdb2d5c339e25576609b5cc620000000010000001e0400003082041a308203020211009b7e0649a33e62b9d5ee90487129ef57300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203139393920566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204733301e170d3939313030313030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203139393920566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473330820122300d06092a864886f70d01010105000382010f003082010a0282010100cbba9c52fc781f1a1e6f1b3773bdf8c96b9412304ff03647f5d0910af517c8a561c116404dfb8a6190e57620c111067dab2c6ea6f511418efa2dad2a6159a467264cd0e8bc525b70200458d17ac9a469bc831764ad058bbcd058ce8d8cf5ebf042490b9d972767326ee1ae93151c70bc204d2f18de9288e86c8557111ae97ee3261154a245965583ca3089e8dcd8a3ed2a803f7f7965573e152066082f9593bfaa472fa84697f012e2fec20a2b51e676e6b746b7e20da6cca8c34c595589e6e8535c1cea9df062160ba7c95f0cf0dec276ceaff76af2fa41a6a23314c9e57a63d39e6237d585659e0ee65324741b5e1d12535bc72ce783493b15ae8a68b957970203010001300d06092a864886f70d01010505000382010100111496c1ab9208f73f2fc9b2fee45a9f64dedb214f869934763657ddd0152fc5ad7f151f3762733ed4e75fce1703db35fa2bdbae60095f1e5f8f6ebb0b3dea5a131e0c606fb5c0b523222e070bcba974cb47bb1dc1d7a56bcc2fd242fd49dda789cf53bada005a28bf82dff8ba131d508682fd8e308f2946b01e3d35da386216184aade6b6516cdeaf62eb01d01e24fe7a8f121a1268b8fb66991414455caee7ae6917812b5a37c95e2af4c6e2a15c549ba65400cff0f1c1c798301a3b3616dba36eeafdadb2c2daef0247138ac0f1b331ad4f1ce14f9caf0f0c9df7780dd8f4355680dab76d178f9d1e8164e1fec545baad6bb90a7a4e4f4b84ee4bf17ddd11 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8781C25A96BDC2FB4C65064FF9390B26048A0E01 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8351509B7DF8CFE87BAE62AEB9B03A52F4E62C79 cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\26A16C235A2472229B23628025BC8097C88524A1\Blob = 0f0000000100000030000000139537d16c2be16bdb77b9d3c8838c473741f095a93f2a4dcd829051704fcb8af256ea95928de2d214da8db68278948f03000000010000001400000026a16c235a2472229b23628025bc8097c88524a1090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b000000010000007a000000530079006d0061006e00740065006300200043006c006100730073002000330020005000750062006c006900630020005000720069006d006100720079002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790020002d00200047003600000053000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c02000000001000000fa050000308205f6308203dea003020102021065637185d36f45c68f7f31f909879282300d06092a864886f70d01010c0500308194310b3009060355040613025553311d301b060355040a131453796d616e74656320436f72706f726174696f6e311f301d060355040b131653796d616e746563205472757374204e6574776f726b314530430603550403133c53796d616e74656320436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204736301e170d3132313031383030303030305a170d3337313230313233353935395a308194310b3009060355040613025553311d301b060355040a131453796d616e74656320436f72706f726174696f6e311f301d060355040b131653796d616e746563205472757374204e6574776f726b314530430603550403133c53796d616e74656320436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473630820222300d06092a864886f70d01010105000382020f003082020a0282020100b70eb2fa4dbc9a7215fb775bdbfd430fcb0bf7602eb32b7e0cbb53f2cc4e65f319bbff351df7d3a9bb402db5dd78d4a6f937ea85057b6db7e6134b067cfb76638f201d2d382b0485f2e8b0d15f4d4a21c96ad894ea1e0250a6aa9007a04721ea66f904a0e683f0c4f55e96e2274d61c3b3c18c22b666a100d15629fbedc17f24ca3dfa5a94b084c3c7ba431cfd640ef128fb4759f226e131b944f9abddfbbebe2c37e3ac0b18d3fc01a2f1a40a3582474cabbd8a5edf1385fc20cc4859afaf416fcb23cdca93a7ddd55fc8643bff0103a00a4f2d6e3d84beafc832b253299015f7b0059a0a3cf6b90690c9a5e15da03bb0fea8b6bff5892857243a218671e4dc8a8b4155ec1e302459d1c059b878afaa5a74de25803098ed30446f21701cdb12530ed6a62866932c1fcc4f3c1b81c5b9f6786fd0323a0872db6b0e46178594f3bcefbcf7a45e8ee9e9b564e5b74b45122c4c37b760430a4d710600942635741fbb7a395c4e3be6b803e2c7938b842c254945dd7f2394601fcbe9cdf6ab97f761e7fb7f6281c8dc0a305c187ce6ceefc76e1e877cb3e9cac87b6af468fc83a50c56b4bab28d4a0ac79797c58830153d100854157272673333f47cb7ce00275365ce24f15a64e7362ff22e02c297df72e8021ea0f73db5fb686003fa33a9e6126d06e1a9a85d4e3cfed9e70065acb6194d7b837f3447eae1186db18b1c79abe79d0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414397108003edec886e790ffe4fd210fce241916f6300d06092a864886f70d01010c05000382020100506b884d6048ce5ae322ce677c84a7cd1cfde90c038c36af0a870e6aae57ae01d036bbf2fdb973c15fb5a8ae4ca2fa49cb07461636bde3c857387e38e4bf253360c6dc379c63bb5e981e1ab282f0aea67711804447a129c5f0b33ace98f0b8ecd30e80067723304cff796463225b7793434b75b3db3b6e3b4addf1c8aeb5378a95883a10687038b95b707ed543c9fc5f4fe5e67b36eef020ed47571326105e14060d7b7607c2c62d16f4aea76c0fbc880f4f2c02b6a3d722e6994735d88da54f81123a117db3cc0b75f31e70a31b03eafa9ae8e62e3639cc99ce3a3f0cb7aef84399b0936e6faad90f6a3191bb9cd3b428fb834c7a73825067d20eaced60c5b25d3598cf877e1e591d24bc56badaa45ad8cce6bc1e108f1b8c8ef3c1dbb7bed4b05b658f1668f356c52a19164d0fb865876d2483b862dce047611a887bce4e7ffddcc60d5a9aa4f3b54cf6dd31a6e81d1121333004617d1ce03e4f8d3fb58b12005a7da9a100d483eb70bb18f8a4d21c812db70811c8267bb6d4e50f034672d425401ebe495d6d93f15cb23b7554693aa0ee4c22baac9ae208ad4563054a523576c434f55e0732addc7c26d15b8fade4e6aa1b759feb5db4e8c0a9157c4e4a0772df46c9d491927556b0e1ee37366528c515c82b76cc6d6f1983f4fdda15e241e73379468357f9f1a5b66dd3bcd753e7ee716d78a997a7ee209c191572153d04 cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\20CB594FB4EDD895763FD5254E959A6674C6EEB2\Blob = 0f000000010000001400000046ee423f88daae3cbddca68bda863da3f25aca800b00000001000000340000004d004f004700410048004100200047006f007600740020006f00660020004b006f007200650061002000470050004b0049000000090000000100000056000000305406082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a0304060a2b0601040182370a030c06082b0601050507030903000000010000001400000020cb594fb4edd895763fd5254e959a6674c6eeb220000000010000008e0300003082038a30820272a003020102021045f8e0e401c53e71e6bd716d979c4123300d06092a864886f70d0101050500304f310b3009060355040613024b52311c301a060355040a1313476f7665726e6d656e74206f66204b6f726561310d300b060355040b130447504b49311330110603550403130a47504b49526f6f744341301e170d3037303331353036303030345a170d3137303331353036303030345a304f310b3009060355040613024b52311c301a060355040a1313476f7665726e6d656e74206f66204b6f726561310d300b060355040b130447504b49311330110603550403130a47504b49526f6f74434130820121300d06092a864886f70d01010105000382010e0030820109028201005a2b41159bdb762601f054720b87131fa0d03f96aa0db33481de485a9ff3705ac2f13a9e04f04e947997e1f4b5144cd76fc48b18b7dc122b1d0a9bee200c5b8ffff9af829e9846d03d5d28f39716c15ce556bf44a400a17acb9b7a5bdcd4edfbf2a00267001e44e58a01dca5a34efed60c67ca49b9f0d0a0f94d1f03d386ef0d85754df3edfbcd6a660457f4579bac668a4fc2a84f718909dd4c00df96bbd5900ab4b66a6dc6bfd39929ff62f010da45ac09720b8210e815a88b5fe2a25a791ec267fde944570b03d0211551b000f38f6de223f04921d96dcf623decebfd2892013f7aa3727cebf3aee7f80aec6ead7a9b55c9304b9cb661466b581afe9f481d0203010001a3633061301f0603551d23041830168014166732f4685e683147dbedecce612e9a2446c47d301d0603551d0e04160414166732f4685e683147dbedecce612e9a2446c47d300e0603551d0f0101ff0404030201ae300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100356352c660181cb7c2c15a5802ec07d5a19093fc8047d05278ab85f876d3b8b01832a0b6906813663d6faf8edcf6a3c4ce395fafed0a66e07c11c80ccb9e1f38298a8bdec8632ec7b4d2ce369194e04f8492b6aa22a8fd31a73348c95bf613d81616eb1f3fa54e06933ad906653096fa8d06dba11af42bfa0f68f0c12b7c9d05d709423bd22f9190fc0e6b385bb275a9579c5764f59820a4ffd43004e4ce1f90c92fc1df5a56b8cbaaaab4bfebb8f7224a4dc135f465bd78bc6f781b563a81e80df5c2a51730d38d5777cba5c14cb130dd34b8ab920a2202368bf66cf761b908ee30ad1aa844f12e32ec83a248483a675fe96f1b1733082ac1c9c3679a0e8567 cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\58E8ABB0361533FB80F79B1B6D29D3FF8D5F00F0\Blob = 19000000010000001000000086408455f344ddc712d436abc535cd300f000000010000002000000009793e87b5d73efddfafa2600a3e107a138f2d821b18868e61535cd1435fbbc10b000000010000003e00000044002d0054005200550053005400200052006f006f007400200043006c006100730073002000330020004300410020003200200032003000300039000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030803000000010000001400000058e8abb0361533fb80f79b1b6d29d3ff8d5f00f0140000000100000014000000fdda14c49f30de21bd1e4239fcab632349e0f184200000000100000037040000308204333082031ba00302010202030983f3300d06092a864886f70d01010b0500304d310b300906035504061302444531153013060355040a0c0c442d547275737420476d62483127302506035504030c1e442d545255535420526f6f7420436c617373203320434120322032303039301e170d3039313130353038333535385a170d3239313130353038333535385a304d310b300906035504061302444531153013060355040a0c0c442d547275737420476d62483127302506035504030c1e442d545255535420526f6f7420436c61737320332043412032203230303930820122300d06092a864886f70d01010105000382010f003082010a0282010100d3b24acf7a47ef759b23fa3a2fd6504589353ac66bdbfedb0068a8e003111d3750089f4d4a689435b353d19463a72056afde5178ec2a3df34848503e0adf46558b276dc3104d0d915243d887e05d4e36b521ca5f3940045f5b7ecca3c62ba9401ed93684d648f3921e34462024c1a4518e4a1aef503f695d197f45c3c7018f51c923e872aeb4bc56097f12cb1cb1af29900ac955cc0fd3b41aed47355a4aed9c730421d0aabd0c13b500ca266cc46b0c945a9594da509af1ffa52b6631a4c938a0df1d1fb8092ef3a7e86752ab951fe0463ed8a4c3ca5ac53180e8489a9f9469fe19ddd8737c81ca96de8eedb33205658434e6e6fd5710b55f76bf2fb0100dc50203010001a382011a30820116300f0603551d130101ff040530030101ff301d0603551d0e04160414fdda14c49f30de21bd1e4239fcab632349e0f184300e0603551d0f0101ff0404030201063081d30603551d1f0481cb3081c8308180a07ea07c867a6c6461703a2f2f6469726563746f72792e642d74727573742e6e65742f434e3d442d5452555354253230526f6f74253230436c61737325323033253230434125323032253230323030392c4f3d442d5472757374253230476d62482c433d44453f63657274696669636174657265766f636174696f6e6c6973743043a041a03f863d687474703a2f2f7777772e642d74727573742e6e65742f63726c2f642d74727573745f726f6f745f636c6173735f335f63615f325f323030392e63726c300d06092a864886f70d01010b050003820101007f97db30c8dfa49c7d217a8070ce141269881495604401acb2e9304f9b50c266d87e8d30b57031e9e269c7f370db201586d00df0beac017584ce7e9f4dbfb7603b9cf3ca1de25e68d8a39d97e54060d23621fed0b4b817da74a37fd4dfb09802ac6f6b6b2c252472a165ee255ae5e632e7f2dfab49faf3906923db04d9e75c58fc65d497beccfc2e0acc252a3504f8609115753d41ff231f19c86ceb825304a6e44c224d8d8cbace5b73ec6454506dd19c55fb69c336c38cbc3c85a66b0a260de0939860ae7ec624978a615f918e6692098736cd8b9b2d3ef651d450d45928bd83f2cc287b53866dd8268870d7ea91cd3eb9cac0906e5ac65e7465d75cfea3e2 cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\51A44C28F313E3F9CB5E7C0A1E0E0DD2843758AE\Blob = 19000000010000001000000020e83a702922f3b58f000e88e923071b0f00000001000000140000004c8f996258d674d321d7575ef9f8538875935db503000000010000001400000051a44c28f313e3f9cb5e7c0a1e0e0dd2843758ae090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b0601050508020206082b060105050703090b000000010000002200000041002d00540072007500730074002d006e005100750061006c002d003000310000001400000001000000080000004e59cec7023287302000000001000000610300003082035d30820245a003020102020300e242300d06092a864886f70d01010505003055310b30090603550406130241543110300e060355040a1307412d547275737431193017060355040b1310412d54727573742d6e5175616c2d30313119301706035504031310412d54727573742d6e5175616c2d3031301e170d3034313133303233303030305a170d3134313133303233303030305a3055310b30090603550406130241543110300e060355040a1307412d547275737431193017060355040b1310412d54727573742d6e5175616c2d30313119301706035504031310412d54727573742d6e5175616c2d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100fff51c80119e9e1e6858ccd277dbc7f48e67525058ba12a46a3b16f78c734f4c8a4af36091eb3e659929d940d52e08f0fe86d6cd65f7ddd83295074e8d3b2675db370e302823e06b64668a84d333e93d3ddba68139e6791965efea5845ffeb8c33fcbff811d92f28348a1bf52c3fbe4cb660956399b6120ef7455151cf871c0483291de97897312a4a4743b59398e5f9e4ac4df7de1c7aee7c6adb5bd8f04c9ff0ee1f3d0e51b4df1ea2140270f435cfaca953547b37d8cf4699c8fb2ccc3a2c1ddfe41c2a11e2d66882ce8d2990e681d42c267ec4f2365f2a53434950bf536ba71e6bb5938704e25a8976c83f3c71dd9ccb7f3cc696cd91fac23e664d18ba150203010001a3363034300f0603551d130101ff040530030101ff30110603551d0e040a04084e59cec702328730300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100ebd23d475854f466e5f6f57b5bb007429509025140befd88b7f798f29da8b9050f55a4998a468ab4062b083fdaaf37d7078dd07adf9d33a0a91ec9fc8a4611bd029e3e35efdc4bdff82d5bc702408a6727655e96f9b34e4e9768f255e58f19267cdf99e52f97cef2b6b6d52d3f812d60e55ac47c3698f30d6ef0de63e7e82648819f72988c669b31a47c9a866aa1fe687e3e224bf5b26a64d9b62eaffdf2b19f5bc823efee5a47315790d3e7eafd1cba27d0d605d15837d7b5a1fa0583579f55668f9d7302436fe91e62a305628aa9efb4869191aee354bc346624418dd7f6b3474640db2dfa4a6039b2e8d6a7a4e1351075b5fec352140b38dea659289110c6 cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7998A308E14D6585E6C21E153A719FBA5AD34AD9\Blob = 0f000000010000001400000008e44456065f530a759aa43f407f120ee966af090b00000001000000640000005400550052004b0054005200550053005400200045006c0065006b00740072006f006e0069006b00200053006500720074006900660069006b0061002000480069007a006d006500740020005300610067006c006100790069006300690073006900000009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703090300000001000000140000007998a308e14d6585e6c21e153a719fba5ad34ad92000000001000000ff030000308203fb308202e3a003020102020101300d06092a864886f70d01010505003081b7313f303d06035504030c3654c39c524b545255535420456c656b74726f6e696b20536572746966696b612048697a6d6574205361c49f6c6179c4b163c4b173c4b1310b300906035504060c025452310f300d06035504070c06414e4b41524131563054060355040a0c4d28632920323030352054c39c524b54525553542042696c676920c4b06c657469c59f696d2076652042696c69c59f696d2047c3bc76656e6c69c49f692048697a6d65746c65726920412ec59e2e301e170d3035303531333130323731375a170d3135303332323130323731375a3081b7313f303d06035504030c3654c39c524b545255535420456c656b74726f6e696b20536572746966696b612048697a6d6574205361c49f6c6179c4b163c4b173c4b1310b300906035504060c025452310f300d06035504070c06414e4b41524131563054060355040a0c4d28632920323030352054c39c524b54525553542042696c676920c4b06c657469c59f696d2076652042696c69c59f696d2047c3bc76656e6c69c49f692048697a6d65746c65726920412ec59e2e30820122300d06092a864886f70d01010105000382010f003082010a0282010100ca5205d66303d81c5fddd27b5df20c60615b6b3b742b780d7d45bd2274e88c03c1c6112a3d95bca994b0bb9197c8697c84c5b4916c6c136aa455ada485e8957eb300af00c20518f5709d368baecbe41b817f9388fb6a55bb7d8592ceba589fdb32c5bd5def224a2f41077e4961b386ec4ea6416e84bc03ecf53b1cc81fc2eea8eeea124a8d14cff30ae05039f90835f81159ade722ea4bca1406de42bab299f32d54881006eae11a3e3d671ffbcefb7c82e8115d4ac1b914ea54d9669b7c897d049a62c9e9523c9e9cefd2f526e4e6e5187c8b6edf6ccc785b4f72b2cb5c3f8c058dd14c8cad92c7e1787f656c4906502c9e32c2d74ac6758a594e756f475ec10203010001a310300e300c0603551d13040530030101ff300d06092a864886f70d0101050500038201010015f555ff3796805921a4fca1154c20f6d45fda0324fccf901af4210a9aee3ab16aefeff860d14c3666451df3660274047b9230a8de0a760fef956ebdc937e61a0dac89485bcc8336c2f5465c598256b4d5fe23b4d8541c44abc4a7e514ce3c41617c43e6cdc481098b24fb5425d616a8960c67076fb35047e31c2428dd2a98a461fedbea1237bc011a3485bd6e4fe791720744851e58ca5444ddf7acb9cb892172db8fc06929972aa3ae1823971c412a8b7c2ac17c90e8a928c0d391c6ad28874068b5ffeca7d2d338189cd37d695df0c6a51e241ba347fc690768e7e49ab4ed0fa1878702ce87d2484ee1bcffcbf1729244640325eade5b6e9fc9f24eacddc7 cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\74207441729CDD92EC7931D823108DC28192E2BB\Blob = 0f000000010000001400000083446093bf635ddba22d70e25cfd1eb12beb43b003000000010000001400000074207441729cdd92ec7931d823108dc28192e2bb090000000100000020000000301e06082b0601050507030406082b0601050507030106082b060105050703020b0000000100000038000000430065007200740050006c0075007300200043006c006100730073002000320020005000720069006d00610072007900200043004100000053000000010000002700000030253023060d2b0601040181ad5a020502030130123010060a2b0601040182373c0101030200c0200000000100000096030000308203923082027aa00302010202110085bd4bf3d8dae369f694d75fc3a54423300d06092a864886f70d0101050500303d310b30090603550406130246523111300f060355040a130843657274706c7573311b301906035504031312436c6173732032205072696d617279204341301e170d3939303730373137303530305a170d3139303730363233353935395a303d310b30090603550406130246523111300f060355040a130843657274706c7573311b301906035504031312436c6173732032205072696d61727920434130820122300d06092a864886f70d01010105000382010f003082010a0282010100dc5096d012f835d208787ab65270fd6feecfb911cb5d77e1ece97e048dd6cc6f73435760ac330a44ec035f1c802491e5a891561282f7e02bf4dbae612e89108d6b6cbab302bdd536c5483723e2f05a3752331712e2d1604dbe2f4111e3f617250c8b91c01b997b99560dafeed2bc4757e379497b3489272484deb1ece9584efe4edf5abe41adac08c5180eefd253ee6cd09d1201138ddc8062f795a944884a714e60559edb23197956070c3f630b5cb0e2be7e15fc943358413874c4e18f8bdf26ac1fb58b3bb743596bb024a66d908bc472ea5d3398b7cbde5e7bef94f11b3ecac921c1c59802aaa2f65b779bf57e9655341c6769c0f142e347acfc281c66550203010001a3818c308189300f0603551d13040830060101ff02010a300b0603551d0f040403020106301d0603551d0e04160414e3732ddfcb0e280cdeddb3a4ca79b88ebbe83089301106096086480186f842010104040302010630370603551d1f0430302e302ca02aa0288626687474703a2f2f7777772e63657274706c75732e636f6d2f43524c2f636c617373322e63726c300d06092a864886f70d01010505000382010100a754cf884419cbdfd47f00df563362b5f7510190ebc33fd18844e9245defe714bd20b79a3c00fe6d9fdb90dcd7f462d68b705de7e50448a9687cc9f142f36c7fc57a7c1d5188bad20a3e275dde2d514ed3136469e42ee3d3e79b0999a6e0959bce1ad77fbe3cce52b31115c10f17cd03bb9c2515baa27689fc06f118d0934b0e7c82b7a5f4f65ffeed40a69d847439b9dc1e8516da291b862300c9bb897e6e80881e2f14b40324a8326f039a472c30be56c6a74202701bea40d8ba05037007a496fffd48330ae1dca581909b4ddd7de7e7b2cd5cc86a95f8a5f68dc45d7808be7b06d649cf193650232e08e69e054d4718d516e9b1d6b610d5bb97bfa28eb454 cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3F85F2BB4A62B0B58BE1614ABB0D4631B4BEF8BA\Blob = 