Analysis
-
max time kernel
1642s -
max time network
1872s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
03-09-2024 20:54
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.yandex.com.tr/search/?text=bonzi+buddy+download&clid=2411726&lr=11508
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
https://www.yandex.com.tr/search/?text=bonzi+buddy+download&clid=2411726&lr=11508
Resource
win11-20240802-en
General
-
Target
https://www.yandex.com.tr/search/?text=bonzi+buddy+download&clid=2411726&lr=11508
Malware Config
Extracted
crimsonrat
185.136.161.124
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
Processes:
resource yara_rule behavioral2/files/0x000100000003a692-157156.dat cobalt_reflective_dll -
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
CrimsonRAT main payload 1 IoCs
Processes:
resource yara_rule behavioral2/files/0x000100000003bacb-182918.dat family_crimsonrat -
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Detects Kaiten/Tsunami Payload 2 IoCs
Processes:
resource yara_rule behavioral2/files/0x000100000003955f-138722.dat family_kaiten2 behavioral2/files/0x0001000000039574-138772.dat family_kaiten2 -
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid Process 10508 bcdedit.exe 10472 bcdedit.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 9 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
explorer.exeKB931125-rootsupd.exetv_enua.exeMSAGENT.EXEdescription ioc Process Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A} KB931125-rootsupd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ = "RootsUpdate" KB931125-rootsupd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\IsInstalled = "1" KB931125-rootsupd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Version = "41,0,2195,0" KB931125-rootsupd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Locale = "*" KB931125-rootsupd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ComponentID = "Windows Roots Update" KB931125-rootsupd.exe Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components tv_enua.exe Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components MSAGENT.EXE -
Downloads MZ/PE file
-
Drops file in Drivers directory 16 IoCs
Processes:
360TS_Setup.exeEaInstHelper64.exeQHActiveDefense.exeDrvInst.exeQHActiveDefense.exedescription ioc Process File created C:\Windows\system32\drivers\BAPIDRV64.sys 360TS_Setup.exe File created C:\Windows\system32\drivers\360Box64.sys 360TS_Setup.exe File opened for modification C:\Windows\system32\drivers\360elam64.sys EaInstHelper64.exe File opened for modification C:\Windows\SysWOW64\drivers\360AvFlt.sys QHActiveDefense.exe File opened for modification C:\Windows\System32\drivers\SET3883.tmp DrvInst.exe File created C:\Windows\System32\drivers\SET3883.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\tap0901.sys DrvInst.exe File created C:\Windows\system32\drivers\360AntiHacker64.sys 360TS_Setup.exe File created C:\Windows\system32\drivers\360AvFlt.sys 360TS_Setup.exe File created C:\Windows\system32\drivers\360netmon.sys 360TS_Setup.exe File created C:\Windows\system32\drivers\360elam64.sys EaInstHelper64.exe File created C:\Windows\system32\drivers\360FsFlt.sys QHActiveDefense.exe File created C:\Windows\SysWOW64\drivers\360AvFlt.sys QHActiveDefense.exe File created C:\Windows\system32\drivers\360Camera64.sys 360TS_Setup.exe File opened for modification C:\Windows\system32\drivers\etc\hosts QHActiveDefense.exe File opened for modification C:\Windows\system32\drivers\360FsFlt.sys QHActiveDefense.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid Process 3116 netsh.exe 2112 netsh.exe -
Office macro that triggers on suspicious action 5 IoCs
Office document macro which triggers in special circumstances - often malicious.
Processes:
resource yara_rule behavioral2/files/0x000100000002c300-35658.dat office_macro_on_action behavioral2/files/0x000100000003a9b0-161009.dat office_macro_on_action behavioral2/files/0x000100000003ae0c-166384.dat office_macro_on_action behavioral2/files/0x000100000003ae73-166859.dat office_macro_on_action behavioral2/files/0x000100000003ae8e-166993.dat office_macro_on_action -
Sets service image path in registry 2 TTPs 14 IoCs
Processes:
QHActiveDefense.exeQHSafeTray.exe360TS_Setup.exeEaInstHelper64.exeQHActiveDefense.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360AvFlt\ImagePath = "system32\\DRIVERS\\360AvFlt.sys" QHActiveDefense.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360elam64\ImagePath = "system32\\DRIVERS\\360elam64.sys" QHSafeTray.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360AntiHacker\ImagePath = "System32\\Drivers\\360AntiHacker64.sys" 360TS_Setup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHProtected\ImagePath = "\"C:\\Program Files (x86)\\360\\Total Security\\safemon\\WscReg.exe\"" 360TS_Setup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360elam64\ImagePath = "system32\\DRIVERS\\360elam64.sys" EaInstHelper64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360AvFlt\ImagePath = "system32\\drivers\\360AvFlt.sys" QHActiveDefense.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360netmon\ImagePath = "system32\\DRIVERS\\360netmon.sys" QHSafeTray.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360Box64\ImagePath = "system32\\DRIVERS\\360Box64.sys" 360TS_Setup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360FsFlt\ImagePath = "system32\\DRIVERS\\360FsFlt.sys" QHActiveDefense.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360Camera\ImagePath = "System32\\Drivers\\360Camera64.sys" QHActiveDefense.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BAPIDRV\ImagePath = "system32\\DRIVERS\\BAPIDRV64.sys" 360TS_Setup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\ImagePath = "\"C:\\Program Files (x86)\\360\\Total Security\\safemon\\QHActiveDefense.exe\"" 360TS_Setup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360FsFlt\ImagePath = "system32\\DRIVERS\\360FsFlt.sys" QHActiveDefense.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\360AvFlt\ImagePath = "system32\\DRIVERS\\360AvFlt.sys" 360TS_Setup.exe -
Processes:
resource yara_rule behavioral2/files/0x000100000003883d-132131.dat office_xlm_macros -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 64 IoCs
Processes:
BonziBuddy432.exeMSAGENT.EXEtv_enua.exeAgentSvr.exeBonziBDY_4.EXEAgentSvr.exeBonziBDY_35.EXEMentalMentor.exeMentalMentor.tmp7z.exe7z.exe7z.exe7z.exeluminati.exetest_wpf.exenet_updater32.exementalmentor.exementalmentor_crashpad_handler.exeQtWebEngineProcess.exeQtWebEngineProcess.exeopera_inst.exesetup.exesetup.exesetup.exesetup.exesetup.exenet_updater32.exeav360_inst.exeluminati.exetest_wpf.exetest_wpf.exeluminati.exetest_wpf.exeidle_report.exeQtWebEngineProcess.exebrightdata.exeluminati.exetest_wpf.exeidle_report.exe360TS_Setup.exe360TS_Setup.exePowerSaver.exeWscReg.exeWscReg.exeEaInstHelper64.exeQHActiveDefense.exeQHActiveDefense.exeQHSafeTray.exeQHWatchdog.exePopWndLog.exeQHSafeTray.exePopWndLog.exeQHWatchdog.exeQHSafeTray.exeKB931125-rootsupd.exeupdroots.exeupdroots.exeupdroots.exeupdroots.exeQHSafeMain.exe360TsLiveUpd.exeidle_report.exeAssistant_113.0.5230.31_Setup.exe_sfx.exePromoUtil.exepid Process 1680 BonziBuddy432.exe 2360 MSAGENT.EXE 2496 tv_enua.exe 4716 AgentSvr.exe 740 BonziBDY_4.EXE 1076 AgentSvr.exe 1968 BonziBDY_35.EXE 1384 MentalMentor.exe 3520 MentalMentor.tmp 3660 7z.exe 2164 7z.exe 2568 7z.exe 2152 7z.exe 1008 luminati.exe 1412 test_wpf.exe 5408 net_updater32.exe 5692 mentalmentor.exe 5772 mentalmentor_crashpad_handler.exe 6092 QtWebEngineProcess.exe 6108 QtWebEngineProcess.exe 5132 opera_inst.exe 5364 setup.exe 5428 setup.exe 4856 setup.exe 5476 setup.exe 5680 setup.exe 5736 net_updater32.exe 5848 av360_inst.exe 5184 luminati.exe 5188 test_wpf.exe 5324 test_wpf.exe 3452 luminati.exe 4776 test_wpf.exe 5184 idle_report.exe 