0f0000000100000014000000e93b3d11f8e383f44926dca2d18933ebdc8c38210300000001000000140000003f85f2bb4a62b0b58be1614abb0d4631b4bef8ba09000000010000000c000000300a06082b060105050703030b000000010000001200000056006500720069005300690067006e000000200000000100000006030000308203023082026b02107eb611ab32c841db5eac01e3959efffd300d06092a864886f70d01010505003081c1310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355040b1333436c6173732034205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574776f726b301e170d3938303531383030303030305a170d3138303531383233353935395a3081c1310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355040b1333436c6173732034205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574776f726b30819f300d06092a864886f70d010101050003818d0030818902818100baf0e4cff9c4ae8554b90757f98fc57f6811f8c417b044dce33073d52a622ab8d0cc1ced285b7ebd6adcb39124ca41623cfc0201bf1c1631940597766ea2adbd61176c4e3086f051372a50c7a86281dc5b4aaac1a0b46eeb2fe557c5b12b4070db5a4da18e1fbd031fd803d48f4c9971bce282cc58e8983a86d38638f300291f0203010001300d06092a864886f70d0101050500038181008a68628772e784900902db00b128ff18c5b563649a2bc1d2f75fe81f0cafc9ebf51da1047e3fe3a68ec71dfd2810757c3fcaf91726276f2bc1dbc9c36b7ca6c6dce55a8dfbef40c887ef1950365787f1f23fe5eaa3969997ad99af3bbf84b7d59e6c8b0aa3efe762fba677e82f4e86dd31a2f3ca5698ec879ed982af845241e8 cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 1400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde53000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030703000000010000001400000047beabc922eae80e78783462a79f45c254fde68b0f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f3352000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5 cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E621F3354379059A4B68309D8A2F74221587EC79\Blob = 1900000001000000100000002a989d4c9ae7473307ce6afbbc7e4ef20f00000001000000140000003c574c8c3c5896f06fe67795885afb18fec4ff8d030000000100000014000000e621f3354379059a4b68309d8a2f74221587ec79090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b000000010000002c000000470065006f0054007200750073007400200055006e006900760065007200730061006c002000430041000000140000000100000014000000dabb2eaab00cb8882651745c6d03d3c0d88f7ad620000000010000006c0500003082056830820350a003020102020101300d06092a864886f70d01010505003045310b300906035504061302555331163014060355040a130d47656f547275737420496e632e311e301c0603550403131547656f547275737420556e6976657273616c204341301e170d3034303330343035303030305a170d3239303330343035303030305a3045310b300906035504061302555331163014060355040a130d47656f547275737420496e632e311e301c0603550403131547656f547275737420556e6976657273616c20434130820222300d06092a864886f70d01010105000382020f003082020a0282020100a61555a0a3c6e01f8c9d2150d7c1be2b5bb5a49ea1d97258bd001b4cbf61c9141d4582abc61d80d63deb109c3aaf6d24f8bc71019e06f57c5f1ec10e55ca839a5930ae19cb304895ed22378df44a9a72663ead95c0e01600e0101f2b310ed79454d34233a0341d1e4576dd4fca1837ec85157a1908fcd5c79cf0f2a92e10a992e63d583da916683c2f7521187f2877a5e16117b7a6e9f81e99db736ef40aa2216ceedaaa859266aff67a6b82daba2208350fcf42f135fa6aee7e2b25cc3a11e46daf73b2761dadd0b278671aa4391c510b675683fd385d0dceddf0bb2b961fde7b3252fd1dbbb506a1b2215ea5d695687ff0999edc45083ee7d2090d3594dd804e5397d7b509442064161703024c530d68ded5aa724d936d820edb9cbdcfb4f35c5d547a690996d6db11c18d75a8b4cf39c8ce3cbc247ce662cae1bd7da7bd57650be4fe25edb66910dc281a46bd011dd097b5e1983bc03764d63d94ee0be1f528ae0b56bf718b2329418e86c54b527bd871ab1f8a15a63b835ad7580151c64c41d97fd8416772a228df6083a99ec87bfc53737259f5937a17760ecef7e55cd90b5534a2aa5bb56a54e713ca57ec976df45e062f458b58d4231692e4166e28635930df50019c63891a9fdb1794827037c3249e9a47d65aca4ea86989721f916cdb7e9e1badc71f73dd2c4f1965fd7f9340102ed2f0ed3c9e2e283e692633c57b0203010001a3633061300f0603551d130101ff040530030101ff301d0603551d0e04160414dabb2eaab00cb8882651745c6d03d3c0d88f7ad6301f0603551d23041830168014dabb2eaab00cb8882651745c6d03d3c0d88f7ad6300e0603551d0f0101ff040403020186300d06092a864886f70d010105050003820201003178e6c7b5dfb89440c971c4a835ec461dc285f3285886b00bfc8eb2398f4455ab64845c69a9d09a383cfae51f35e544e380799468a4bbc49f3de134cd30468b542b95a5eff73f9984fd35e6cf31c6dc6abfa7d72308e1985ec35a0876a9a6af772fb760bd44466aef97ff7395c18ee893fbfd31b7ec571111459b30f11a8839c14f3ca700d5c7fcab6d802270a50ce05d042902fbcba091d17cd6c37e50d59d58be4138ebb9753c15d99bc94a8359c0da53fd33bb36189b850f15ddee2dac7693b9d9018d4810a8fbf53886f1db0ac6bd84a32341ded6776f85d4851c50e0ae518aba8d3e76e2b9ca27f25f9fef6e590d06d82b17a4d27c6bbb5f141a488f1a4ce7b3471c8e4c452b20ee48dfe7dd098e18a8da408d9226115361735debbde7c44d293761ebac392d672e16d6f5008385a1cc7f76c47de4b74b66ef03456069b60c529692845ea6a3b5a43e2bd9ccd81b47aaf244da4ff903e8f014cb3ff383ded0c154e3b7e80a374d8b2059033019a12cc8bd111fdfaec94ac5f327666686ac6891ffd9e6531c0f8b5c69650a26c81e34c35d517bd7a99c06a136ddd58994bcd9e42d0c5e096c08977ca33d7c93ff3fa114a7cfb55debdbdb1cc476df88b9bd4505951baefc466a4caf48e3ceae0fd27eebe66c9c4f816a7a64acbb3ed5e7cb762ec5a748c15c900fcbc83ffae632e18d1b6fa4e68ed8f929488ace73fe2c cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CC7EA292AF8715D74CA4B415F320154B24F565FD\Blob = 19000000010000001000000095212cfd76cf16127e0aa23ae27f056f0f00000001000000140000007d34adee58f808de24b08b60b995c1760f84374b030000000100000014000000cc7ea292af8715d74ca4b415f320154b24f565fd09000000010000002a000000302806082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b000000010000003a00000053006f0075007400680020004100660072006900630061006e00200050006f007300740020004f0066006600690063006500200043004100000014000000010000001400000082f09b86afdcc26f47c0756bbc563b503f942b8920000000010000003d0600003082063930820421a003020102020103300d06092a864886f70d01010505003081ce310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311630140603550407130d536f6d65727365742057657374312a3028060355040a1321536f757468204166726963616e20506f7374204f6666696365204c696d69746564311a3018060355040b13115341504f2054727573742043656e747265311d301b060355040313145341504f20436c617373203420526f6f742043413129302706092a864886f70d010901161a706b6961646d696e40747275737463656e7472652e636f2e7a61301e170d3130303931353030303030305a170d3330303931343030303030305a3081ce310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311630140603550407130d536f6d65727365742057657374312a3028060355040a1321536f757468204166726963616e20506f7374204f6666696365204c696d69746564311a3018060355040b13115341504f2054727573742043656e747265311d301b060355040313145341504f20436c617373203420526f6f742043413129302706092a864886f70d010901161a706b6961646d696e40747275737463656e7472652e636f2e7a6130820222300d06092a864886f70d01010105000382020f003082020a0282020100dbdced489aa0a39fe0118ed9c892753a55c15122ca0b7aa4350dc5e6572d83f02a6f223837316d7c8524a2062f43823d453040251cee584741e6f09e001ef8f42f11bb92b298452dd31f80c9761413c3cc40e6adeb3960fccfc8df2afd8c1251efcf0c64c657e823515de76652ea66bd937f9d7a28f119706e849f3047b7b0396b132ceb4b4d2eaf3fbffd02134a39e73e33c5109151be0f479d4d52fc2cf3e313a20082e1140ccdd29eb3f2e081dabe999253e37d997743e1e14829819ed605573a71dc3e98ad58706f46bb7e3203e2839b5957f7f8b3cd5416ecb6ada11c1a92d1d4299e8fcdb3e87d50f1c282acbabdb47556a0f5455d187d2c8cf17b41cc86b19a844b0a2a5d9b96e1cdfaab162741e79535a6cb8aa796f3a5cc51f92d7d1e43fbdc6db5b938bd05fb58fa2ed3ec5e642daf58014a7c2246d341cb3de4965e494338bb89ebf49c693912035c84bbe58c1eeae066bbc0bf8cfe9e0a4d3d683f4076d632a9ea45b86a07528ecd51f15d28630cd35938fcc9fd82c94520bce6e8cca20ccb7b6439494645f5731c6a9720eb2142f7b42052b74afd75bccb0f0c6711571ff730f1ab90cc5d3c960562d3ca55014b46c580871c72d0735421ead7a39cd3ae7fd453d928fc57dee53f524abbc8262447531c73bacfc6b430cd5e71c756bc493825e6c5100978d9d41d5ccd6eeddb915ca1531456aa8d27a9a68e1b0203010001a320301e300e0603551d0f0101ff040403020106300c0603551d13040530030101ff300d06092a864886f70d01010505000382020100d10b85d45ea696f0908912d9015308ecf2ed4338893ec12964ee53ff4ffe8b0a0e92f4fd7d2880ce0109fc31d16b5b0389b22e6003e5ef639691295fe03f98f868985563ca4f6b5372bab3621a199ec1131d9982faabaa3380b9f71afc794c02d0e1838b2c782c2f5c3061324fbbd13e955f607655d10e6f794e0ffab875b11ffe0d8b5b8b2842ca4d4563520249cc9d0f5fbb393f619bb15c74439a56c3997f9fc44dc0d38fd7cb5497f5fb487e2782feba63ede86fe384eb693e08f2ca24aa348e6240870dc751d40175dc667affe9ba326f4f8f72356c09ed5b78b0a948fa7c9141b2ac8e313725950c45a5554a19518c55930915c9f440019cb5757caa01feb2694d189a02eb7400fb7b68f4f0c37fa69df4ece842baeb837997fca376195b717f2667e94f2a7bb3cb7ef3fcf5a7bffb3f977575d0cbeb78e3036b8e82d01161fb373da7980b1efe3b5ed9cf00a517e9ecfd0cb5ddb8c6bcbdf3d230ee850e85f952334886e7c6afbfbf0cd04b7040f55ec8553f501c4f07d96776147d660dc2b5caa282340386f8d25ab6129626797a176d98a9ccf9e0cb1a45fff3c00cc562fe13c62dbf6a17ea630d7e3e247e62394e27391b414bc3b1607151fa0982ac0f8dd7d7efde1dab2b51bdf800f3d481c70d981c3dec2fa306c8f55500a73ffd97abb0b54a99590888906c1cb0ffe8ed7c993f2d6aed6d7d6612eed8e031ec cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\34D499426F9FC2BB27B075BAB682AAE5EFFCBA74\Blob = 19000000010000001000000017415041e20a8959c660552b1ad786640f00000001000000140000009a92de6fbf1a70be211189361d24ca183ddc15a103000000010000001400000034d499426f9fc2bb27b075bab682aae5effcba74090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b000000010000003c00000053006500630072006500740061007200690061002000640065002000450063006f006e006f006d006900610020004d0065007800690063006f000000140000000100000014000000d9b5cbe7525009b32839dc0062729792798640bf200000000100000098050000308205943082047ca003020102020101300d06092a864886f70d010105050030820131311730150603550407130e416c7661726f204f627265676f6e3119301706035504081310446973747269746f204665646572616c310b3009060355040613024d58310e300c060355041113053031303330311d301b06035504091314496e73757267656e74657320537572203139343031423040060355040313394175746f726964616420436572746966696361646f7261205261697a206465206c6120536563726574617269612064652045636f6e6f6d696131343032060355040b132b446972656363696f6e2047656e6572616c206465204e6f726d6174697669646164204d657263616e74696c311f301d060355040a1316536563726574617269612064652045636f6e6f6d69613124302206092a864886f70d010901161561637273654065636f6e6f6d69612e676f622e6d78301e170d3035303530383030303030305a170d3235303530383030303030305a30820131311730150603550407130e416c7661726f204f627265676f6e3119301706035504081310446973747269746f204665646572616c310b3009060355040613024d58310e300c060355041113053031303330311d301b06035504091314496e73757267656e74657320537572203139343031423040060355040313394175746f726964616420436572746966696361646f7261205261697a206465206c6120536563726574617269612064652045636f6e6f6d696131343032060355040b132b446972656363696f6e2047656e6572616c206465204e6f726d6174697669646164204d657263616e74696c311f301d060355040a1316536563726574617269612064652045636f6e6f6d69613124302206092a864886f70d010901161561637273654065636f6e6f6d69612e676f622e6d7830820122300d06092a864886f70d01010105000382010f003082010a0282010100c164a0f4e75270b2ea9313f4353a1fea3a1cc51b8b58e196d602415e8e8540ff41664053fc98b5d13232976740809dee203f0e54fb4207fb771a99d886f41c2a8825f3e944a34efe07beb1c8ef3c8d87e01eca49103b28ef2451a1fc88174ae71cc8546763e86a31e6436cf6401186c456eebdc91da6463c1e46c2828d2ea9e8ee760a43e0724d8cf4c506fa2c01003360ce3870346b171aeb7a6461a793a4656ad723c7767a94510bec9ea8cf3ba250321c42bd63e187cbb985480ec0d558b6f6ce4bf207cfe304d51fc2d6a36ea3bbb6b76ec4f1a21f16bcb62db0eff45a9b298dbce1fc075b1e09338278cc406d71b363132fd34c36ac394fc6c1b0b6f5850203010001a381b23081af30330603551d1f042c302a3028a026a0248622687474703a2f2f61632e65636f6e6f6d69612e676f622e6d782f6c6173742e63726c30470603551d200440303e303c0608608364650a823c013030302e06082b060105050702011622687474703a2f2f61632e65636f6e6f6d69612e676f622e6d782f6370732e68746d6c300f0603551d130101ff040530030101ff300b0603551d0f040403020106301106096086480186f8420101040403020007300d06092a864886f70d010105050003820101004c2a785304967360ab35acc0c4e3e7c870a5292f8718e5a882de07d508f4cf9e3d9efc4a2c167c9fa29d6510ccc11b9b6a67dab2b31dffcd647a3863ad48fdf372e1fa9fbb57ddbfccc254d8953c66d76b06baafa9e06d08efa4b6903d0c6e2017a796a77c684a9c98c4076fc1026291389b9de38a79539d9f247625f6ad285606aaef07acbaf66ce425317d88803a7846f879e138e013e7612947f3cb1400d3dae2dded73df4bf263e426d875d04d43149016944701ffa1594be4769b5903ded617f67bd75cf8e9e36fc84ee04726b1e29c7c4a31e56411e0b05fda9136481ffa098a6568f50ec29fefb86acf77fe12ed36da1136ad196ac2d48e52d768ef31 cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6E3A55A4190C195C93843CC0DB722E313061F0B1\Blob = 0b000000010000004c0000004300680061006d006200650072007300690067006e0020004300680061006d00620065007200730020006f006600200043006f006d006d006500720063006500200052006f006f0074000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080300000001000000140000006e3a55a4190c195c93843cc0db722e313061f0b12000000001000000c1040000308204bd308203a5a003020102020100300d06092a864886f70d0101050500307f310b300906035504061302455531273025060355040a131e41432043616d65726669726d61205341204349462041383237343332383731233021060355040b131a687474703a2f2f7777772e6368616d6265727369676e2e6f726731223020060355040313194368616d62657273206f6620436f6d6d6572636520526f6f74301e170d3033303933303136313334335a170d3337303933303136313334345a307f310b300906035504061302455531273025060355040a131e41432043616d65726669726d61205341204349462041383237343332383731233021060355040b131a687474703a2f2f7777772e6368616d6265727369676e2e6f726731223020060355040313194368616d62657273206f6620436f6d6d6572636520526f6f7430820120300d06092a864886f70d01010105000382010d00308201080282010100b73655e5a55d1830e0da895491fcc8c752f82f50d9efb1757365477d1b5bba75c5fca18824fa2fedca084a3954c4517ab5da60ea383c81b2cbf1bbd991233f48017075a9052aad1f71f3c9543d1d066a403eb30c85ee5c1b79c262c4b8368e355d010c23044735aa9b604ea0663dcb260a9c40a1f45d98bf71aba500682aed837a0fa214b5d422b380b03c0c5a51692d58188fed999ef1aee295e6f647a8d60c0fb05858dbc366379e9b91543337d2941c6a48c9c9f2a5daa50c23f7230e9c32555e719c8405519a2dfde64e2a345adeca4037670c54215577da0a0ccc97ae80dc94364af43ece36131e53e4ac4e3a05ecdbae729c388bd0393b890a3e77fe75020103a38201443082014030120603551d130101ff040830060101ff02010c303c0603551d1f043530333031a02fa02d862b687474703a2f2f63726c2e6368616d6265727369676e2e6f72672f6368616d62657273726f6f742e63726c301d0603551d0e04160414e394f5b14de9dba1295b578b4d760676e1d1a28a300e0603551d0f0101ff040403020106301106096086480186f842010104040302000730270603551d110420301e811c6368616d62657273726f6f74406368616d6265727369676e2e6f726730270603551d120420301e811c6368616d62657273726f6f74406368616d6265727369676e2e6f726730580603551d200451304f304d060b2b0601040181872e0a0301303e303c06082b060105050702011630687474703a2f2f6370732e6368616d6265727369676e2e6f72672f6370732f6368616d62657273726f6f742e68746d6c300d06092a864886f70d010105050003820101000c4197c21a86c0227c9ffb90f31ad103b1ef13f9215f049cdac9a58d276c968791be4190017293e71e7d5ff689c65da740093dac494545dc2e8d3068b209bafbc32fccba0bdf3f777b467d3a12248e968f3c050a6fd294281d6d0cc02e8822d5d8cf1d13c7f048d7d705a7cfc7479e3b3c34c8804fd414bbfc0d50f7fab3ec425fa9dd6dc8f475cf7bc17226b1011c5c2cfd7a4eb401c50557b9e73caa05d988e9074641ceef4181ae58df83a2aecad7771fe7003c9d6f8ee432091d4d783478343c949b26ed4f71c6197abd2022485afe4b7d03b7e758bec6324e741e68dda8685bb33eee627dd980e80a757ab7eeb4659a2190e0aad098bc38b5733c8bf8dc updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\59AF82799186C7B47507CBCF035746EB04DDB716 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5F3AFC0A8B64F686673474DF7EA9A2FEF9FA7A51\Blob = 0f0000000100000014000000a80fb311312188fd9deedf37fb087479bd6b47c80300000001000000140000005f3afc0a8b64f686673474df7ea9a2fef9fa7a5109000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090b00000001000000260000005300770069007300730063006f006d00200052006f006f0074002000430041002000310000002000000001000000dd050000308205d9308203c1a00302010202105c0b855c0be75941df57cc3f7f9da836300d06092a864886f70d01010505003064310b30090603550406130263683111300f060355040a13085377697373636f6d31253023060355040b131c4469676974616c204365727469666963617465205365727669636573311b3019060355040313125377697373636f6d20526f6f742043412031301e170d3035303831383132303632305a170d3235303831383232303632305a3064310b30090603550406130263683111300f060355040a13085377697373636f6d31253023060355040b131c4469676974616c204365727469666963617465205365727669636573311b3019060355040313125377697373636f6d20526f6f74204341203130820222300d06092a864886f70d01010105000382020f003082020a0282020100d0b9b0a80cd9bb3f21f81bd533938016652075b23d9b606d46c88c316f17c3fa9a6c56ed3cc59157c3cdab9649902a194b1ea36d57ddf12b622875455eaad65bfa0b25d8a116f91cc42ee6952a67ccd0296e3c8534386149b1009fd63a715f4d6dce5fb9a9e4897f6a52faca9bf2dca9f99d99473f4e295fb4a68d5d7b0b99110303fee7dbdba3ff1da5cd901e011f35b07f00db906fc67e7bd1ee7a7aa7aa0c576fa46dc5133bb0a5d9ed321cb45e678b54dc7387e5d3177c6650725dd41a58c1d9cfd889026fa749b4365dd0a4de072cb675b72891d697be28f5981eea5b26c9bdb09773daae9126eb68c1f93915d6674b0a6d4fcbcfb0e442718c5379e7eee1db1da06e1d8c1a77355c161e2b531f348bd16cfcf267077af5adedd69aaba1b14be1cc375ffd7fcd4daeb81f9c43f92a58554345bc96cd700efcc9e366ba4e8d3b81cb15647bb994e85d335285712e4f8ea2061151c9e3cba16e3108640cc2d23cf536e8d7d00e78232091c9242a65295b22f721ce835ea4f3de4bd3688f46755c83096e296bc4708cf59dd7202fff46d22b38c22f751c3d7edaa5ef1e60856942d3ccf863fe1e433985a6b6634110b3731ebcd3faca7d1647e2a7d5d0a38a0a089662566e34dbd902b93075e304d2e78fc2b011400aacd57102628b31beddc623583142432d74f9c69ea68a0fe9febf83e6435724baef4634aad7120138ed0203010001a38186308183300e0603551d0f0101ff040403020186301d0603551d2104163014301206076085740153000106076085740153000130120603551d130101ff040830060101ff020107301f0603551d2304183016801403252fde6f82013a5c2cdc2ba169b567d48cd3fd301d0603551d0e0416041403252fde6f82013a5c2cdc2ba169b567d48cd3fd300d06092a864886f70d010105050003820201003510cbeca6040d0d0fcdc0dbaba8f288970cdf932f4d7c4056317aeba40f60cd7af3bec3278e033ea4dd12ef7e1e74063c3f31f21c7b913121b4f0d06c97d4e997b224561e56c335bd88050f5b101a64e1c78230f932ad9e502ce77805d031b15a988a754e905c6a142ae052478260e61eda81b1fb140b5af19fd295ba3ed01bd6151da3be86d5db0fc04964bb2e50194bd224f8dd1e0756d038a0957020768cd7dd1ede9f71c423ef83135ca324154d29403c6ac4a9d8b7a644a50df4e09d771e407026fcdad936e479e4b53fbc9b65bebb1196cfdbc628393a08ce475b535ac599fe5da9ddef4cd4c6a5ad02e68c07121e6f03d16fa0a3f329bd12c750a2b07f88a999779ab1c0a5392e5c7c69e22cb0ea376aa4e15ae1f550e583efa5bb2a88e78cdbfd6d5e9719a87e66756b71eabfb1c76fa0f48ea4ec34515b8c260370a177d50112570035db23de0e8a2899fdb1106f4bff382d604e2c9ceb67b5ad49ee4b1facaffb0d905a6660705daacd78d424eec841a09301929c6a9efcb924c5b315827ebeae952bebb1c0dae301600b5e69ac845661be7117fe1d130ffec68745e9fe32a01a0d13a4945571a5168bbaca89b0b2c7fc8fd854b593629dcecf59fb3d18ce2acb3515825dff54225b7152fbb7c9fe609b004164f0aa2aecb64243ce896681c88b9f39540325d316358e84d05ffa301af59a6cf40e53f93a5bd11c