6904 QtWebEngineProcess.exe 7088 brightdata.exe 6704 luminati.exe 6732 test_wpf.exe 6976 idle_report.exe 6708 360TS_Setup.exe 7108 360TS_Setup.exe 10144 PowerSaver.exe 9900 WscReg.exe 10256 WscReg.exe 9756 EaInstHelper64.exe 9556 QHActiveDefense.exe 2548 QHActiveDefense.exe 8208 QHSafeTray.exe 5596 QHWatchdog.exe 9512 PopWndLog.exe 2992 QHSafeTray.exe 7364 PopWndLog.exe 8052 QHWatchdog.exe 7868 QHSafeTray.exe 6316 KB931125-rootsupd.exe 9392 updroots.exe 9308 updroots.exe 9072 updroots.exe 9180 updroots.exe 8824 QHSafeMain.exe 6916 360TsLiveUpd.exe 10392 idle_report.exe 6664 Assistant_113.0.5230.31_Setup.exe_sfx.exe 7896 PromoUtil.exe -
Loads dropped DLL 64 IoCs
Processes:
BonziBuddy432.exeMSAGENT.EXEregsvr32.exetv_enua.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeBonziBDY_4.EXEAgentSvr.exeBonziBDY_35.EXEMentalMentor.tmp7z.exe7z.exe7z.exe7z.exeluminati.exementalmentor.exepid Process 1680 BonziBuddy432.exe 1680 BonziBuddy432.exe 1680 BonziBuddy432.exe 1680 BonziBuddy432.exe 1680 BonziBuddy432.exe 1680 BonziBuddy432.exe 1680 BonziBuddy432.exe 1680 BonziBuddy432.exe 1680 BonziBuddy432.exe 1680 BonziBuddy432.exe 1680 BonziBuddy432.exe 2360 MSAGENT.EXE 1332 regsvr32.exe 2496 tv_enua.exe 2548 regsvr32.exe 2548 regsvr32.exe 1832 regsvr32.exe 200 regsvr32.exe 2208 regsvr32.exe 1100 regsvr32.exe 2568 regsvr32.exe 3732 regsvr32.exe 1112 regsvr32.exe 740 BonziBDY_4.EXE 740 BonziBDY_4.EXE 740 BonziBDY_4.EXE 740 BonziBDY_4.EXE 740 BonziBDY_4.EXE 740 BonziBDY_4.EXE 1076 AgentSvr.exe 1076 AgentSvr.exe 1076 AgentSvr.exe 1968 BonziBDY_35.EXE 1968 BonziBDY_35.EXE 1968 BonziBDY_35.EXE 1968 BonziBDY_35.EXE 1968 BonziBDY_35.EXE 1968 BonziBDY_35.EXE 1968 BonziBDY_35.EXE 1968 BonziBDY_35.EXE 1968 BonziBDY_35.EXE 1076 AgentSvr.exe 1076 AgentSvr.exe 740 BonziBDY_4.EXE 740 BonziBDY_4.EXE 740 BonziBDY_4.EXE 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3660 7z.exe 2164 7z.exe 2568 7z.exe 2152 7z.exe 1008 luminati.exe 1008 luminati.exe 1008 luminati.exe 1008 luminati.exe 1008 luminati.exe 5692 mentalmentor.exe 5692 mentalmentor.exe 5692 mentalmentor.exe 5692 mentalmentor.exe 5692 mentalmentor.exe 5692 mentalmentor.exe 5692 mentalmentor.exe -
Modifies system executable filetype association 2 TTPs 6 IoCs
Processes:
regsvr32.exeuninstall.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SD360\ = "{086F171D-5ED1-4ED2-B736-CFF3AD6A128E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SD360 regsvr32.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/files/0x0001000000039d38-145801.dat themida -
Processes:
resource yara_rule behavioral2/memory/11028-21886-0x0000000000400000-0x00000000030CA000-memory.dmp upx behavioral2/memory/11028-21937-0x0000000000400000-0x00000000030CA000-memory.dmp upx behavioral2/memory/11028-22079-0x0000000000400000-0x00000000030CA000-memory.dmp upx behavioral2/files/0x0001000000035964-109334.dat upx behavioral2/files/0x0001000000039650-139762.dat upx behavioral2/files/0x000100000003969c-140235.dat upx behavioral2/files/0x000100000003970a-140278.dat upx behavioral2/files/0x000100000003b095-169548.dat upx -
Unexpected DNS network traffic destination 25 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 54.72.244.172 Destination IP 54.72.244.172 Destination IP 54.72.12.198 Destination IP 52.209.50.186 Destination IP 52.209.64.157 Destination IP 54.72.244.172 Destination IP 54.72.244.172 Destination IP 54.72.244.172 Destination IP 52.209.64.157 Destination IP 52.209.64.157 Destination IP 54.72.12.198 Destination IP 54.72.244.172 Destination IP 54.72.244.172 Destination IP 54.76.133.21 Destination IP 54.72.244.172 Destination IP 54.76.133.21 Destination IP 54.72.244.172 Destination IP 54.72.244.172 Destination IP 54.72.244.172 Destination IP 54.76.133.21 Destination IP 54.72.244.172 Destination IP 54.72.244.172 Destination IP 54.72.12.198 Destination IP 54.76.133.21 Destination IP 52.209.50.186 -
Adds Run key to start application 2 TTPs 7 IoCs
Processes:
tv_enua.exementalmentor.exe360TS_Setup.exeQHActiveDefense.exeSkypeSetupFull_7.32.99.104_is.exeDesktopPlus64.exeVPNMaster.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tv_enua = "RunDll32 advpack.dll,LaunchINFSection C:\\Windows\\INF\\tv_enua.inf, RemoveCabinet" tv_enua.exe Set value (str) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mental Mentor = "\"C:\\Users\\Admin\\mentalmentor\\mentalmentor.exe\" silent" mentalmentor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\QHSafeTray = "\"C:\\Program Files (x86)\\360\\Total Security\\safemon\\360Tray.exe\" /start" 360TS_Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\QHSafeTray = "\"C:\\Program Files (x86)\\360\\Total Security\\safemon\\360Tray.exe\" /start" QHActiveDefense.exe Set value (str) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Windows\CurrentVersion\Run\Skype = "\"c:\\program files (x86)\\skype\\Phone\\Skype.exe\" /minimized /regrun" SkypeSetupFull_7.32.99.104_is.exe Set value (str) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Windows\CurrentVersion\Run\360DesktopLite = "\"C:\\ProgramData\\360TotalSecurity\\DesktopPlus\\DesktopPlus64.exe\" /auto" DesktopPlus64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VPNMaster = "C:\\Program Files (x86)\\VPNMaster\\Startup.exe" VPNMaster.exe -
Blocklisted process makes network request 3 IoCs
Processes:
MsiExec.exeflow pid Process 1413 5868 MsiExec.exe 1418 5868 MsiExec.exe 1424 5868 MsiExec.exe -
Checks for any installed AV software in registry 1 TTPs 61 IoCs
Processes:
360TS_Setup.exeQHActiveDefense.exeQHWatchdog.exeQHSafeMain.exedescription ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\ErrorControl 360TS_Setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Doctor Web\InstalledComponents QHActiveDefense.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\NOD\CurrentVersion\Info QHActiveDefense.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense QHActiveDefense.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\ObjectName QHWatchdog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense QHWatchdog.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Start 360TS_Setup.exe Delete value \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\LaunchProtected QHWatchdog.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\DeleteFlag QHWatchdog.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\WOW64 = "1" QHWatchdog.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Doctor Web\InstalledComponents QHActiveDefense.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense 360TS_Setup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\DisplayName = "360 Total Security" 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Group 360TS_Setup.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Type = "16" 360TS_Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense QHWatchdog.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Start QHWatchdog.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast QHActiveDefense.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast QHActiveDefense.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast 360TS_Setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Type QHWatchdog.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\ImagePath QHSafeMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Type QHActiveDefense.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Group = "TDI" 360TS_Setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast 360TS_Setup.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\ErrorControl = "1" 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\ImagePath 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\ErrorControl QHWatchdog.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Group QHWatchdog.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast QHActiveDefense.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\FailureCommand QHActiveDefense.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Alias QHActiveDefense.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\DisplayName 360TS_Setup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\ImagePath = "\"C:\\Program Files (x86)\\360\\Total Security\\safemon\\QHActiveDefense.exe\"" 360TS_Setup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Description = "360 Total Security" QHWatchdog.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Doctor Web\InstalledComponents 360TS_Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense 360TS_Setup.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Start = "2" 360TS_Setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Eset\NOD\CurrentVersion\Info QHActiveDefense.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira QHActiveDefense.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Doctor Web\InstalledComponents 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\ObjectName 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Type 360TS_Setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira QHActiveDefense.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense QHSafeMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Parameters QHActiveDefense.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense QHWatchdog.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\ImagePath QHWatchdog.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\NOD\CurrentVersion\Info 360TS_Setup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\ObjectName = "LocalSystem" 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\DisplayName QHWatchdog.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense QHWatchdog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\Parameters QHSafeMain.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense QHActiveDefense.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Eset\NOD\CurrentVersion\Info 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\ImagePath QHActiveDefense.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense\WOW64 QHActiveDefense.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
360TS_Setup.exeQHActiveDefense.exeQHSafeTray.exeQHSafeMain.exedescription ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA QHActiveDefense.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA QHSafeTray.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA QHSafeMain.exe -
Drops Chrome extension 1 IoCs
Processes:
chrome.exedescription ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\glcimepnljoholdmjchkloafkggfoijh\2.1.56_0\manifest.json chrome.exe -
Drops desktop.ini file(s) 4 IoCs
Processes:
QHSafeMain.exemsiexec.exedescription ioc Process File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini QHSafeMain.exe File created C:\program files (x86)\skype\desktop.ini msiexec.exe File opened for modification C:\program files (x86)\skype\Desktop.ini msiexec.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini QHSafeMain.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
QHActiveDefense.exemsiexec.exeQHSafeMain.exeQHSafeTray.exeexplorer.exesetup.exesetup.exeDriverUpdater.exeOpera_90.0.4480.80_Setup.exedescription ioc Process File opened (read-only) \??\k: QHActiveDefense.exe File opened (read-only) \??\o: QHActiveDefense.exe File opened (read-only) \??\b: QHActiveDefense.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\r: QHSafeMain.exe File opened (read-only) \??\G: QHSafeMain.exe File opened (read-only) \??\P: QHSafeMain.exe File opened (read-only) \??\F: QHSafeTray.exe File opened (read-only) \??\Y: QHSafeMain.exe File opened (read-only) \??\R: QHSafeMain.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\v: QHActiveDefense.exe File opened (read-only) \??\H: QHActiveDefense.exe File opened (read-only) \??\f: QHSafeMain.exe File opened (read-only) \??\W: QHActiveDefense.exe File opened (read-only) \??\B: QHActiveDefense.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: setup.exe File opened (read-only) \??\i: QHActiveDefense.exe File opened (read-only) \??\N: QHSafeMain.exe File opened (read-only) \??\B: QHSafeMain.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\D: setup.exe File opened (read-only) \??\s: QHActiveDefense.exe File opened (read-only) \??