cefutil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0CFD83DBAE44B9A0C8F676F3B570650B94B69DBF cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CA3AFBCF1240364B44B216208880483919937CF7\Blob = 1400000001000000140000001a8462bc484c332504d4eed0f603c41946d1946b030000000100000014000000ca3afbcf1240364b44b216208880483919937cf709000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090b0000000100000026000000510075006f0056006100640069007300200052006f006f00740020004300410020003200000053000000010000002600000030243022060c2b06010401be58000264010230123010060a2b0601040182373c0101030200c00f0000000100000014000000c8f8a3c6bf401d34e6f1d8f8e1ddd08bbb9346262000000001000000bb050000308205b73082039fa00302010202020509300d06092a864886f70d01010505003045310b300906035504061302424d31193017060355040a131051756f5661646973204c696d69746564311b30190603550403131251756f566164697320526f6f742043412032301e170d3036313132343138323730305a170d3331313132343138323333335a3045310b300906035504061302424d31193017060355040a131051756f5661646973204c696d69746564311b30190603550403131251756f566164697320526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a02820201009a18ca4b940d002daf03298af00f81c8ae4c19851d089fab294485f32f81ad321e9046bfa386261a1efe7e1c183a5c9c60172a3a748333307d615411cbedabe0e6d2a27ef56b6f18b70a0b2dfde93eef0ac6b310e9dcc24617f85dfda4daff9e495a9ce633e62496f73fba5b2b1c7a35c2d667feab66508b6d28602befd760c3c793bc8d3691f37ff8db1113c49c7776c1aeb7026a817aa94583e205e6b956c194378f48716322ec176507958a4bdf8fc65a0ae5b0e35f5e6b11ab0cf985eb44e9f80473f2e9fe5c988cf573af6bb47ecdd45c022b4c39e1b295952d4287d7d5b39043b76c13f1deddf6c4f8893fd175f592c391d58a88d090ecdc6dde89c26571968b0d03fd9cbf5b16ac92dbeafe797cadebaff716cbdbcd252be51ffb9a9fe251cc3a530c48e60ebdc9b4760652e611138572630304e004362b201902e874a71fb6c95666f07525dc67c10e616088b33ed1a8fca3da1db0d1b12354df44766ded41d8c1b222b6531cdf351ddca1772a31e42df5e5e5dbc8e0ffe580d70b63a0ff33a10fba2c1515ea97b3d2a2b5bef28c961e1a8f1d6ca46137b9867333d797969e237d82a44c81e2a1d1ba675f9507a32711ee16107bbc454a4cb204d2abefd5fd0c51ce506a0831f991da0c8f645c03c33a8b203f6e8d673d3ad6fe7d5b88c95efbcc61dc8b3377d3443235096204921610d89e2747fb3b21e3f8eb1d5b0203010001a381b03081ad300f0603551d130101ff040530030101ff300b0603551d0f040403020106301d0603551d0e041604141a8462bc484c332504d4eed0f603c41946d1946b306e0603551d230467306580141a8462bc484c332504d4eed0f603c41946d1946ba149a4473045310b300906035504061302424d31193017060355040a131051756f5661646973204c696d69746564311b30190603550403131251756f566164697320526f6f74204341203282020509300d06092a864886f70d010105050003820201003e0a164d9f065ba8ae715d2f052f67e6134583c436f6f3c0260c0db547645df8b472c946a50318275589787d76ea9634801720dce783f88dfc07b8da5f4d2e67b284fdd944fc775081e67cb4c90d0b7253f87607074147960cfbe0822693558cfe221f60657c5fe726b3f732909850d4377155f6922178f79579faf82d268766563077a6377833521058ae3f618ef26ab1ef187e4a5963ca8da256d5a72fbc561fcf39c1e2fb0aa8152c7d4d7a63c66c97443cd26fc34a170af890d257a21951a52d9741da074fa950da908d9446e13ef094fd100038f53be840e1b46e561a20cc6f588ded2e458fd6e9933fe7b12cdf3ad6228cdc84bb226fd0f8e4c639e904883cc3baeb557a6d809924f56c01fbf897b0945bebfdd26ff177680d356423acb855a103d14d4219dcf8755956a3f9a84979f8af0eb911a07cb76aed34d0b62662381a870cf8e8fd2ed3907f07912a1dd67e5c858399b038083fe95ef93507e4c9626e577fa75095f7bac89be68ea201c5d666bf7961f33c1ce1b9825c5da0c3e9d848bd19a21114196eb2861b683e48371a88b75d965e9cc7ef276208e291195cd2f121ddba1742829771815331a99ff67d62bf72e1a3931dcc8a265a0938d0ced70d8016b478a53a874c8d8aa5d54697f22c10b9bc5422c0015069439ef4b2ef6df8ecdaf1e3b1efdf918f542a0b25c12619c452100565d58210eac231cd2e cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8EFDCABC93E61E925D4D1DED181A4320A467A139\Blob = 0b00000001000000520000004100750074006f00720069006400610064006500200043006500720074006900660069006300610064006f007200610020005200610069007a002000420072006100730069006c0065006900720061000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080300000001000000140000008efdcabc93e61e925d4d1ded181a4320a467a1392000000001000000bc040000308204b8308203a0a003020102020104300d06092a864886f70d01010505003081b4310b300906035504061302425231133011060355040a130a4943502d42726173696c313d303b060355040b1334496e7374697475746f204e6163696f6e616c206465205465636e6f6c6f67696120646120496e666f726d6163616f202d204954493111300f0603550407130842726173696c6961310b30090603550408130244463131302f060355040313284175746f72696461646520436572746966696361646f7261205261697a2042726173696c65697261301e170d3031313133303132353830305a170d3131313133303233353930305a3081b4310b300906035504061302425231133011060355040a130a4943502d42726173696c313d303b060355040b1334496e7374697475746f204e6163696f6e616c206465205465636e6f6c6f67696120646120496e666f726d6163616f202d204954493111300f0603550407130842726173696c6961310b30090603550408130244463131302f060355040313284175746f72696461646520436572746966696361646f7261205261697a2042726173696c6569726130820122300d06092a864886f70d01010105000382010f003082010a0282010100c0f32e7705ff86f9be521d9bfe54007075408ac6a668b916764c0ff7f4bfb4e288811acbe8ecbe6481a539475deae62d93d31aff7a54a6071f3408f4bd89b982cca3428f5e9ac73ec7a9b8556c24f62a8c65208ae4442402afd4b789fb2ae2c4d7e81d7edc1d220c5f52c3ede02c8dad8e74415e7b28cd944fcc79aeb9b3123afb4c8086a52500976815a9eeb16a28be6e6611d50ae659a052006e7d2eb92b8eb62d6d18456e85037b50cafba4fcb392fa93c73ca24a5b1e96bdbde333b43542f6c3c9eb43165e1e9a9d52a8d5470b71b511c8478dbd99de551280014ea8bb07630efc25b1a2b27452b079dd13a10e3b6e650a81c9bec15dde4d1937e943a74f0203010001a381d23081cf304e0603551d200447304530430605604c010100303a303806082b06010505070201162c687474703a2f2f61637261697a2e69637062726173696c2e676f762e62722f44504361637261697a2e706466303d0603551d1f043630343032a030a02e862c687474703a2f2f61637261697a2e69637062726173696c2e676f762e62722f4c435261637261697a2e63726c301d0603551d0e041604148afaf157841113359042fa574954690da4c4f037300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106300d06092a864886f70d010105050003820101001903973553f860221e8e7202c07e2260156a6f983656aa5577d3f6c71698fc881a1b2529b9b83a6ded38ab621d54c5eddf41a1a562325efbdcddfa2ccf45b06a5cf550037e045dcc24e2aa56b9fd611eb8967ddaf1f0072a4aaafa0ae405c12afbe45a2c4b39700c00daef4993ef06630264219d9c76c49eb07d6953f5541f4bffc961e21cec5b9ed8934b774d1439230c6a22bfb7bf5e9ca347100d9fba91f7bc48a07f9121e1b54037956886b4e6e8c639df1ed741966bd4c13b6b9e651449d2793d2e9a53808d1da601bbd23395f9a1264dae67ad773c938f67e508cf020bb30b69bd2491d9e04489540461c5d7f4b99e63db2bef40e3ab1ddf7a2a2bc9fc updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\705D2B4565C7047A540694A79AF7ABB842BDC161\Blob = 0b00000001000000780000004100750074006f00720069006400610064006500200043006500720074006900660069006300610064006f007200610020006400610020005200610069007a002000420072006100730069006c00650069007200610020007600310020002d0020004900430050002d00420072006100730069006c000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000705d2b4565c7047a540694a79af7abb842bdc1612000000001000000840400003082048030820368a003020102020101300d06092a864886f70d0101050500308197310b300906035504061302425231133011060355040a130a4943502d42726173696c313d303b060355040b1334496e7374697475746f204e6163696f6e616c206465205465636e6f6c6f67696120646120496e666f726d6163616f202d20495449313430320603550403132b4175746f72696461646520436572746966696361646f7261205261697a2042726173696c65697261207631301e170d3038303732393139313731305a170d3231303732393139313731305a308197310b300906035504061302425231133011060355040a130a4943502d42726173696c313d303b060355040b1334496e7374697475746f204e6163696f6e616c206465205465636e6f6c6f67696120646120496e666f726d6163616f202d20495449313430320603550403132b4175746f72696461646520436572746966696361646f7261205261697a2042726173696c6569726120763130820122300d06092a864886f70d01010105000382010f003082010a0282010100ce1ce8be9334cec9b1e454ee09f6eca40885a03fc68ac67030a7808ced3e0154078c19233b9fbbc7b48b20b1e2f741162d5e8766bab007dd6fd13f3cdac859339d15b09f92c85654588a3a27a2341e9b78b5b7cde59be9c02e129e707807fa8ef24cc0f8e5727c1ea9a96003572647db8376c3cec812bbd1ffefaeb3627d9aa0e4bc6e7d012e3460dc87e05f7f05705c30152cc275a33f50036623662ce7747778db6617dff91f0d82688f7587f7e9317a534fcf5862bb40a234cfc07084509715da204be9fb4c42ad2b688ea3d9ad0562fe0874c4e8c1cc8513cead283050dddec081c149b05e2e2638e963043377b58076cd2a7ff23cac5d934239f4a273450203010001a381d43081d1304e0603551d200447304530430605604c010100303a303806082b06010505070201162c687474703a2f2f61637261697a2e69637062726173696c2e676f762e62722f44504361637261697a2e706466303f0603551d1f043830363034a032a030862e687474703a2f2f61637261697a2e69637062726173696c2e676f762e62722f4c435261637261697a76312e63726c301d0603551d0e0416041442b22c5c740107be9bff55333bee29bb5d91bf06300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100596c8a76e919715783fea7f47a0f9e81d0cf071c0c23e9240d51cb33e82a09c37aff0ea3808660c17097e0c00a55dda4654c8fa747b057b7f3abc4c319e398ec0db01b5191c9d909d6e96ab3e70cb0b29287fb8e4d15ec121419780c62ea1439180ac555db5385dc7b28fa1571a3ca7425820f672734d7ae521302fbc5ef9a8025a5529e390eed3af478075fd5287a0a4af5d0c367f78c58176f0a00a32610b460223a4a48a5dae0a984de43db9f43a73f280447922ff7e7647521d24f81ceaa3e640ee30ead559a7e949b34c1d0ae694e1ea3d9b38757da70c25a7d87cdf9bf37deed5635f7b7220e4f92b83f08df9c9e985ef26fb9fa9b2cf8cd45d872b220 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\EC93DE083C93D933A986B3D5CDE25ACB2FEECF8E\Blob = 030000000100000014000000ec93de083c93d933a986b3d5cde25acb2feecf8e090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b000000010000005e0000004e00650074004c006f0063006b00200050006c006100740069006e0061002000280043006c00610073007300200050006c006100740069006e0075006d002900200046005101740061006e00fa007300ed0074007600e1006e00790000002000000001000000250600003082062130820409a003020102020649412dec0010300d06092a864886f70d01010b05003081ad310b30090603550406130248553111300f06035504070c08427564617065737431153013060355040a0c0c4e65744c6f636b204b66742e31373035060355040b0c2e54616ec3ba73c3ad7476c3a16e796b696164c3b36b202843657274696669636174696f6e20536572766963657329313b303906035504030c324e65744c6f636b20506c6174696e612028436c61737320506c6174696e756d292046c59174616ec3ba73c3ad7476c3a16e79301e170d3038313231313135313234345a170d3238313230363135313234345a3081ad310b30090603550406130248553111300f06035504070c08427564617065737431153013060355040a0c0c4e65744c6f636b204b66742e31373035060355040b0c2e54616ec3ba73c3ad7476c3a16e796b696164c3b36b202843657274696669636174696f6e20536572766963657329313b303906035504030c324e65744c6f636b20506c6174696e612028436c61737320506c6174696e756d292046c59174616ec3ba73c3ad7476c3a16e7930820222300d06092a864886f70d01010105000382020f003082020a0282020100cdf2eec41a7aeb74294cb6bde4d60a176c65e2663dc4d1bc0cb65ad62b705f2dcc21d15910e4b113bdf6cc2295d66c464e9132b3ebf5accb04014f76dd533e789ff95ebcb5821346ca10e31d2d692b9432107321aba938c5e36e1364d563a9ed0966ec8a6f898d1186d0f5bf32960b7570f52858425eac69b4f5fc91392ea29140d13c5441872364504879684b68934b72eb8069b34a1c90beb241a3a5cd17c0d11a697f02184ab5628726572d6ca82c2139f5975e9b9aa6f8e74c79c47b3b56dc7af8b458ce760aae2255eb8fc784647bbd6bca954fd8be3113bf8da10a2bd579b7f576adda515c814762a8aaffcf53e03471cf0d2553a99e6347af8591f8cf1911e54ef9cfede33505012203cf9a7cea1d515acbfd733d390b31ebc43bca852a111400a01b81a2098848f37ca264a1ec67b45887f014eaa9bea522414decbda40ee83d87f72faace35864f3057928d36ae78d6fd18fcd7251ecf7afc19fda03f72173608413f9736950c89957145fa84d6d42060b3450af2b7953d0be5a4c3b812f2916ce96d6083f6451105bae64783d991e26ee1bb466b481bbcc6fbcf7ede2cbb9084eeb62739e78da2310fdf81b72c6c00e2b1d82a175c1b1e47894b17511440404fc4391832c2806036e57a4767f6a80554c15d96a01fb688520c02be8d557e144bc3a201ee9c8a415df95f9691098eb4e4b5c504dfd636ad59b4b2d7020300f391a345304330120603551d130101ff040830060101ff020104300e0603551d0f0101ff040403020106301d0603551d0e04160414e6a11383fe974bf2d8ff31a1a7743389ce5e7fa4300d06092a864886f70d01010b05000382020100698442c0e35e1361972049f1f41685a59fa4110825c463868ff04bafb329f507571a62c71b456eaf5d16b7c1d064833b97f543b64590f1662a83242aff88e97a0bf9c25b7aaf63f70978864859345e9b6a104ef16e9589364a68d06f9be07e4fb7350fe379b105af277caa890a43defa0cefd9572f2871cd696b5242c98a304559a1ccfa594a8ff7d6dd44a5b32e5b1118e2b2b5e7115338fe824cd373be65921a3aa8d2d2aabcd4be6d3652ff6bd4d2b51b37f31742f12ea7d5906c749d74f5fa5f221bd3dc75a8b5fff21ad1bc2b005c3cc5b886085449a29c23fbefa68d70f442524d1b200081f8a0b8f474239cbef4b90eec1e6ad8654a1575f1775b6ed8b1e60fb496b81dfa86c8926e8be97ddfa20ed5f1f17cae4ae366bf5dfc5bef48b29e69c77d90a055b6947081b90abd897553ec84a903a5df519908d0740c02d67372067b8bbb5daa4efc6767d88e1003192d373ad477a93a1c9dc0797b6c2977324d4a8b3088c2e736ce68a39a9886f989159ebfaa517df15046540f022e5c9fe3de573315fe189261a8d229055d65441e9be3effbdc05df15aba6d80ba473b24c3ae09ed4b36ae53a0e0af04ecf78811fbea9986fb147517d423336b3a6a9025205747e2a6cd4aa9256b03e3b2358b18d35a7138f671e7115a6b3b50386b82066c0486fb9acd44a0355b237df04dd220c53862a4a2aa1c1383e3ce53cdf7597 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B31EB1B740E36C8402DADC37D44DF5D4674952F9\Blob = 190000000100000010000000a62b124070201c18d5e44196e10ee6cb0f0000000100000014000000254f527930383ecbe8b1b23d4940698c516f5a7c030000000100000014000000b31eb1b740e36c8402dadc37d44df5d4674952f909000000010000005e000000305c06082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030606082b0601050507030706082b0601050508020206082b06010505070308060a2b0601040182370a03040b000000010000001000000045006e0074007200750073007400000053000000010000002400000030223020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c01400000001000000140000006890e467a4a65380c78666a4f1f74b43fb84bd6d2000000001000000950400003082049130820379a0030201020204456b5054300d06092a864886f70d01010505003081b0310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31393037060355040b13307777772e656e74727573742e6e65742f43505320697320696e636f72706f7261746564206279207265666572656e6365311f301d060355040b1316286329203230303620456e74727573742c20496e632e312d302b06035504031324456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479301e170d3036313132373230323334325a170d3236313132373230353334325a3081b0310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31393037060355040b13307777772e656e74727573742e6e65742f43505320697320696e636f72706f7261746564206279207265666572656e6365311f301d060355040b1316286329203230303620456e74727573742c20496e632e312d302b06035504031324456e747275737420526f6f742043657274696669636174696f6e20417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100b695b64342fac66d2a6f48df944c395705eec37911416836edecfe9a018fa13828fcf71046662e4d1e1ab11a4ec6d1c09588b0c9ff318b3303dbb7837b3e20845eedb25628a7f8e0b9407137c5cb470e972a68c022956215db47d9f5d02bff824bc9ad3ede4cdb9080503f098a8400ec300a3d18cdfbfd2a599a2395172c459e1f6e43796d0c5c98fe48a7c523475c5efd6ee71eb4f66845d186835ba28a8db1e32980fe257188adbebc8fac52964baa518de4133119e84e4d9fdbacb36ad5bc395471ca7a7a7f90dd7d1d80d981bb5926c211fee693e2f780e465fb34370e2980704daf38862e9e7f57af9e17aeeb1ccb28215fb61cd8e7a20422f9d3dad8cb0203010001a381b03081ad300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff302b0603551d1004243022800f32303036313132373230323334325a810f32303236313132373230353334325a301f0603551d230418301680146890e467a4a65380c78666a4f1f74b43fb84bd6d301d0603551d0e041604146890e467a4a65380c78666a4f1f74b43fb84bd6d301d06092a864886f67d0741000410300e1b0856372e313a342e3003020490300d06092a864886f70d0101050500038201010093d430b0d703202ad0f963e8910c0520a95f19ca7b724ed4b1dbd096fb545a192c0c08f7b2bc85a89d7f6d3b52b32adbe7d4848c63f60fcb260191506cf45f14e29374c0139e303a50e3b460c51cf022448d7147acc81ac9e99b9a006013ff707e5f114d491bb315527bc954dabf9d95af6b9ad89ee9f1e4438de211443abfafbd834273528baabba729cff5641c0a4dd1bcaaac9f2ad0ff7f7fda7deab1ed3025c184da34d25b788356ec9c36c326e211f667491d92ab8cfbebff7aee854aa75080f0a75c4a942e5f05993c5241e0cdb463cf0143ba9c83dc8f603bf35ab4b47baeda0b903875ef811d66d2f7577036b3bffc28af7125855b13fe1e7f5ab43c cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0446C8BB9A6983C95C8A2E5464687C1115AAB74A\Blob = 