\A: QHActiveDefense.exe File opened (read-only) \??\I: QHSafeMain.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\j: QHActiveDefense.exe File opened (read-only) \??\m: QHActiveDefense.exe File opened (read-only) \??\r: QHActiveDefense.exe File opened (read-only) \??\F: DriverUpdater.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: QHSafeMain.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\w: QHActiveDefense.exe File opened (read-only) \??\x: QHActiveDefense.exe File opened (read-only) \??\z: QHActiveDefense.exe File opened (read-only) \??\M: QHSafeMain.exe File opened (read-only) \??\F: setup.exe File opened (read-only) \??\J: QHActiveDefense.exe File opened (read-only) \??\Y: QHActiveDefense.exe File opened (read-only) \??\E: QHSafeMain.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: QHActiveDefense.exe File opened (read-only) \??\M: QHActiveDefense.exe File opened (read-only) \??\l: QHSafeMain.exe File opened (read-only) \??\F: Opera_90.0.4480.80_Setup.exe File opened (read-only) \??\X: QHSafeMain.exe File opened (read-only) \??\O: QHActiveDefense.exe File opened (read-only) \??\H: QHSafeMain.exe File opened (read-only) \??\W: QHSafeMain.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\h: QHActiveDefense.exe File opened (read-only) \??\N: QHActiveDefense.exe File opened (read-only) \??\F: QHSafeMain.exe File opened (read-only) \??\V: QHActiveDefense.exe File opened (read-only) \??\L: QHSafeMain.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1502 ip-api.com -
Modifies WinLogon 2 TTPs 1 IoCs
Processes:
QHSafeMain.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "1" QHSafeMain.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 27 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
360InstantSetup.exeDesktopPlus64.exeQHActiveDefense.exePopWndLog.exeLiveUpdate360.exe360TsLiveUpd.exeVPNMaster_setup_guard.exe360webshield.exe360InstantSetup.exesetup.exe360InstantSetup.exe360TsLiveUpd.exe360InstantSetup.exePopTip.exeQHSafeTray.exeQHSafeMain.exeQHSafeTray.exeQHSafeTray.exePromoUtil.exe360InstantSetup.exe360InstantSetup.exeVPNMaster.exeav360_inst.exe360TS_Setup.exeQHSafeTray.exeDriverUpdater.exedescription ioc Process File opened for modification \??\PhysicalDrive0 360InstantSetup.exe File opened for modification \??\PhysicalDrive0 DesktopPlus64.exe File opened for modification \??\PhysicalDrive0 QHActiveDefense.exe File opened for modification \??\PhysicalDrive0 PopWndLog.exe File opened for modification \??\PhysicalDrive0 LiveUpdate360.exe File opened for modification \??\PhysicalDrive0 360TsLiveUpd.exe File opened for modification \??\PhysicalDrive0 VPNMaster_setup_guard.exe File opened for modification \??\PhysicalDrive0 360webshield.exe File opened for modification \??\PhysicalDrive0 360InstantSetup.exe File opened for modification \??\PhysicalDrive0 setup.exe File opened for modification \??\PhysicalDrive0 360InstantSetup.exe File opened for modification \??\PhysicalDrive0 360TsLiveUpd.exe File opened for modification \??\PhysicalDrive0 360InstantSetup.exe File opened for modification \??\PhysicalDrive0 PopTip.exe File opened for modification \??\PhysicalDrive0 QHSafeTray.exe File opened for modification \??\PHYSICALDRIVE0 QHSafeMain.exe File opened for modification \??\PhysicalDrive0 QHSafeTray.exe File opened for modification \??\PhysicalDrive0 QHSafeTray.exe File opened for modification \??\PhysicalDrive0 PromoUtil.exe File opened for modification \??\PhysicalDrive0 360InstantSetup.exe File opened for modification \??\PhysicalDrive0 QHSafeMain.exe File opened for modification \??\PhysicalDrive0 360InstantSetup.exe File opened for modification \??\PhysicalDrive0 VPNMaster.exe File opened for modification \??\PhysicalDrive0 av360_inst.exe File opened for modification \??\PhysicalDrive0 360TS_Setup.exe File opened for modification \??\PhysicalDrive0 QHSafeTray.exe File opened for modification \??\PhysicalDrive0 DriverUpdater.exe -
Checks system information in the registry 2 TTPs 3 IoCs
System information is often read in order to detect sandboxing environments.