0300000001000000140000000446c8bb9a6983c95c8a2e5464687c1115aab74a09000000010000006a000000306806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020b000000010000001600000049006e0066006f004e006f00740061007200790000002000000001000000c8070000308207c4308205aca00302010202081aaf926c8f93af60300d06092a864886f70d0101050500308195318192300906035504060c0242473015060355040a0c0e496e666f4e6f7461727920504c433015060a0992268993f22c6401191607726f6f742d6361301a06035504030c13496e666f4e6f746172792043535020526f6f74301a060355040b0c13496e666f4e6f746172792043535020526f6f74301f06092a864886f70d010901161263737040696e666f6e6f746172792e636f6d3022180f32303036303330363137333330355a180f32303236303330363137333330355a308195318192300906035504060c0242473015060355040a0c0e496e666f4e6f7461727920504c433015060a0992268993f22c6401191607726f6f742d6361301a06035504030c13496e666f4e6f746172792043535020526f6f74301a060355040b0c13496e666f4e6f746172792043535020526f6f74301f06092a864886f70d010901161263737040696e666f6e6f746172792e636f6d30820222300d06092a864886f70d01010105000382020f003082020a02820201009ccda45e1fa47e08824f8076c1278c4716609f73acc9917f2d106c3b94499c42335f94f183210991f792b70f38458b94074aabfe3f36355bd1d552384246e847c74a5033c8e4e073b6909abaa38838d32b42c06edfa21317f24fb9e7f221dd65faa6fd52c260b2cb4f37bdaf278e696b32405359f5f2317688066d689f30bcb7811c8e6763c30565f733f659a9abb38a470b1413c736dd22fbf84434354128c081ba4eb57113af03a8490a2ea49b61776b1d24d2a5f12dd1475e82ff4883b0159847de76fb4f4ec0bf544966bc4f01d17c3a65fec5ac705bc5151b72a57da65b3b17c3bec33f5d127f672d76470c8bbf1623b58372cd80cde8baaf5e683338d490ed6ed2e9560424a1f9be6c5eca9e2320922b9a0d4b4de3a2488fbeedaa0e8cbea93870b9107f325d80275a03e0d44733255a76a983d99840ed7f7502efee6191ac313e80d3344bf0c24e3530495eb729e87d21b0ff2a799c343119663320611a2fb082d5b16753900d9d2a97286eb7663f1a7fa6c49a6896e6665b7a37df5a7715e0d9e37cb3b2d0d568db3e1d581f8eca987463bfd47d3668eed02fa42af2882f77c3123f8da8252c046958a6cbb439f188d0a6de96ce734246d3a3f9f1d88e8a9d6e8ac0524f45b770fe1c7b3d0d96dcf990966dc618a142c2b6dcd9231f97939b0f19f9b0b73f2574bd8253ec0d2f6dd63f522fd876d025bdd0b9f5bd0f0203010001a38202103082020c300e0603551d0f0101ff040403020106304406082b0601050507010104383036303406082b060105050730018628687474703a2f2f6f6373702e696e666f6e6f746172792e636f6d2f726573706f6e6465722e636769305606082b0601050507010b044a3048304606082b06010505073005863a6c6461703a2f2f6c6461702e696e666f6e6f746172792e636f6d2f64633d726f6f742d63612c64633d696e666f6e6f746172792c64633d636f6d3081aa0603551d200481a230819f306f06092b0601040181ad00013062303a06082b06010505070201162e687474703a2f2f7265706f7369746f72792e696e666f6e6f746172792e636f6d2f6370732f716370732e68746d6c302406082b0601050507020230181a16496e666f4e6f746172792043535020526f6f74204341302c06092b0601040181ad0000301f301d06082b060105050702011611687474703a2f2f7777772e6372632e6267300f0603551d130101ff040530030101ff307f0603551d1104783076a47430723170300b06035504110c0431303030300c06035504070c05536f666961301306035504140c0c2b3335393239383735373137301b060655040a6401010c113133313237363832373a42554c53544154302106092a864886f70d0109080c143136204976616e205661736f7620537472656574301d0603551d0e04160414ddd44e67433fd3ea62e8da896e8e3b6e0bbb959f300d06092a864886f70d01010505000382020100189bfc0dc1f871acd4cc14b52709c1584a3440e69b65cae0f18b523d967e891edea815fadd942e83c6365d1b21a9360e5c3d49880c53215d1f6d49366f9c50ebdb64cf89baaf5ead14448762ef307cc096df7039cb3b51ee2bfc08058756cd3325e0801ae0a6e70d434c00234356a20e1954e28dd10d16b95a6f9b77e51ca9838b28f1e132765f47b09a36eab26fdd863158fe0669b0c360a6fbd828d408ddf16e4e1abdcdb7acbe22871649b13800d58c4329e7296b2b126259aa43f0b4728838d6025f1fda24928d8d7cfc1f7d3890580b1f1cb71cbb36272d5a1cc731ddb42b9dbd47a131b70911e2cd6fa76ef4b8a3298ff360bfa71de04f9725250a3049c7fe7a3944d4d365ef885dffd9ee5339bc3a44a8313b25977b9abfd1dd6be2d7126afb32bbd1d88ef396b38f90ea7858c10adba525be8a031fe592d2bc7fa472e4eb567aa9fa7cb8f1a0bf26fe4a34cf25aa64c4bb7bed18e54c2c6f4165ede0bb3d2c75556fe41506c54b6c93f60f55cc937585612603d2cc95cb7a102027567abf7558dcf50d96d94a0784d8229b10d1d6066e160703b3af79e3a017bab84308429d3c3b27cc7c11d47e31f366510211723aa3e972bd955da1157f47133995b2b5aef6f161743078c76601d3b2709708c90d24f4442a70a69d2f1264066e8a8d20e37edaf154bf0d14ac29be7d7f7fb96b450251671559a20e2127c9826731 updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F17F6FB631DC99E3A3C87FFE1CF1811088D96033\Blob = 190000000100000010000000446baae39a4826f1d43186dee8c6aa7e0f0000000100000014000000399890e6c8e9ddbce5a03cacdf9907ec990191d8030000000100000014000000f17f6fb631dc99e3a3c87ffe1cf1811088d96033090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b00000001000000640000005400dc0052004b0054005200550053005400200045006c0065006b00740072006f006e0069006b00200053006500720074006900660069006b0061002000480069007a006d00650074002000530061001f016c00610079003101630031017300310100005300000001000000230000003021301f060960861803000301010530123010060a2b0601040182373c0101030200c014000000010000001400000029c590ab25af11e461bfa3ff886191e60efe9c812000000001000000410400003082043d30820325a003020102020101300d06092a864886f70d01010505003081bf313f303d06035504030c3654c39c524b545255535420456c656b74726f6e696b20536572746966696b612048697a6d6574205361c49f6c6179c4b163c4b173c4b1310b3009060355040613025452310f300d06035504070c06416e6b617261315e305c060355040a0c5554c39c524b54525553542042696c676920c4b06c657469c59f696d2076652042696c69c59f696d2047c3bc76656e6c69c49f692048697a6d65746c65726920412ec59e2e20286329204172616cc4b16b2032303037301e170d3037313232353138333731395a170d3137313232323138333731395a3081bf313f303d06035504030c3654c39c524b545255535420456c656b74726f6e696b20536572746966696b612048697a6d6574205361c49f6c6179c4b163c4b173c4b1310b3009060355040613025452310f300d06035504070c06416e6b617261315e305c060355040a0c5554c39c524b54525553542042696c676920c4b06c657469c59f696d2076652042696c69c59f696d2047c3bc76656e6c69c49f692048697a6d65746c65726920412ec59e2e20286329204172616cc4b16b203230303730820122300d06092a864886f70d01010105000382010f003082010a0282010100abb73e0a8cc8a55815e68aef273d4ab4e825d3cd33c220dc19ee883f4d62f0dd13778f61a92ab5d4f2b93158293b2f3f6a9c6f737625ee342080eeeab7f0c40acd2b8694c9e360b14452b25a29b4919783d8b7a6142f2949a2f30506fbb44fdaa16c9a669ff04309caea728feb00d73539d75617471730f4bebf3fc268af3640c1a9f4a9a7e8106b088af7861edc9a2a1506f6a3f0f4e0c714d4517fcfb4db6daf4796179b7771d8a7719d240cf6943f8531124fbaee4e82b8b93e8f23375ecca2aa75f7186f09d3aea7542834fbe1e03b607da0be798986c89f2df90a4bc450a2e7fd7916c77a0b18cfce4cef7dd6076f98f1afb1c17ad78135b8aa17b4e0cb0203010001a3423040301d0603551d0e0416041429c590ab25af11e461bfa3ff886191e60efe9c81300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100100ddaf83aec28d1149582b1122c517a4125364c9fec3f1f849d65545ca8160240fa6e1a3784ef729d860a559d5628ac662cd03a5693340725ad08b08fc80f0959ca9d981ce554f8b9457f6a976f88684d4a06263788020eb6c6d67299ce6b77da6231a4561fae5f8d77da5df688fc1ad99eb581f032b8e388d09cf36aa0b99b145935364fcff38e5e5d17ad1595d8ddb2d5156e004eb34bcf6694e4e0cdb505da63578be5b3aadbc02e1c9044db1a5d18a4eebe045b99d5715f55656462d5a29b045986c86277e77c82456a3d17bfec9d750caea36f5ad32f9836f4f0f519ab115dc8a6e32a586a4209c3bd922666320d5d085574ff8c98d00aa6846ad1397d cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5F3AFC0A8B64F686673474DF7EA9A2FEF9FA7A51\Blob = 14000000010000001400000003252fde6f82013a5c2cdc2ba169b567d48cd3fd0b00000001000000260000005300770069007300730063006f006d00200052006f006f00740020004300410020003100000009000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090300000001000000140000005f3afc0a8b64f686673474df7ea9a2fef9fa7a510f0000000100000014000000a80fb311312188fd9deedf37fb087479bd6b47c82000000001000000dd050000308205d9308203c1a00302010202105c0b855c0be75941df57cc3f7f9da836300d06092a864886f70d01010505003064310b30090603550406130263683111300f060355040a13085377697373636f6d31253023060355040b131c4469676974616c204365727469666963617465205365727669636573311b3019060355040313125377697373636f6d20526f6f742043412031301e170d3035303831383132303632305a170d3235303831383232303632305a3064310b30090603550406130263683111300f060355040a13085377697373636f6d31253023060355040b131c4469676974616c204365727469666963617465205365727669636573311b3019060355040313125377697373636f6d20526f6f74204341203130820222300d06092a864886f70d01010105000382020f003082020a0282020100d0b9b0a80cd9bb3f21f81bd533938016652075b23d9b606d46c88c316f17c3fa9a6c56ed3cc59157c3cdab9649902a194b1ea36d57ddf12b622875455eaad65bfa0b25d8a116f91cc42ee6952a67ccd0296e3c8534386149b1009fd63a715f4d6dce5fb9a9e4897f6a52faca9bf2dca9f99d99473f4e295fb4a68d5d7b0b99110303fee7dbdba3ff1da5cd901e011f35b07f00db906fc67e7bd1ee7a7aa7aa0c576fa46dc5133bb0a5d9ed321cb45e678b54dc7387e5d3177c6650725dd41a58c1d9cfd889026fa749b4365dd0a4de072cb675b72891d697be28f5981eea5b26c9bdb09773daae9126eb68c1f93915d6674b0a6d4fcbcfb0e442718c5379e7eee1db1da06e1d8c1a77355c161e2b531f348bd16cfcf267077af5adedd69aaba1b14be1cc375ffd7fcd4daeb81f9c43f92a58554345bc96cd700efcc9e366ba4e8d3b81cb15647bb994e85d335285712e4f8ea2061151c9e3cba16e3108640cc2d23cf536e8d7d00e78232091c9242a65295b22f721ce835ea4f3de4bd3688f46755c83096e296bc4708cf59dd7202fff46d22b38c22f751c3d7edaa5ef1e60856942d3ccf863fe1e433985a6b6634110b3731ebcd3faca7d1647e2a7d5d0a38a0a089662566e34dbd902b93075e304d2e78fc2b011400aacd57102628b31beddc623583142432d74f9c69ea68a0fe9febf83e6435724baef4634aad7120138ed0203010001a38186308183300e0603551d0f0101ff040403020186301d0603551d2104163014301206076085740153000106076085740153000130120603551d130101ff040830060101ff020107301f0603551d2304183016801403252fde6f82013a5c2cdc2ba169b567d48cd3fd301d0603551d0e0416041403252fde6f82013a5c2cdc2ba169b567d48cd3fd300d06092a864886f70d010105050003820201003510cbeca6040d0d0fcdc0dbaba8f288970cdf932f4d7c4056317aeba40f60cd7af3bec3278e033ea4dd12ef7e1e74063c3f31f21c7b913121b4f0d06c97d4e997b224561e56c335bd88050f5b101a64e1c78230f932ad9e502ce77805d031b15a988a754e905c6a142ae052478260e61eda81b1fb140b5af19fd295ba3ed01bd6151da3be86d5db0fc04964bb2e50194bd224f8dd1e0756d038a0957020768cd7dd1ede9f71c423ef83135ca324154d29403c6ac4a9d8b7a644a50df4e09d771e407026fcdad936e479e4b53fbc9b65bebb1196cfdbc628393a08ce475b535ac599fe5da9ddef4cd4c6a5ad02e68c07121e6f03d16fa0a3f329bd12c750a2b07f88a999779ab1c0a5392e5c7c69e22cb0ea376aa4e15ae1f550e583efa5bb2a88e78cdbfd6d5e9719a87e66756b71eabfb1c76fa0f48ea4ec34515b8c260370a177d50112570035db23de0e8a2899fdb1106f4bff382d604e2c9ceb67b5ad49ee4b1facaffb0d905a6660705daacd78d424eec841a09301929c6a9efcb924c5b315827ebeae952bebb1c0dae301600b5e69ac845661be7117fe1d130ffec68745e9fe32a01a0d13a4945571a5168bbaca89b0b2c7fc8fd854b593629dcecf59fb3d18ce2acb3515825dff54225b7152fbb7c9fe609b004164f0aa2aecb64243ce896681c88b9f39540325d316358e84d05ffa301af59a6cf40e53f93a5bd11c cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1AC92F09EA89E28B126DFAC51E3AF7EA9095A3EE\Blob = 1400000001000000140000009faad32996df00e543e0f163acde128ec22778fa0b000000010000003e0000000e204900470043002f004100200041004300200072006100630069006e0065002000450074006100740020006600720061006e0063006100690073000000090000000100000074000000307206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030606082b0601050507030706082b0601050508020206082b06010505070308060a2b0601040182370a0304060a2b0601040182370a030c06082b060105050703090300000001000000140000001ac92f09ea89e28b126dfac51e3af7ea9095a3ee0f00000001000000200000005e873caf65994c56d4516c228671a26225f8f2b087b682fa56f5608a02abe6c62000000001000000c7050000308205c3308203aba00302010202121121850cb39c6a32fabe671b813fa486158f300d06092a864886f70d01010b0500305e310b3009060355040613024652310e300c060355040a1305414e53534931173015060355040b130e3030303220313330303037363639312630240603550403131d4947432f4120414320726163696e652045746174206672616e63616973301e170d3131303730383039303030305a170d3238303431353039303030305a305e310b3009060355040613024652310e300c060355040a1305414e53534931173015060355040b130e3030303220313330303037363639312630240603550403131d4947432f4120414320726163696e652045746174206672616e6361697330820222300d06092a864886f70d01010105000382020f003082020a0282020100aa7c289f113098cd6f6e2c8512263b0806ca41fd524f43bdc0262771761a5996d809eb07aa264e4f3e4ba1e3978785668171c9b915766f77501893102d37884d17b7f345bd222eb727985bc705fdbd33eda2f5531d282365bf40356ece6a0bc3a9f5250cab22f0b8c0c47d370ca3627ceeb4db3d2139a79c89e39ba210f88ab64a2f2e98692b6aa086daf108e5be4c67162d2561f3d50d0b17444709d446059d0fc0884d61e424c4c76809afacd2afb995266f8004fc76acaac723b6e406915544ec64db99811cd25674fdd63228bbcbc9370dfb696c6fbaa36b068c6a402e173a39ead00cdf5a1cba6fa432b0b8cc3e771bd38b1f86faff3e3e6f5c8846e7e30ffaab1df37d4bf8546e4eccdc325a6378a232af3378ea43e14c7a4dd794062de64fa54292af288a4fc315eca96ba9dfe0dd1302bccc7dff2de607a9be7596ea425e5b1adea233b363bdab05f98be6bd4dd16d569aeb893c9fc078e4be257006c51173a0c8ca14cb3ad4f29c2a3cda5f1733d9761437aa498765d9f4d92e195ff9a0cda8b941326d71a6a4cbf76322d029e4ba811a6a291d9aa5a45c46542445d4c8ed7a7985ec84776e674d640f43de7a83a4a7d8dbb5534cfe62c813c36236a52831329bb49687e299c61f56bf46a3a96431e5d5b14ba866cc5ba1ff16fc0a382a688f772526ad91748568c87f1ae55a14b87d0eb72331c064b7052f4158550203010001a37b3079300f0603551d130101ff040530030101ff300e0603551d0f0101ff04040302010630160603551d20040f300d300b06092a817a01815f010102301d0603551d0e041604149faad32996df00e543e0f163acde128ec22778fa301f0603551d230418301680149faad32996df00e543e0f163acde128ec22778fa300d06092a864886f70d01010b0500038202010075b575d18e36669c48f7850d4e05bb4d9a9cb40e28a204bc5030bbf4944c989085abe052644fd2d22e629390b0850d8854fbc6546c9eeb9579805ea297161ff26774419c55f4b76a9b4a1686bd051f6680707ec9d1f52d21715039a5ad88a6261c8bd7251c3ad6e3f4c20c9f57c164c857512316238d0f236a564bfffac69f3593c622c065f1afdea96c18be576559cdf423556421d8ed95616933726a51f69fe5956d8ede6b732713945e7e9748c03216be3d37edd6dc8ebc5c2dfc62a8cff690f7b18b09eb3a24630dc89645d42f774842f52d62e7270be0118619dda710f763069130695a75f4acf9a18d97c6a0ef3a1f932548563a1a88211993c39520490855494da2539c999c73692ea7f5cab70e25ef37235f90d8437eee84176a275e7fd22d3fac3eaf30a78d91c4f48f091df3f7910ee318badc44c97d055303b76ea0f379d7d11a4fd0b86c8876c1809855855361cf44574cde4e0d1651f13d8981ae7d0bad8ab5ee56c4c6cc110b18d4fcfd79fbfe04119c23ef7672c78dbeb91e7876f29a1cad6342c7d8ed6d6190c2212a0f08142d2043257c18b5b7a0a47db9a50c19fec9ab3de75bdeaffa57192785e7230ef4cd0d19303e8ae4c6111ef0b47d69639b0e968690e0fb036f5b593e1d21f557675626f287190784ba2c903ac328a4055a20cda95b9575397f22500a4e7f17f7b3acd307a6be2d520a304c7810 cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\43F9B110D5BAFD48225231B0D0082B372FEF9A54\Blob = 03000000010000001400000043f9b110d5bafd48225231b0d0082b372fef9a54090000000100000016000000301406082b0601050507030406082b060105050703010b0000000100000048000000460061006200720069006300610020004e006100630069006f006e0061006c0020006400650020004d006f006e00650064006100200079002000540069006d0062007200650000002000000001000000fd020000308202f930820262a003020102020436f11b19300d06092a864886f70d01010505003036310b3009060355040613024553310d300b060355040a1304464e4d5431183016060355040b130f464e4d5420436c6173652032204341301e170d3939303331383134353631395a170d3139303331383135323631395a3036310b3009060355040613024553310d300b060355040a1304464e4d5431183016060355040b130f464e4d5420436c617365203220434130819d300d06092a864886f70d010101050003818b0030818702818100983fad1936933d3efe764214fd356ff1faad227a58e346d05dc65af9622d8f315efeb430fe5074acd69d1de062c649dd14127d710bac06c13fd70687e09089d6e5e303b2f227b19f33c8aa6b364aa3c43f79419d89462f2b3e63d4385691aa1db10d42754df3874ee30f4dccb46cbf621387ead09b8eb6e2ff19f49409d59661020103a382011430820110301106096086480186f842010104040302000730580603551d1f0451304f304da04ba049a4473045310b3009060355040613024553310d300b060355040a1304464e4d5431183016060355040b130f464e4d5420436c6173652032204341310d300b0603550403130443524c31302b0603551d1004243022800f31393939303331383134353631395a810f32303139303331383134353631395a300b0603551d0f040403020106301f0603551d23041830168014409a7644977407c4ac14cb1e8d4f3a457c30d761301d0603551d0e04160414409a7644977407c4ac14cb1e8d4f3a457c30d761300c0603551d13040530030101ff301906092a864886f67d074100040c300a1b0456342e3003020490300d06092a864886f70d010105050003818100614ca07c59635b66f8ee6513ce438047b9b235c9c884c76b736045e49d379df58e25b9f9aaaacae3f8439c2fa08905b14532942a1e038d5da6decf5795dadf26605fcbdf951eb8ce08d8f88ac94fa9687593e32f054c646002a2421e6f866865550ed8436ff291313ea3473c2805af45b69d224c267b4b7d5b15f91946df085d updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\093C61F38B8BDC7D55DF7538020500E125F5C836\Blob = 0f0000000100000020000000bc9c578712090a1c04397ca4a528d202b145b32d9a9fd76743f632a6636abaaf030000000100000014000000093c61f38b8bdc7d55df7538020500e125f5c83609000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090b000000010000002c000000510075006f0056006100640069007300200052006f006f00740020004300410020003200200047003300000053000000010000002600000030243022060c2b06010401be58000264010230123010060a2b0601040182373c0101030200c02000000001000000640500003082056030820348a0030201020214445734245b81899b35f2ceb82b3b5ba726f07528300d06092a864886f70d01010b05003048310b300906035504061302424d31193017060355040a131051756f5661646973204c696d69746564311e301c0603550403131551756f566164697320526f6f742043412032204733301e170d3132303131323138353933325a170d3432303131323138353933325a3048310b300906035504061302424d31193017060355040a131051756f5661646973204c696d69746564311e301c0603550403131551756f566164697320526f6f74204341203220473330820222300d06092a864886f70d01010105000382020f003082020a0282020100a1ae25b20118dc57883f46ebf9afe2eb2371e29ad16166215faaaf2751e56e1b16d42d7d50b05377bd783a60e264029b7c869bd61a8eadff1f157fd5951e12cbe6148404c1df36b3169f8ae3c9db9834ced833172846fca7c9f0d2b4d54d097249f9f287e3a9da7da17d6bb23a25a96d5244acf8be6efbdca673919061a6031420f2e787a388adada08cffa60b255225e71601d5cbb835810ca33bf0e1e1fc5a5dce80716df849ab3e3bbab8d78001fba5eb5bb3c55e602a31a0af37e8203a9fa8322c0ccc091dd39e8e5dbc4c98eec51a687bec53a6e91435a3dfcd809f0c48fb1cf4f1bf4ab8fad58c714ac71fadfe419ab3835df28456efa55743ce29ad8cab55bfc4fb5b01dd2321a158008ec3d06a13ed13e3122b80dc67e695b2cd1e226e2af841d4f2ca14078d8a5512c669f5b886682f535eb0d2aa21c198e630e36755c79b6eac19a855a64506d0233adbeb655d2a1111f03b4fca6df434c471e4ff005af65cae23608573f1e410b125aed592bb13c10ce039dab43957b5ab35aa72213b8335e731df7a216eb832087d1d3291154a6272cfe377a1bcd5111b76016708e0410bc3eb156ef8a419d9a2abafe22752562b028a2c1424f9bf4202bf26c8c68fe06e387d532de5ed98b39563687ff935f4df88c5603592c07c691c619516d0ebde0baf3e04104565585038af48f259b616f23c0d9002c6702e01ad3c15d70203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414ede76f765abf60ec495bc6a577bb7216719bc43d300d06092a864886f70d01010b0500038202010091df803f43097e71c2f7ebb3888fe151b2bc3d75f9285dc8bc999b7b5daae5cae10af7e8b2d39fdd67317eba01aac76a413b90d4085cb2606a90f0c8ce0362f98bedfb6e2adc064d3c290f89168a584c480fe88461ea3c72a677e442ae88a34358797eaecaa5530da93d70bd201961a46c38fc4332e1c147fff8ecf1112232969cc2f65b69967b200c43419a5bf6591988de558837510b785c0a1ea342fdc79d880fc0f27802245493af898788c94a801dead06e3e612e36bb350e2796fd66343b617273f1165c47065449007a5812b00aef85fdb1b833756a931c12e6605e6f1d7fc91f23cb84619f1e8244f95fad6255249a5298ed51e7a17e973ae62f1f11da53802c859eab3510db225f6ac55e9753f232020930a358f00d01d572c6b17c697bc3f53645cc616e5e4c94c55eaee80e5e8bbff7cde0eda10e1b33ee5418fe0fbeef7e846b43e37098db5d75b20d590785152339d6f1dfa9260fd648c7b3a622f533375a95479f7bba18156fffd614648349d20a6721db0f3563602822e3b19583cd85a6dd2f0fe767526ebb2f857cf54a73e7c53ec0bd2112053ffcb70349025bc825e6e25438f579878c1d53b24e857b0638c72cf8f8b0728d25e57752f4031c48a6505f8820306ef28243ab3d9784e753fb21c14f0f229a86b8592af6473d19882de885e19eec85086ab16c34c91dec482b3b78ed66c48e796983de7f8c