Processes:
QHSafeTray.exe360SecureBrowser.exedescription ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer QHSafeTray.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer 360SecureBrowser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName 360SecureBrowser.exe -
Drops file in System32 directory 63 IoCs
Processes:
tv_enua.exenet_updater32.exeQHActiveDefense.exeidle_report.exeDrvInst.exeidle_report.exechrome.exeMsiExec.exeidle_report.exeidle_report.exeQHSafeMain.exeidle_report.exeVPNMaster_setup_guard.exeinstalltapx64.exeidle_report.exeidle_report.exeidle_report.exeidle_report.exeidle_report.exeidle_report.exeidle_report.exetest_wpf.exeidle_report.exeidle_report.exeidle_report.exeidle_report.exedescription ioc Process File opened for modification C:\Windows\SysWOW64\SET924.tmp tv_enua.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache net_updater32.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\360WD\wdch.dat QHActiveDefense.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\idle_report.exe.log idle_report.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9a9d580b-75eb-2544-9061-d69104d0289d} DrvInst.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\idle_report.exe.log idle_report.exe File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF chrome.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData net_updater32.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\360WD\wdch.dat-journal QHActiveDefense.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 MsiExec.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_DBEBBB72D7CF896A67503824FF19F0BB MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9a9d580b-75eb-2544-9061-d69104d0289d}\SET377C.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\BrightData net_updater32.exe File opened for modification C:\Windows\system32\hpnsw5.exe QHActiveDefense.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\idle_report.exe.log idle_report.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdf\tap0901.sys DrvInst.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\idle_report.exe.log idle_report.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft net_updater32.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_488E097E1A6B1768143D54114E281A12 net_updater32.exe File opened for modification C:\Windows\system32\CleanLog\SysSweeper.dat QHSafeMain.exe File created C:\Windows\SysWOW64\SET924.tmp tv_enua.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 net_updater32.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\idle_report.exe.log idle_report.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6 MsiExec.exe File created C:\Windows\SysWOW64\remote_config_data VPNMaster_setup_guard.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdf\oemvista.PNF installtapx64.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\idle_report.exe.log idle_report.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F MsiExec.exe File created C:\Windows\System32\DriverStore\Temp\{9a9d580b-75eb-2544-9061-d69104d0289d}\SET377A.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9a9d580b-75eb-2544-9061-d69104d0289d}\SET377B.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdf\tap0901.cat DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\idle_report.exe.log idle_report.exe File created \??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF chrome.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\idle_report.exe.log idle_report.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F MsiExec.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\idle_report.exe.log idle_report.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9a9d580b-75eb-2544-9061-d69104d0289d}\SET377A.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9a9d580b-75eb-2544-9061-d69104d0289d}\tap0901.cat DrvInst.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\idle_report.exe.log idle_report.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content net_updater32.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\idle_report.exe.log idle_report.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6 MsiExec.exe File created C:\Windows\System32\DriverStore\Temp\{9a9d580b-75eb-2544-9061-d69104d0289d}\SET377C.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdf\oemvista.inf DrvInst.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\idle_report.exe.log idle_report.exe File opened for modification C:\Windows\SysWOW64\msvcp50.dll tv_enua.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\test_wpf.exe.log test_wpf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\idle_report.exe.log idle_report.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9a9d580b-75eb-2544-9061-d69104d0289d}\oemvista.inf DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 net_updater32.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\idle_report.exe.log idle_report.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\idle_report.exe.log idle_report.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9a9d580b-75eb-2544-9061-d69104d0289d}\tap0901.sys DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB net_updater32.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB net_updater32.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\idle_report.exe.log idle_report.exe File created C:\Windows\System32\DriverStore\Temp\{9a9d580b-75eb-2544-9061-d69104d0289d}\SET377B.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_488E097E1A6B1768143D54114E281A12 net_updater32.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\360safe\antiadwa\memo20240903.dat QHActiveDefense.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 MsiExec.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_DBEBBB72D7CF896A67503824FF19F0BB MsiExec.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