cefutil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a09000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B172B1A56D95F91FE50287E14D37EA6A4463768A\Blob = 1900000001000000100000001779b0c2e4414bbad0662219933d67d70f0000000100000014000000bba770661f7c955307ec67e2369d3c3991e21fdc0b00000001000000140000005500530045005200540072007500730074000000090000000100000016000000301406082b0601050507030406082b06010505070302030000000100000014000000b172b1a56d95f91fe50287e14d37ea6a4463768a1400000001000000140000008982677dc49d2670004bb450487cde3dae046e7d2000000001000000a6040000308204a23082038aa003020102021044be0c8b500024b411d336252567c989300d06092a864886f70d01010505003081ae310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d313630340603550403132d55544e2d5553455246697273742d436c69656e742041757468656e7469636174696f6e20616e6420456d61696c301e170d3939303730393137323835305a170d3139303730393137333635385a3081ae310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d313630340603550403132d55544e2d5553455246697273742d436c69656e742041757468656e7469636174696f6e20616e6420456d61696c30820122300d06092a864886f70d01010105000382010f003082010a0282010100b23985a4f27dab413b624637aecdc16075bc3965f94a1a47a2b9cc48cc6a98d54d3519b9a442e5ce49e28a2f1e7cd23107c74eb483649d2e29d5a264c485bd85513579a44e68907b1c7aa492a817f29815f293ccc9a43295bb0c4f30bd98a00b8be56e1ba246fa78bca26fab595ea52fcfcada6daa2febaca1b36aaab72e67358b79e11e6988e2e646cda0a5eabe0bce763a7a0e9beafcda275b3d731f22e64861c64cf369b1a82e1bb6d431202cbc828a8ea40ea5d78943fc165aaf1d71d71159daba870daffaf3e1c2f0a4c5678cd6d6543ade0aa4ba0377b365c8fd1ed37462aa18ca68931ea1857ef54765cbf84d572874d234ff30b6eef66230148c2ceb0203010001a381b93081b6300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e041604148982677dc49d2670004bb450487cde3dae046e7d30580603551d1f0451304f304da04ba0498647687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d436c69656e7441757468656e7469636174696f6e616e64456d61696c2e63726c301d0603551d250416301406082b0601050507030206082b06010505070304300d06092a864886f70d01010505000382010100b16d615da61a7f7cab4ae430fc536f2524c6caede2315c2b0eeeee61556f043ecf39dec51b4994e4eb204cb4e69e502e72d98df5aaa3b34ada561c609780dc82a2ad4abd8a2bff0b09b4c6d7200445e4cd8001baba2b6eceaad792fee4afebf4261d162a7f6c3095372f3312ac7fddc7d1118c5198b2d0a391d0adf69f9e83931e1d42b846af6b66f09b7feae30302e50251c1aad5359d72400389ba311dc51068529edfa285c55c08a678e6534fb1e8b7d3149e93a6c364e3ac7e71cdbc9fe9031bccfbe9ac31c1af7c15740299c3b247a6c23261d7c76f48245127a1d58755f27b8f983d169eee75b6f8d08ef2f3c6ae285ba7f0f33617fcc305d3ca034a54 cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B31EB1B740E36C8402DADC37D44DF5D4674952F9\Blob = 53000000010000002400000030223020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c00b000000010000001000000045006e0074007200750073007400000009000000010000005e000000305c06082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030606082b0601050507030706082b0601050508020206082b06010505070308060a2b0601040182370a0304030000000100000014000000b31eb1b740e36c8402dadc37d44df5d4674952f92000000001000000950400003082049130820379a0030201020204456b5054300d06092a864886f70d01010505003081b0310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31393037060355040b13307777772e656e74727573742e6e65742f43505320697320696e636f72706f7261746564206279207265666572656e6365311f301d060355040b1316286329203230303620456e74727573742c20496e632e312d302b06035504031324456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479301e170d3036313132373230323334325a170d3236313132373230353334325a3081b0310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31393037060355040b13307777772e656e74727573742e6e65742f43505320697320696e636f72706f7261746564206279207265666572656e6365311f301d060355040b1316286329203230303620456e74727573742c20496e632e312d302b06035504031324456e747275737420526f6f742043657274696669636174696f6e20417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100b695b64342fac66d2a6f48df944c395705eec37911416836edecfe9a018fa13828fcf71046662e4d1e1ab11a4ec6d1c09588b0c9ff318b3303dbb7837b3e20845eedb25628a7f8e0b9407137c5cb470e972a68c022956215db47d9f5d02bff824bc9ad3ede4cdb9080503f098a8400ec300a3d18cdfbfd2a599a2395172c459e1f6e43796d0c5c98fe48a7c523475c5efd6ee71eb4f66845d186835ba28a8db1e32980fe257188adbebc8fac52964baa518de4133119e84e4d9fdbacb36ad5bc395471ca7a7a7f90dd7d1d80d981bb5926c211fee693e2f780e465fb34370e2980704daf38862e9e7f57af9e17aeeb1ccb28215fb61cd8e7a20422f9d3dad8cb0203010001a381b03081ad300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff302b0603551d1004243022800f32303036313132373230323334325a810f32303236313132373230353334325a301f0603551d230418301680146890e467a4a65380c78666a4f1f74b43fb84bd6d301d0603551d0e041604146890e467a4a65380c78666a4f1f74b43fb84bd6d301d06092a864886f67d0741000410300e1b0856372e313a342e3003020490300d06092a864886f70d0101050500038201010093d430b0d703202ad0f963e8910c0520a95f19ca7b724ed4b1dbd096fb545a192c0c08f7b2bc85a89d7f6d3b52b32adbe7d4848c63f60fcb260191506cf45f14e29374c0139e303a50e3b460c51cf022448d7147acc81ac9e99b9a006013ff707e5f114d491bb315527bc954dabf9d95af6b9ad89ee9f1e4438de211443abfafbd834273528baabba729cff5641c0a4dd1bcaaac9f2ad0ff7f7fda7deab1ed3025c184da34d25b788356ec9c36c326e211f667491d92ab8cfbebff7aee854aa75080f0a75c4a942e5f05993c5241e0cdb463cf0143ba9c83dc8f603bf35ab4b47baeda0b903875ef811d66d2f7577036b3bffc28af7125855b13fe1e7f5ab43c updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1B2364FD4D4F52E89B2D0FAF33E4D62BD969921\Blob = 030000000100000014000000b1b2364fd4d4f52e89b2d0faf33e4d62bd969921090000000100000048000000304606082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b0601050507030606082b060105050703070b000000010000003a00000053006f0075007400680020004100660072006900630061006e00200050006f007300740020004f0066006600690063006500200043004100000020000000010000003d0600003082063930820421a003020102020102300d06092a864886f70d01010505003081ce310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311630140603550407130d536f6d65727365742057657374312a3028060355040a1321536f757468204166726963616e20506f7374204f6666696365204c696d69746564311a3018060355040b13115341504f2054727573742043656e747265311d301b060355040313145341504f20436c617373203320526f6f742043413129302706092a864886f70d010901161a706b6961646d696e40747275737463656e7472652e636f2e7a61301e170d3130303931353030303030305a170d3330303931343030303030305a3081ce310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311630140603550407130d536f6d65727365742057657374312a3028060355040a1321536f757468204166726963616e20506f7374204f6666696365204c696d69746564311a3018060355040b13115341504f2054727573742043656e747265311d301b060355040313145341504f20436c617373203320526f6f742043413129302706092a864886f70d010901161a706b6961646d696e40747275737463656e7472652e636f2e7a6130820222300d06092a864886f70d01010105000382020f003082020a0282020100ca781a07bcf6fbb4b789bcd01956382a599d07ea1af9f8f868675e8fefcaf7f56a89e6a3957fa9db29241c35d038966c3e5624ff5e6251902e87e89cc7dabc33f19ea16f0b8e0a24f4f84d90a6b2cd5e11d3c2974cf55f401d26244d8d09100bffbb201b9326190c433fe98ebc3137106e91ca48825646c7bcb93a9e468166cfd9e85c10cf399e65c39ec55af44bcc44996686f4721ba35349eaae47cd320d70e6a0a076079dff58efe43c91c0b5e4dcb8010cd3feb342a03b6102d4375bd74c4595d2755df56e305f57518bb2ff7ec88b9caaa341370c1091a8a6855cb9c78f0551b2d078d2e24b49e9d41aa73bacaa33e69a2a0340986f7452133194d112c1b4cb30f9ff44b8925b52d630d933d175e319a51615b75457f15650ce4ebe033b2fecb630ee14605e5f7a35f44e640711eaa507661b6e93e2b04f5ed6e044e0b3dcaeefb8fda8b3ecece5398844b4a1bb1460648fd69293cbf3cc50dde907c86767f9f0878491b20062e9bf4a1574c5bf044c05465d0acbe5ea6100e16f41b1348ea600a27ca6a5a6fa6c4c43e5a8269a34981e8798e74c78d18f9f05555d8a4bc9cfa00b7d06909c1892b2c4b2d7e345d96b73c39739bf291e06095540babcda487543edfe447e3d2ce6629103fd3d89ef7ef45d248fa50b2bb33e7a2928bcbb3fbfeb778504268b94b290f5eb8d4fa2442250a89c2a4448007819ab9d0896150203010001a320301e300e0603551d0f0101ff040403020106300c0603551d13040530030101ff300d06092a864886f70d0101050500038202010045c99ea4602589fe9799b8c2f1aed735133679d0dd822251f14cf66336a10d5b20f21b85d6768f790fababa2c837b82963ece59eb67896a6ff8a109e146e1a6ddf5e9bb92c857209f2371a9b79b328efe596dd469b878c8df8418c14e1ad455fcba7240cc137ba2c02c4ab8c353809e990f16672a5914279090a144e9a749645a12f20a497742acb01b3cb562ade2c585f176762be2bba11132d10404561f0c3c5ef8f19d03ac2650ad968e89c062037ba9f4b16396078e0756255c0d9cb372109109039cf5c99ecdfacd65a474123abb8a721079214ac8cda8a2416eb148848bcef81ce8e16df3dd25a6f9fc041712589062ce6bc4feda491f3c6ed54ddd9930322aa8407a873dba75a894df6ed7280eb837844a922246898b13fa941f2ece904a422335fe675dcbd9e25f5e364651ec1f357272ec9c0327844dbd8381376e11d7fe017879a7f4d4b076eb8573885b9e9534e973a0d1f53b981724546f3c87ea609ee1834757e87e7e820eedc16d4e6c784aada6f5f9ccceb580641938ce5cc590c6865393c291661f169fb47b9c2d86781240bf4fc496200af07a3ff9ea00ec3018b2167d63b1b3ce0a1b76ddc554be3d02e9dd69eca6ebab3baf0607e7f0550e341f1be403a9057e02d696c0bc1bc7ac18efb09deea957f399bc3639f49f578af7e4982ac9f6e8c121a50b6c0e3dc8482d8ebd2bb0e5d368602492b053b57 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54\Blob = 190000000100000010000000ad6d6ff31b24013151f279e26a8c33240f000000010000002000000017fe16f394ec70a5bb0c6784cab40b1e61025ae9d50ecaa0531d6b4d997bbc5953000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c00b000000010000006000000056006500720069005300690067006e00200055006e006900760065007200730061006c00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080300000001000000140000003679ca35668772304d30a5fb873b0fa77bb70d54140000000100000014000000b677fa6948479f5312d5c2ea07327607d19707192000000001000000bd040000308204b9308203a1a0030201020210401ac46421b31321030ebbe4121ac51d300d06092a864886f70d01010b05003081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f72697479301e170d3038303430323030303030305a170d3337313230313233353935395a3081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c761375eb10134db62d7159bff585a8c2323d6608e91d79098837ae65819388cc5f6e56485b4a271fbedbdb9dacd4d00b4c82d73a5c76971951f393cb244079ce80efa4d4ac421df29618f32226182c5871f6e8c7c5f16205144d1704f57eae31ce3cc79ee58d80ec2b34593c02ce79a172b7b00377a413378e133e2f3101a7f872cbef6f5f742e2e5bf8762895f004bdfc5dde4754432413a1e716e69cb0b754608d1cad22b95d0cffbb9406b648c574dfc13117984ed5e54f6349f0801f3102506174adaf11d7a666b986066a4d9efd22e82f1f0ef09ea44c9156ae2036e33d3ac9f5500c7f6086a94b95fdce033f18460f95b2711b4fc16f2bb566a80258d0203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e04160414b677fa6948479f5312d5c2ea07327607d1970719300d06092a864886f70d01010b050003820101004af8f8b003e62c677be4947763cc6e4cf97d0e0ddcc8b935b9704f63fa24fa6c838c479d3b63f39af976329591b177bcac9abeb1e43121c68195565a0eb1c2d4b1a659acf163cbb84c1d59904aef9016281f5aae10fb8150380c6cccf13dc3f563e3b3e321c92439e9fd156646f41b11d04d73a37d46f93deda85f62d4f13ff8e074572b189d81b4c428da9497a570ebac1dbe0711f0d5dbdde58cf0d532b083e657e28fbfbea1aabf3d1db5d438ead7b05c3a4f6a3f8fc0666c63aae9d9a416f481d195140e7dcd9534d9d28f7073817b9c7ebd9861d845879890c5eb8630c635bff0ffc35588834bef05920671f2b89893b7eccd8261f138e64f97982a5a8d cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\84F2E3DD83133EA91D19527F02D729BFC15FE667\Blob = 0f0000000100000030000000701fb48f98fc1287d2c93066d72f28290d85fdd7bd356decc800721f981c04433503b31276abd53a1ade353da0c3a0040b000000010000007a000000530079006d0061006e00740065006300200043006c006100730073002000310020005000750062006c006900630020005000720069006d006100720079002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790020002d002000470034000000090000000100000016000000301406082b0601050507030206082b0601050507030403000000010000001400000084f2e3dd83133ea91d19527f02d729bfc15fe6672000000001000000ac020000308202a83082022da0030201020210216e33a5cbd388a46f2907b4273cc4d8300a06082a8648ce3d040303308194310b3009060355040613025553311d301b060355040a131453796d616e74656320436f72706f726174696f6e311f301d060355040b131653796d616e746563205472757374204e6574776f726b314530430603550403133c53796d616e74656320436c6173732031205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204734301e170d3131313030353030303030305a170d3338303131383233353935395a308194310b3009060355040613025553311d301b060355040a131453796d616e74656320436f72706f726174696f6e311f301d060355040b131653796d616e746563205472757374204e6574776f726b314530430603550403133c53796d616e74656320436c6173732031205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d2047343076301006072a8648ce3d020106052b8104002203620004d766b51bdbaeb360ee46ea8863753b2a946df35f12f6e30f9eb60a14534852c8dc3ab3cb482026124efa8984d4df91e4297d2801d9db184369a11fb5d38616dcc77f6723dfdf313183033570b14bb7c817bb51cbdc9417dbea093b7612deaab5a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041465c08d25f50cba9777903f9e2ee05af5ced5e1e4300a06082a8648ce3d0403030369003066023100a5aee34653f89836e322fa2e28490dee307e33f3ec3f715ecc55897899acb2fddc1c5c338e29b96b17c81168b5dc83070231009cc844da69c236c35419108502da9d47ef41e76c269d093df76d90d105442fb0bc839368f20c454939bf99041cd310a0 cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\EC0C3716EA9EDFADD35DFBD55608E60A05D3CBF3\Blob = 1900000001000000100000002b09c98d4e89a70a9d72e17a6f6bdf760f00000001000000140000008c88fe8a33fd9c47f91820978b2dbbc97feda69f030000000100000014000000ec0c3716ea9edfadd35dfbd55608e60a05d3cbf3090000000100000016000000301406082b0601050507030406082b060105050703010b00000001000000460000004400530054002000280055006e0069007400650064002000500061007200630065006c00200053006500720076006900630065002900200052006f006f007400430041000000140000000100000014000000acc2c9a7327eadb44f1bcc3cfbb19c66de3579fb2000000001000000fc030000308203f8308202e0021100d01e408b0000027c0000000700000001300d06092a864886f70d01010505003081b9310b3009060355040613027573310d300b0603550408130455746168311730150603550407130e53616c74204c616b65204369747931243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311e301c060355040b1315556e697465642050617263656c2053657276696365311930170603550403131044535420285550532920526f6f7443413121301f06092a864886f70d010901161263614064696773696774727573742e636f6d301e170d3938313231303030323534365a170d3038313230373030323534365a3081b9310b3009060355040613027573310d300b0603550408130455746168311730150603550407130e53616c74204c616b65204369747931243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311e301c060355040b1315556e697465642050617263656c2053657276696365311930170603550403131044535420285550532920526f6f7443413121301f06092a864886f70d010901161263614064696773696774727573742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100ef17ecaf29e6d92b27c0db7b249f66f404a3c2ad0acab0cd842baa37f380a160ef428fe55d775f574254dd2bdb61b2715e937b6f5feb242be7a4f2ebf173b30b8df559d732dfac908e4e31ba254db60ca6f1e5af0ce1e56f520315c1dfbe7e4aa6a61846703fefa74da8dcf574d9617a403ca19428eac29488cb371505193c9562ba1c2dfb288cd1c89e923c5b11543b78d9473b9b2d4ae63e7b6bdff4f605cf28f6ba9836009e3c37850a9cdeb7a485c563fdb762146d171ecc8a8085423211b021e29d77c98016419eebe514897fb7c3bc4fc19f879b96ec63f6f990560e95a3230a8c64da9bbb1c77b04c5de6c8e8f57d792d57243fcce33d2c98cf129f170203010001300d06092a864886f70d01010505000382010100bb388e042226580e214456ccbd597c2968cb5c0fc886543f8178a7ad8fcc46f71c54b8792d5b72056ae821d0ec1d1dfea43451beeeedcecc9c1668e25d7573084331916a102b10c24b69f8c9ad98a8fdb8eff6abf05f21efcb856b09ed2f4866b56072c0e8a0c798db0ef71b738d34080a7bc57762aa30239bb01e8b809854dc0587b3a96259fc8bb7159aac44eccf351af70f2e5d924b01c87beea037ede41d820d99414317add4d5cae3f97d17a201d0300f40b9dcb904826983b6f90ffa0692f7a8f4d6171cf05e7fc429c8e6e1e2ff36682151aeffa9ba8492ad8a7b33d890d2c1796d33333974ac1b38719f2c0790ea1de0d3895fcbef148d2754a5bd46 cefutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABB51672400588E6419F1D40878D0403AA20264\Blob = 190000000100000010000000f3af8d55433588c257d4d05c06e441790f0000000100000014000000729d4c00652fdac523063a9456b6183e82ea2ca7030000000100000014000000cabb51672400588e6419f1d40878d0403aa20264090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000006c0000004a006100700061006e002000430065007200740069006600690063006100740069006f006e002000530065007200760069006300650073002c00200049006e0063002e0020005300650063007500720065005300690067006e00200052006f006f0074004300410031000000140000000100000014000000d16979e28a65374d9148b42e43d06aa7a316705820000000010000002d030000308203293082021102085f60585f00000000300d06092a864886f70d01010505003057310b3009060355040613024a50312b3029060355040a13224a6170616e2043657274696669636174696f6e2053657276696365732c20496e632e311b3019060355040313125365637572655369676e20526f6f74434131301e170d3939303931353135303030315a170d3230303931353134353935395a3057310b3009060355040613024a50312b3029060355040a13224a6170616e2043657274696669636174696f6e2053657276696365732c20496e632e311b3019060355040313125365637572655369676e20526f6f7443413130820122300d06092a864886f70d01010105000382010f003082010a028201010094900c4b71291cdaf668797aa4bae7d2cc8dafe84790991fc62aea9763e81fce1757c61ab3a8c77c87ed353580baba6e6dbe17fecc2d1b6cef8a004916e1ee065e4a075dab3dd150b89146d4d4da15d8945c0ecad7dabfa0f7493cc8bbceea26810a142d9c0d37456b41ca578b38f0261f31fccf348e8f77c13fe3ab543c27b4ce324c551362fcfe3a1625cf1b6ba223b7e0ea0269bbf722716d7c0b1993a1979ce391691f68e42f7d106d8f67aec110a2b05e634a97f7e678a9ad26bb54c9dfb4eec59ed325dd136853f98fe8ece5de81d6783eee5040b4013cac15c1823b2e7ff152278b72e0e7dbf98b29c3c34a2b3389ab5c2a07fc7c231e2b4f0822fec10203010001300d06092a864886f70d0101050500038201010055ed6f7b93e545314e68d55581a2081f6cdd09c5781a7057c8df0881ae6677c6750fe4ef498b035c6cff1c90a472b2d31612b206f84686aebfa715db854dfac22d4db3b5b043ef7c7e07db5fb357465176078644fd07eaf1cb4b454d66a73326c4f943aa8d12b3d48d68b6f70279b42d5ad70398042c6999aff4663b64acb2c02bc869549e4c4e48188dce57b53b51e51bd7fa3960db564513bee766d523f67c4800b04cef348d22acb22ed14c38cdfa580306ee3a73870a053acae4afd4c1ee1c857f2516cf27011f848a7708d0d346e820ec9fa48cf1bccdc41236801ec70928afe808bec0d3b23ed72e673da3cebb34fae285cdacce551d455b7885d3857a cefutil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\36B12B49F9819ED74C9EBC380FC6568F5DACB2F7 updroots.exe -
NTFS ADS 5 IoCs
Processes:
msedge.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 859214.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 133239.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 295964.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 999792.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 206065.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe360TS_Setup.exepid process 3420 msedge.exe 3420 msedge.exe 1920 msedge.exe 1920 msedge.exe 2892 identity_helper.exe 2892 identity_helper.exe 2360 msedge.exe 2360 msedge.exe 5972 msedge.exe 5972 msedge.exe 5692 msedge.exe 5692 msedge.exe 4768 msedge.exe 4768 msedge.exe 5164 msedge.exe 5164 msedge.exe 5164 msedge.exe 5164 msedge.exe 5512 msedge.exe 5512 msedge.exe 5524 msedge.exe 5524 msedge.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe 3004 360TS_Setup.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3432 Explorer.EXE -
Suspicious behavior: LoadsDriver 35 IoCs
Processes:
360TS_Setup.exeQHActiveDefense.exeQHSafeMain.exepid process 656 656 3004 360TS_Setup.exe 3004 360TS_Setup.exe 656 656 656 656 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe 656 656 3644 QHActiveDefense.exe 656 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe 3644 QHActiveDefense.exe 656 656 3644 QHActiveDefense.exe 656 4268 QHSafeMain.exe 4268 QHSafeMain.exe 4268 QHSafeMain.exe 4268 QHSafeMain.exe 656 656 656 656 656 656 656 -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs
Processes:
msedge.exepid process 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
360TS_Setup_Mini_WW.Bing.CPI202305_6.6.0.1054.exe360TS_Setup.exeQHActiveDefense.exeQHActiveDefense.exeQHSafeTray.exeQHSafeMain.exe360InstantSetup.exeExplorer.EXEdescription pid process Token: SeManageVolumePrivilege 4248 360TS_Setup_Mini_WW.Bing.CPI202305_6.6.0.1054.exe Token: SeLoadDriverPrivilege 3004 360TS_Setup.exe Token: SeLoadDriverPrivilege 3004 360TS_Setup.exe Token: SeDebugPrivilege 3004 360TS_Setup.exe Token: SeDebugPrivilege 3004 360TS_Setup.exe Token: SeDebugPrivilege 4264 QHActiveDefense.exe Token: SeLoadDriverPrivilege 3644 QHActiveDefense.exe Token: SeLoadDriverPrivilege 3644 QHActiveDefense.exe Token: SeLoadDriverPrivilege 3644 QHActiveDefense.exe Token: SeLoadDriverPrivilege 3644 QHActiveDefense.exe Token: SeShutdownPrivilege 3184 QHSafeTray.exe Token: SeCreatePagefilePrivilege 3184 QHSafeTray.exe Token: SeBackupPrivilege 3184 QHSafeTray.exe Token: SeSecurityPrivilege 3184 QHSafeTray.exe Token: SeSecurityPrivilege 3184 QHSafeTray.exe Token: SeLoadDriverPrivilege 3644 QHActiveDefense.exe Token: SeDebugPrivilege 3644 QHActiveDefense.exe Token: SeLoadDriverPrivilege 3644 QHActiveDefense.exe Token: SeLoadDriverPrivilege 3644 QHActiveDefense.exe Token: SeLoadDriverPrivilege 3644 QHActiveDefense.exe Token: SeLoadDriverPrivilege 3644 QHActiveDefense.exe Token: SeDebugPrivilege 3184 QHSafeTray.exe Token: SeDebugPrivilege 3644 QHActiveDefense.exe Token: SeDebugPrivilege 3184 QHSafeTray.exe Token: SeIncreaseQuotaPrivilege 4268 QHSafeMain.exe Token: SeDebugPrivilege 4268 QHSafeMain.exe Token: SeSecurityPrivilege 4268 QHSafeMain.exe Token: SeShutdownPrivilege 4268 QHSafeMain.exe Token: SeIncreaseQuotaPrivilege 4268 QHSafeMain.exe Token: SeDebugPrivilege 4268 QHSafeMain.exe Token: SeSecurityPrivilege 4268 QHSafeMain.exe Token: SeShutdownPrivilege 4268 QHSafeMain.exe Token: SeManageVolumePrivilege 3764 360InstantSetup.exe Token: SeManageVolumePrivilege 3764 360InstantSetup.exe Token: SeShutdownPrivilege 3432 Explorer.EXE Token: SeCreatePagefilePrivilege 3432 Explorer.EXE Token: SeShutdownPrivilege 3432 Explorer.EXE Token: SeCreatePagefilePrivilege 3432 Explorer.EXE Token: SeShutdownPrivilege 3432 Explorer.EXE Token: SeCreatePagefilePrivilege 3432 Explorer.EXE Token: SeShutdownPrivilege 3432 Explorer.EXE Token: SeCreatePagefilePrivilege 3432 Explorer.EXE Token: SeShutdownPrivilege 3432 Explorer.EXE Token: SeCreatePagefilePrivilege 3432 Explorer.EXE Token: SeShutdownPrivilege 3432 Explorer.EXE Token: SeCreatePagefilePrivilege 3432 Explorer.EXE Token: SeShutdownPrivilege 3432 Explorer.EXE Token: SeCreatePagefilePrivilege 3432 Explorer.EXE Token: SeShutdownPrivilege 3432 Explorer.EXE Token: SeCreatePagefilePrivilege 3432 Explorer.EXE Token: SeShutdownPrivilege 3432 Explorer.EXE Token: SeCreatePagefilePrivilege 3432 Explorer.EXE Token: SeShutdownPrivilege 3432 Explorer.EXE Token: SeCreatePagefilePrivilege 3432 Explorer.EXE Token: SeShutdownPrivilege 3432 Explorer.EXE Token: SeCreatePagefilePrivilege 3432 Explorer.EXE Token: SeShutdownPrivilege 3432 Explorer.EXE Token: SeCreatePagefilePrivilege 3432 Explorer.EXE Token: SeShutdownPrivilege 3432 Explorer.EXE Token: SeCreatePagefilePrivilege 3432 Explorer.EXE Token: SeShutdownPrivilege 3432 Explorer.EXE Token: SeCreatePagefilePrivilege 3432 Explorer.EXE Token: SeShutdownPrivilege 3432 Explorer.EXE Token: SeCreatePagefilePrivilege 3432 Explorer.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exe360TS_Setup_Mini_WW.Bing.CPI202305_6.6.0.1054.exepid process 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 4248 360TS_Setup_Mini_WW.Bing.CPI202305_6.6.0.1054.exe 4248 360TS_Setup_Mini_WW.Bing.CPI202305_6.6.0.1054.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
msedge.exe360TS_Setup_Mini_WW.Bing.CPI202305_6.6.0.1054.exeQHSafeTray.exePopWndLog.exe360InstantSetup.exeExplorer.EXEpid process 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 4248 360TS_Setup_Mini_WW.Bing.CPI202305_6.6.0.1054.exe 4248 360TS_Setup_Mini_WW.Bing.CPI202305_6.6.0.1054.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 4248 360TS_Setup_Mini_WW.Bing.CPI202305_6.6.0.1054.exe 3184 QHSafeTray.exe 3184 QHSafeTray.exe 4780 PopWndLog.exe 3184 QHSafeTray.exe 3184 QHSafeTray.exe 3764 360InstantSetup.exe 3764 360InstantSetup.exe 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE -
Suspicious use of SetWindowsHookEx 23 IoCs
Processes:
360TS_Setup.exe360TS_Setup.exeWscReg.exeQHActiveDefense.exeQHSafeTray.exePopWndLog.exeQHActiveDefense.exeKB931125-rootsupd.exeupdroots.exeupdroots.exeupdroots.exeupdroots.exeQHSafeMain.exePromoUtil.exe360InstantSetup.exe360boxmain.execefutil.exePopWndTracker.exePopWndTracker.exeNetworkMon.exepid process 5460 360TS_Setup.exe 3004 360TS_Setup.exe 828 WscReg.exe 4264 QHActiveDefense.exe 3184 QHSafeTray.exe 3184 QHSafeTray.exe 4780 PopWndLog.exe 3644 QHActiveDefense.exe 3448 KB931125-rootsupd.exe 4716 updroots.exe 4328 updroots.exe 4456 updroots.exe 5180 updroots.exe 4268 QHSafeMain.exe 512 PromoUtil.exe 3764 360InstantSetup.exe 6912 360boxmain.exe 7328 cefutil.exe 4280 PopWndTracker.exe 4280 PopWndTracker.exe 6460 PopWndTracker.exe 6460 PopWndTracker.exe 1268 NetworkMon.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1920 wrote to memory of 3080 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 3080 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 2876 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 3420 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 3420 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 372 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 372 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 372 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 372 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 372 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 372 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 372 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 372 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 372 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 372 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 372 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 372 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 372 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 372 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 372 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 372 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 372 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 372 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 372 1920 msedge.exe msedge.exe PID 1920 wrote to memory of 372 1920 msedge.exe msedge.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 64 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid process 7784 10216 attrib.exe 10688 attrib.exe 2724 attrib.exe 4264 7192 attrib.exe 13420 15236 6216 9956 attrib.exe 5556 attrib.exe 13124 attrib.exe 11512 attrib.exe 16788 10696 attrib.exe 15212 17060 18340 14040 attrib.exe 14112 14612 9064 3496 attrib.exe 2872 attrib.exe 2028 attrib.exe 12940 attrib.exe 17528 14560 8916 attrib.exe 12144 attrib.exe 7128 attrib.exe 3660 6000 attrib.exe 10756 attrib.exe 13832 attrib.exe 16224 10984 4364 17928 18520 4308 attrib.exe 1924 attrib.exe 8600 attrib.exe 14032 attrib.exe 17980 3908 attrib.exe 6264 attrib.exe 13540 15756 6964 16604 17812 11844 attrib.exe 11688 attrib.exe 13104 8784 8404 attrib.exe 16096 2468 18076 13824 attrib.exe 7344 5684 attrib.exe 5500 attrib.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:3432 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\.html2⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae23946f8,0x7ffae2394708,0x7ffae23947183⤵PID:3080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:23⤵PID:2876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:3420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:83⤵PID:372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:13⤵PID:3952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:13⤵PID:3684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:13⤵PID:4952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:13⤵PID:4036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:13⤵PID:1904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:83⤵PID:5668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:13⤵PID:1064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:13⤵PID:1072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:13⤵PID:4428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:13⤵PID:3904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:13⤵PID:5152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:13⤵PID:3664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:13⤵PID:4532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5452 /prefetch:83⤵PID:3964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5892 /prefetch:83⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:13⤵PID:3188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5824 /prefetch:83⤵PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:13⤵PID:3720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6516 /prefetch:83⤵PID:3840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:5972
-
-
C:\Users\Admin\Downloads\360TS_Setup_Mini_WW.Bing.CPI202305_6.6.0.1054.exe"C:\Users\Admin\Downloads\360TS_Setup_Mini_WW.Bing.CPI202305_6.6.0.1054.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4248 -
C:\Users\Admin\Downloads\360TS_Setup.exe"C:\Users\Admin\Downloads\360TS_Setup.exe" /c:WW.Bing.CPI202305 /pmode:2 /syncid0_2 /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo=4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5460 -
C:\Program Files (x86)\1715698371_0\360TS_Setup.exe"C:\Program Files (x86)\1715698371_0\360TS_Setup.exe" /c:WW.Bing.CPI202305 /pmode:2 /syncid0_2 /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall5⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3004 -
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set {bootmgr} flightsigning on6⤵
- Modifies boot configuration data using bcdedit
PID:1336
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set flightsigning on6⤵
- Modifies boot configuration data using bcdedit
PID:5012
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\Total Security\MenuEx64.dll"6⤵
- Loads dropped DLL
PID:876 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\360\Total Security\MenuEx64.dll"7⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Registers COM server for autorun
- Modifies registry class
PID:544
-
-
-
C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe"C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe" /flightsigning6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:372
-
-
C:\Program Files (x86)\360\Total Security\safemon\WscReg.exe"C:\Program Files (x86)\360\Total Security\safemon\WscReg.exe" /installsrv6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:828
-
-
C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe"C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe" /install6⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4264
-
-
C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe"C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe"6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst7⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:4716
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst7⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:4328
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4456
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5180
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:13⤵PID:4440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:13⤵PID:4260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1792 /prefetch:13⤵PID:3892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:13⤵PID:5060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:13⤵PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:13⤵PID:4364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6956 /prefetch:13⤵PID:2464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:13⤵PID:4460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4044 /prefetch:83⤵PID:5500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:13⤵PID:5348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4980 /prefetch:83⤵PID:4076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6224 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:5692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6492 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:13⤵PID:4240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5876 /prefetch:83⤵PID:1372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6004 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:5164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7336 /prefetch:83⤵PID:3024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4692 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:5512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,1308632891412632347,4291933163017375555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7484 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:5524
-
-
-
C:\Users\Admin\Desktop\NJRat.exe"C:\Users\Admin\Desktop\NJRat.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
PID:4812 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\Desktop\NJRat.exe" "NJRat.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:4868
-
-
-
C:\Users\Admin\Desktop\CrimsonRAT.exe"C:\Users\Admin\Desktop\CrimsonRAT.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:5000 -
C:\ProgramData\Hdlharas\dlrarhsiva.exe"C:\ProgramData\Hdlharas\dlrarhsiva.exe"3⤵
- Executes dropped EXE
PID:2296
-
-
-
C:\Users\Admin\Desktop\Blackkomet.exe"C:\Users\Admin\Desktop\Blackkomet.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
PID:3076 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:1444
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\Desktop\Blackkomet.exe" +s +h3⤵
- Sets file to hidden
PID:1232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\Desktop" +s +h3⤵PID:5696
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"3⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1456 -
C:\Windows\SysWOW64\notepad.exenotepad4⤵PID:1628
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h4⤵PID:376
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h4⤵PID:6460
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"4⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3648 -
C:\Windows\SysWOW64\notepad.exenotepad5⤵
- Adds Run key to start application
PID:740
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h5⤵PID:6400
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h5⤵PID:6404
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"5⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:6520 -
C:\Windows\SysWOW64\notepad.exenotepad6⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:6508
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h6⤵PID:6876
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h6⤵
- Views/modifies file attributes
PID:5684
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"6⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:6944 -
C:\Windows\SysWOW64\notepad.exenotepad7⤵
- Adds Run key to start application
PID:7340
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h7⤵PID:884
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h7⤵PID:7724
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"7⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
PID:7704 -
C:\Windows\SysWOW64\notepad.exenotepad8⤵
- Adds Run key to start application
PID:7732
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h8⤵PID:7284
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h8⤵PID:5264
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"8⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
PID:7640 -
C:\Windows\SysWOW64\notepad.exenotepad9⤵
- Adds Run key to start application
PID:7384
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h9⤵PID:7852
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h9⤵PID:8068
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"9⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
PID:5020 -
C:\Windows\SysWOW64\notepad.exenotepad10⤵
- Adds Run key to start application
PID:2604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h10⤵
- Sets file to hidden
PID:2208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h10⤵
- Drops file in System32 directory
PID:4448
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"10⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:5140 -
C:\Windows\SysWOW64\notepad.exenotepad11⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:3316
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h11⤵PID:1252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h11⤵PID:6420
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"11⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1456 -
C:\Windows\SysWOW64\notepad.exenotepad12⤵
- Adds Run key to start application
PID:4768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h12⤵PID:1216
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h12⤵PID:6300
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV113⤵PID:6404
-
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"12⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:7116 -
C:\Windows\SysWOW64\notepad.exenotepad13⤵
- Adds Run key to start application
PID:7592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h13⤵PID:7712
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h13⤵PID:7284
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV114⤵PID:5264
-
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"13⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:1656 -
C:\Windows\SysWOW64\notepad.exenotepad14⤵PID:872
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h14⤵PID:2996
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h14⤵
- Drops file in System32 directory
PID:824
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"14⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:4672 -
C:\Windows\SysWOW64\notepad.exenotepad15⤵PID:3680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h15⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3908
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h15⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:4308
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"15⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:6796 -
C:\Windows\SysWOW64\notepad.exenotepad16⤵
- Adds Run key to start application
PID:7388
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h16⤵
- Drops file in System32 directory
PID:6176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h16⤵PID:4088
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"16⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in System32 directory
PID:916 -
C:\Windows\SysWOW64\notepad.exenotepad17⤵
- Drops file in System32 directory
PID:3944
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h17⤵PID:608
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h17⤵
- Drops file in System32 directory
PID:4796
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"17⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in System32 directory
PID:3272 -
C:\Windows\SysWOW64\notepad.exenotepad18⤵
- Adds Run key to start application
PID:6096
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h18⤵
- Sets file to hidden
PID:6152
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h18⤵
- Sets file to hidden
PID:6744
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"18⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:5116 -
C:\Windows\SysWOW64\notepad.exenotepad19⤵
- Adds Run key to start application
PID:5140
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h19⤵PID:5468
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h19⤵PID:6560
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"19⤵
- Modifies WinLogon for persistence
- Checks computer location settings
PID:7176 -
C:\Windows\SysWOW64\notepad.exenotepad20⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:6040
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h20⤵PID:4372
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h20⤵PID:5288
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"20⤵
- Modifies WinLogon for persistence
- Checks computer location settings
PID:3004 -
C:\Windows\SysWOW64\notepad.exenotepad21⤵
- Adds Run key to start application
PID:6712 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6712 -s 37622⤵
- Program crash
PID:3628
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h21⤵
- Views/modifies file attributes
PID:1924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h21⤵PID:1980
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"21⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:5372 -
C:\Windows\SysWOW64\notepad.exenotepad22⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:6680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h22⤵PID:7712
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h22⤵
- Sets file to hidden
PID:5576
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"22⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Modifies registry class
PID:2876 -
C:\Windows\SysWOW64\notepad.exenotepad23⤵
- Adds Run key to start application
PID:1860
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h23⤵PID:1584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h23⤵PID:6052
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"23⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:6964 -
C:\Windows\SysWOW64\notepad.exenotepad24⤵PID:6260
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h24⤵PID:6416
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h24⤵PID:972
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"24⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies registry class
PID:3648 -
C:\Windows\SysWOW64\notepad.exenotepad25⤵
- Adds Run key to start application
PID:1176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h25⤵PID:2112
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h25⤵
- Drops file in System32 directory
PID:6540
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"25⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Modifies registry class
PID:6460 -
C:\Windows\SysWOW64\notepad.exenotepad26⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:7220
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h26⤵PID:1168
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h26⤵PID:7260
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"26⤵
- Modifies WinLogon for persistence
- Checks computer location settings
PID:3148 -
C:\Windows\SysWOW64\notepad.exenotepad27⤵PID:224
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h27⤵
- Drops file in System32 directory
PID:6004
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h27⤵
- Sets file to hidden
PID:8100
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"27⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Modifies registry class
PID:1180 -
C:\Windows\SysWOW64\notepad.exenotepad28⤵
- Drops file in System32 directory
PID:8168
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h28⤵PID:5540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h28⤵
- Sets file to hidden
PID:4568
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"28⤵
- Modifies WinLogon for persistence
- Checks computer location settings
PID:4088 -
C:\Windows\SysWOW64\notepad.exenotepad29⤵
- Drops file in System32 directory
PID:6940
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h29⤵PID:3968
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h29⤵PID:7880
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"29⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:6996 -
C:\Windows\SysWOW64\notepad.exenotepad30⤵PID:6416
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h30⤵PID:1356
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h30⤵PID:6220
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"30⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
PID:3088 -
C:\Windows\SysWOW64\notepad.exenotepad31⤵
- Adds Run key to start application
PID:2000
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h31⤵PID:3460
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h31⤵PID:6120
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"31⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:6620 -
C:\Windows\SysWOW64\notepad.exenotepad32⤵
- Adds Run key to start application
PID:6572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h32⤵PID:3484
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV133⤵PID:3148
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h32⤵PID:4256
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"32⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Modifies registry class
PID:2476 -
C:\Windows\SysWOW64\notepad.exenotepad33⤵
- Adds Run key to start application
PID:3028
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h33⤵PID:2508
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h33⤵PID:6924
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"33⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
PID:7272 -
C:\Windows\SysWOW64\notepad.exenotepad34⤵PID:5616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 8835⤵
- Program crash
PID:7432
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h34⤵PID:3544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h34⤵PID:6552
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"34⤵
- Modifies WinLogon for persistence
- Checks computer location settings
PID:2276 -
C:\Windows\SysWOW64\notepad.exenotepad35⤵PID:7040
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h35⤵PID:6924
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV136⤵PID:7724
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h35⤵
- Sets file to hidden
PID:6788 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV136⤵PID:2508
-
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"35⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:6352 -
C:\Windows\SysWOW64\notepad.exenotepad36⤵PID:884
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h36⤵PID:4308
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h36⤵
- Views/modifies file attributes
PID:3496
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"36⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
PID:732 -
C:\Windows\SysWOW64\notepad.exenotepad37⤵
- Adds Run key to start application
PID:1716
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h37⤵PID:1952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h37⤵PID:5616
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"37⤵
- Modifies WinLogon for persistence
- Checks computer location settings
PID:7768 -
C:\Windows\SysWOW64\notepad.exenotepad38⤵
- Adds Run key to start application
PID:6236
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h38⤵PID:2160
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h38⤵
- Drops file in System32 directory
PID:6816 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵PID:6460
-
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"38⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
PID:4260 -
C:\Windows\SysWOW64\notepad.exenotepad39⤵
- Adds Run key to start application
PID:4368
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h39⤵
- Drops file in System32 directory
PID:2400 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV140⤵PID:2476
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h39⤵PID:7240
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"39⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
PID:8240 -
C:\Windows\SysWOW64\notepad.exenotepad40⤵
- Drops file in System32 directory
PID:8304
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h40⤵PID:8320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h40⤵PID:8328
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"40⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:8472 -
C:\Windows\SysWOW64\notepad.exenotepad41⤵
- Drops file in System32 directory
PID:8520
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h41⤵PID:8536
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h41⤵
- Sets file to hidden
PID:8544
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"41⤵
- Modifies WinLogon for persistence
- Checks computer location settings
PID:2668 -
C:\Windows\SysWOW64\notepad.exenotepad42⤵
- Adds Run key to start application
PID:3656
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h42⤵PID:8108
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h42⤵
- Drops file in System32 directory
PID:1168
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"42⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
PID:4576 -
C:\Windows\SysWOW64\notepad.exenotepad43⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:4908
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h43⤵PID:212
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h43⤵PID:3380
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV144⤵PID:4308
-
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"43⤵
- Modifies WinLogon for persistence
- Checks computer location settings
PID:8228 -
C:\Windows\SysWOW64\notepad.exenotepad44⤵PID:5468
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h44⤵
- Drops file in System32 directory
PID:8296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h44⤵PID:8348
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"44⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:7356 -
C:\Windows\SysWOW64\notepad.exenotepad45⤵PID:8584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h45⤵
- Views/modifies file attributes
PID:8600
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h45⤵PID:8544
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"45⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:6476 -
C:\Windows\SysWOW64\notepad.exenotepad46⤵PID:5572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h46⤵PID:1036
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵PID:2668
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h46⤵
- Sets file to hidden
PID:8208
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"46⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Modifies registry class
PID:212 -
C:\Windows\SysWOW64\notepad.exenotepad47⤵
- Adds Run key to start application
PID:2016
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h47⤵
- Views/modifies file attributes
PID:6000
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h47⤵PID:5244
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"47⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Modifies registry class
PID:8724 -
C:\Windows\SysWOW64\notepad.exenotepad48⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:8900
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h48⤵
- Views/modifies file attributes
PID:8916
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h48⤵PID:8924
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"48⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:5624 -
C:\Windows\SysWOW64\notepad.exenotepad49⤵PID:8732
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h49⤵
- Sets file to hidden
PID:9000
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h49⤵PID:8952
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"49⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Modifies registry class
PID:8244 -
C:\Windows\SysWOW64\notepad.exenotepad50⤵PID:9112
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h50⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:8404
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h50⤵PID:8780
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"50⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in System32 directory
PID:9192 -
C:\Windows\SysWOW64\notepad.exenotepad51⤵PID:9080
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h51⤵PID:4280
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h51⤵PID:5284
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"51⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:9072 -
C:\Windows\SysWOW64\notepad.exenotepad52⤵
- Adds Run key to start application
PID:7916
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h52⤵PID:7540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h52⤵
- Sets file to hidden
PID:2864
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"52⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:6136 -
C:\Windows\SysWOW64\notepad.exenotepad53⤵
- Adds Run key to start application
PID:6496
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h53⤵
- Drops file in System32 directory
PID:1036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h53⤵
- Drops file in System32 directory
PID:8096
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"53⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:8240 -
C:\Windows\SysWOW64\notepad.exenotepad54⤵
- Adds Run key to start application
PID:7028
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h54⤵
- Drops file in System32 directory
PID:6168
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h54⤵
- Sets file to hidden
PID:8860
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"54⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
PID:9040 -
C:\Windows\SysWOW64\notepad.exenotepad55⤵
- Adds Run key to start application
PID:9200
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h55⤵
- Drops file in System32 directory
PID:9056
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h55⤵PID:8892
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"55⤵
- Modifies WinLogon for persistence
- Checks computer location settings
PID:8696 -
C:\Windows\SysWOW64\notepad.exenotepad56⤵
- Adds Run key to start application
PID:8328
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h56⤵
- Drops file in System32 directory
PID:6708
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h56⤵PID:3864
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵PID:2160
-
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"56⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
PID:7876 -
C:\Windows\SysWOW64\notepad.exenotepad57⤵
- Adds Run key to start application
PID:1456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h57⤵PID:6480
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h57⤵
- Drops file in System32 directory
PID:7776
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"57⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in System32 directory
PID:2820 -
C:\Windows\SysWOW64\notepad.exenotepad58⤵PID:8592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h58⤵PID:5348
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h58⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:2872
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"58⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:1116 -
C:\Windows\SysWOW64\notepad.exenotepad59⤵
- Adds Run key to start application
PID:7320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h59⤵PID:1904
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV160⤵PID:8208
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h59⤵PID:4540
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"59⤵
- Modifies WinLogon for persistence
- Checks computer location settings
PID:8876 -
C:\Windows\SysWOW64\notepad.exenotepad60⤵
- Drops file in System32 directory
PID:4852
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h60⤵PID:6724
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h60⤵PID:8820
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"60⤵PID:5124
-
C:\Windows\SysWOW64\notepad.exenotepad61⤵PID:376
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h61⤵PID:5540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h61⤵PID:6708
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"61⤵PID:8608
-
C:\Windows\SysWOW64\notepad.exenotepad62⤵PID:8616
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h62⤵PID:4880
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h62⤵PID:7740
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"62⤵PID:8096
-
C:\Windows\SysWOW64\notepad.exenotepad63⤵PID:1036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h63⤵PID:1172
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV164⤵PID:2820
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h63⤵
- Sets file to hidden
PID:8476
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"63⤵PID:9020
-
C:\Windows\SysWOW64\notepad.exenotepad64⤵PID:8820
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h64⤵PID:9164
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵PID:4576
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h64⤵
- Views/modifies file attributes
PID:5500
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"64⤵PID:9084
-
C:\Windows\SysWOW64\notepad.exenotepad65⤵PID:7452
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h65⤵PID:5128
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV166⤵PID:5624
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h65⤵
- Sets file to hidden
PID:8296
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"65⤵PID:8324
-
C:\Windows\SysWOW64\notepad.exenotepad66⤵PID:8600
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h66⤵PID:8608
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h66⤵PID:6452
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"66⤵PID:3904
-
C:\Windows\SysWOW64\notepad.exenotepad67⤵PID:5500
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h67⤵
- Sets file to hidden
PID:7456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h67⤵PID:732
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"67⤵PID:6184
-
C:\Windows\SysWOW64\notepad.exenotepad68⤵PID:7760
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h68⤵PID:8408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h68⤵PID:544
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"68⤵PID:4404
-
C:\Windows\SysWOW64\notepad.exenotepad69⤵PID:8492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h69⤵PID:8296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h69⤵PID:7872
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"69⤵PID:9464
-
C:\Windows\SysWOW64\notepad.exenotepad70⤵PID:9588
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h70⤵PID:9604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h70⤵PID:9612
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"70⤵PID:10152
-
C:\Windows\SysWOW64\notepad.exenotepad71⤵PID:10224
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h71⤵PID:8408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h71⤵PID:8120
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"71⤵PID:9552
-
C:\Windows\SysWOW64\notepad.exenotepad72⤵PID:1852
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h72⤵PID:7924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h72⤵PID:7936
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"72⤵PID:10236
-
C:\Windows\SysWOW64\notepad.exenotepad73⤵PID:9484
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h73⤵PID:212
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h73⤵PID:9572
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"73⤵PID:10076
-
C:\Windows\SysWOW64\notepad.exenotepad74⤵PID:2488
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h74⤵PID:10064
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h74⤵
- Sets file to hidden
PID:10028
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"74⤵PID:9528
-
C:\Windows\SysWOW64\notepad.exenotepad75⤵PID:9692
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h75⤵PID:10180
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h75⤵
- Views/modifies file attributes
PID:10216
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"75⤵PID:9680
-
C:\Windows\SysWOW64\notepad.exenotepad76⤵PID:9508
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h76⤵PID:9660
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h76⤵PID:848
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"76⤵PID:840
-
C:\Windows\SysWOW64\notepad.exenotepad77⤵PID:10072
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h77⤵PID:7156
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h77⤵PID:3576
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"77⤵PID:10356
-
C:\Windows\SysWOW64\notepad.exenotepad78⤵PID:10404
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h78⤵PID:10420
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h78⤵PID:10428
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"78⤵PID:10752
-
C:\Windows\SysWOW64\notepad.exenotepad79⤵PID:10804
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h79⤵PID:10820
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h79⤵PID:10828
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"79⤵PID:11012
-
C:\Windows\SysWOW64\notepad.exenotepad80⤵PID:11076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h80⤵PID:11092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h80⤵PID:11100
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"80⤵PID:9788
-
C:\Windows\SysWOW64\notepad.exenotepad81⤵PID:9920
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h81⤵PID:9800
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h81⤵PID:10588
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"81⤵PID:10480
-
C:\Windows\SysWOW64\notepad.exenotepad82⤵PID:10548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10548 -s 8083⤵
- Program crash
PID:11008
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h82⤵PID:10816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h82⤵PID:5548
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"82⤵PID:10856
-
C:\Windows\SysWOW64\notepad.exenotepad83⤵PID:11068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h83⤵PID:6556
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h83⤵PID:11256
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"83⤵PID:9776
-
C:\Windows\SysWOW64\notepad.exenotepad84⤵PID:10880
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h84⤵PID:10828
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h84⤵PID:10980
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"84⤵PID:10264
-
C:\Windows\SysWOW64\notepad.exenotepad85⤵PID:9816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h85⤵PID:10180
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h85⤵PID:10872
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"85⤵PID:3544
-
C:\Windows\SysWOW64\notepad.exenotepad86⤵PID:10940
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h86⤵PID:9872
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h86⤵PID:10744
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"86⤵PID:10956
-
C:\Windows\SysWOW64\notepad.exenotepad87⤵PID:10252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h87⤵PID:4164
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h87⤵PID:10904
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"87⤵PID:6192
-
C:\Windows\SysWOW64\notepad.exenotepad88⤵PID:6172
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h88⤵PID:10864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h88⤵
- Views/modifies file attributes
PID:9956
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"88⤵PID:6556
-
C:\Windows\SysWOW64\notepad.exenotepad89⤵PID:11008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h89⤵PID:11088
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h89⤵PID:10464
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"89⤵PID:3648
-
C:\Windows\SysWOW64\notepad.exenotepad90⤵PID:10180
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h90⤵PID:8124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h90⤵PID:9748
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"90⤵PID:3544
-
C:\Windows\SysWOW64\notepad.exenotepad91⤵PID:9620
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h91⤵PID:7920
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h91⤵PID:9556
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV192⤵PID:7876
-
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"91⤵PID:11524
-
C:\Windows\SysWOW64\notepad.exenotepad92⤵PID:11580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h92⤵PID:11596
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h92⤵PID:11604
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"92⤵PID:11756
-
C:\Windows\SysWOW64\notepad.exenotepad93⤵PID:11828
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h93⤵
- Views/modifies file attributes
PID:11844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h93⤵PID:11852
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"93⤵PID:12080
-
C:\Windows\SysWOW64\notepad.exenotepad94⤵PID:12128
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h94⤵
- Views/modifies file attributes
PID:12144
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h94⤵PID:12152
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"94⤵PID:9572
-
C:\Windows\SysWOW64\notepad.exenotepad95⤵PID:11484
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h95⤵PID:11480
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h95⤵PID:11472
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"95⤵PID:7920
-
C:\Windows\SysWOW64\notepad.exenotepad96⤵PID:11744
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h96⤵PID:7228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h96⤵
- Views/modifies file attributes
PID:11688
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"96⤵PID:10616
-
C:\Windows\SysWOW64\notepad.exenotepad97⤵PID:11968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11968 -s 8098⤵
- Program crash
PID:12024
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h97⤵PID:11984
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h97⤵PID:11992
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"97⤵PID:7212
-
C:\Windows\SysWOW64\notepad.exenotepad98⤵PID:10676
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h98⤵
- Views/modifies file attributes
PID:10696
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h98⤵PID:10720
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"98⤵PID:9268
-
C:\Windows\SysWOW64\notepad.exenotepad99⤵PID:11480
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h99⤵PID:9396
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h99⤵PID:11404
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"99⤵PID:11604
-
C:\Windows\SysWOW64\notepad.exenotepad100⤵PID:10624
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h100⤵PID:11688
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h100⤵
- Views/modifies file attributes
PID:2028
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"100⤵PID:12184
-
C:\Windows\SysWOW64\notepad.exenotepad101⤵PID:12276
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h101⤵PID:5228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h101⤵PID:8552
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"101⤵PID:11476
-
C:\Windows\SysWOW64\notepad.exenotepad102⤵PID:6424
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h102⤵PID:10660
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h102⤵PID:10636
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"102⤵PID:11576
-
C:\Windows\SysWOW64\notepad.exenotepad103⤵PID:11172
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h103⤵PID:5968
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h103⤵PID:11012
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"103⤵PID:11464
-
C:\Windows\SysWOW64\notepad.exenotepad104⤵PID:5228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h104⤵PID:11424
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h104⤵PID:9668
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"104⤵PID:11892
-
C:\Windows\SysWOW64\notepad.exenotepad105⤵PID:12120
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h105⤵
- Views/modifies file attributes
PID:10688
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h105⤵PID:11984
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"105⤵PID:10636
-
C:\Windows\SysWOW64\notepad.exenotepad106⤵PID:8684
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h106⤵PID:11424
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h106⤵PID:7824
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"106⤵PID:7200
-
C:\Windows\SysWOW64\notepad.exenotepad107⤵PID:8508
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h107⤵
- Sets file to hidden
PID:11776
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h107⤵PID:8712
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"107⤵PID:11684
-
C:\Windows\SysWOW64\notepad.exenotepad108⤵PID:9700
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h108⤵PID:8996
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h108⤵PID:11424
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"108⤵PID:9444
-
C:\Windows\SysWOW64\notepad.exenotepad109⤵PID:10656
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h109⤵PID:7200
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h109⤵PID:8356
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"109⤵PID:5556
-
C:\Windows\SysWOW64\notepad.exenotepad110⤵PID:11320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h110⤵PID:7968
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h110⤵PID:11312
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"110⤵PID:8712
-
C:\Windows\SysWOW64\notepad.exenotepad111⤵PID:7140
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h111⤵
- Sets file to hidden
PID:1640
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h111⤵
- Sets file to hidden
PID:9444 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1112⤵PID:7712
-
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"111⤵PID:3964
-
C:\Windows\SysWOW64\notepad.exenotepad112⤵PID:11088
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h112⤵PID:10736
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h112⤵
- Views/modifies file attributes
PID:5556
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"112⤵PID:6028
-
C:\Windows\SysWOW64\notepad.exenotepad113⤵PID:8200
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h113⤵PID:8712
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h113⤵PID:2956
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"113⤵PID:12376
-
C:\Windows\SysWOW64\notepad.exenotepad114⤵PID:12444
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h114⤵PID:12460
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h114⤵PID:12468
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"114⤵PID:12636
-
C:\Windows\SysWOW64\notepad.exenotepad115⤵PID:12688
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h115⤵PID:12704
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h115⤵PID:12712
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"115⤵PID:12848
-
C:\Windows\SysWOW64\notepad.exenotepad116⤵PID:12904
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h116⤵PID:12924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h116⤵PID:12932
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"116⤵PID:13056
-
C:\Windows\SysWOW64\notepad.exenotepad117⤵PID:13108
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h117⤵
- Views/modifies file attributes
PID:13124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h117⤵
- Sets file to hidden
PID:13132
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"117⤵PID:12340
-
C:\Windows\SysWOW64\notepad.exenotepad118⤵PID:12296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h118⤵PID:10496
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h118⤵
- Views/modifies file attributes
PID:11512
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"118⤵PID:12424
-
C:\Windows\SysWOW64\notepad.exenotepad119⤵PID:12616
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h119⤵PID:12564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h119⤵PID:12600
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"119⤵PID:8264
-
C:\Windows\SysWOW64\notepad.exenotepad120⤵PID:12744
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h120⤵PID:12636
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h120⤵PID:12920
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"120⤵PID:8652
-
C:\Windows\SysWOW64\notepad.exenotepad121⤵PID:5308
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h121⤵PID:12348
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\Windupdt" +s +h121⤵PID:8612
-
-
C:\Windows\SysWOW64\Windupdt\winupdate.exe"C:\Windows\system32\Windupdt\winupdate.exe"121⤵PID:12040
-
C:\Windows\SysWOW64\notepad.exenotepad122⤵PID:8568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-