QHSafeTray.exedescription ioc Process File opened (read-only) \??\VBoxMiniRdrDN QHSafeTray.exe -
Drops file in Program Files directory 64 IoCs
Processes:
360TS_Setup.exeBonziBuddy432.exeVPNMaster_setup_guard.exe360InstantSetup.exeStartup.exemsiexec.exe360TsLiveUpd.exeWinRAR_is_64.exeBonziBDY_4.EXEdescription ioc Process File created C:\Program Files (x86)\360\Total Security\i18n\hi\libaw.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\tr\deepscan\ssr.dat 360TS_Setup.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page17.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\sp003.gif BonziBuddy432.exe File created C:\Program Files (x86)\VPNMaster\WebView2Loader.dll VPNMaster_setup_guard.exe File created C:\Program Files (x86)\VPNMaster\start\icons\[email protected] VPNMaster_setup_guard.exe File created C:\Program Files (x86)\360\Total Security\i18n\it\safemon\360SafeCamera.tpi.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\vi\AntiAdwa.dll.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\config\newui\themes\default\InstantSetup\icon\t016ae096f07d0ebd84.png.mem 360InstantSetup.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\ssa3d30.ocx BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Uninstall.exe BonziBuddy432.exe File created C:\Program Files (x86)\360\Total Security\ipc\qutmipc.dll 360TS_Setup.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\sites.nbd BonziBuddy432.exe File created C:\Program Files (x86)\360\Total Security\i18n\en\safemon\Safemon64.dll.locale 360TS_Setup.exe File created C:\Program Files (x86)\VPNMaster\start\icons\[email protected] VPNMaster_setup_guard.exe File created C:\Program Files (x86)\360\Total Security\ipc\DrvUtility.dll 360TS_Setup.exe File opened for modification C:\Program Files (x86)\360\Total Security\config\newui\themes\default\InstantSetup\icon\t01fcc087310810811b.png.P2P 360InstantSetup.exe File created C:\Program Files (x86)\VPNMaster\start\icons\[email protected] VPNMaster_setup_guard.exe File opened for modification C:\Program Files (x86)\VPNMaster\masterVpnLauncher.log Startup.exe File created C:\Program Files (x86)\360\Total Security\deepscan\rmt.exe 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\config\newui\themes\default\theme_DuplicateFile.xml 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\deepscan\dsconz.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\zh-CN\ipc\filemgr.dll.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\deepscan\CheckSM.exe 360TS_Setup.exe File created C:\Program Files (x86)\VPNMaster\start\static\js\chunk-elementUI.c66d9073.js VPNMaster_setup_guard.exe File created C:\Program Files (x86)\360\Total Security\config\lang\pl\SysSweeper.ui.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\zh-TW\ipc\Sxin64.dll.locale 360TS_Setup.exe File created C:\program files (x86)\skype\Updater\Updater.dll msiexec.exe File created C:\Program Files (x86)\VPNMaster\start\static\css\chunk-6555ed21.f4a1443e.css VPNMaster_setup_guard.exe File created C:\Program Files (x86)\VPNMaster\myinternet.dll VPNMaster_setup_guard.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\sp006.gif BonziBuddy432.exe File created C:\Program Files (x86)\360\Total Security\i18n\ja\safemon\spsafe64.dll.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\modules\360PatchMgr.exe 360TS_Setup.exe File opened for modification C:\Program Files (x86)\360\Total Security\update\~TA6C19.cab.P2P 360TsLiveUpd.exe File created C:\Program Files (x86)\360\Total Security\i18n\ru\ipc\filemgr.dll.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\fr\deepscan\DsRes.dll 360TS_Setup.exe File created C:\Program Files\WinRAR\Zip32.SFX WinRAR_is_64.exe File created C:\Program Files (x86)\VPNMaster\start\icons\[email protected] VPNMaster_setup_guard.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\j3.nbd-SR BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page12.jpg BonziBuddy432.exe File created C:\Program Files (x86)\360\Total Security\i18n\en\safemon\360SafeCamera.tpi.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\de\AntiAdwa.dll.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\zh-CN\safemon\drvmon.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\deepscan\lsv.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\deepscan\ImAVEng.dll 360TS_Setup.exe File opened for modification C:\Program Files (x86)\360\Total Security\update\instantsetup_241464406.dat.P2P 360InstantSetup.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page4.jpg BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb002.gif BonziBuddy432.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page6.jpg BonziBuddy432.exe File created C:\Program Files (x86)\360\Total Security\i18n\vi\safemon\bp.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\netmon\sysoptm.dll 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\vi\ipc\360netd.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\en\safemon\360procmon.dll.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\ipc\360boxmain.exe 360TS_Setup.exe File created C:\Program Files (x86)\VPNMaster\start\icons\[email protected] VPNMaster_setup_guard.exe File created C:\Program Files (x86)\360\Total Security\i18n\es\libdefa.dat 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\i18n\hi\ipc\NetDefender.dll.locale 360TS_Setup.exe File created C:\Program Files (x86)\360\Total Security\safemon\SDPlugin\AdPopWnd.dll 360TS_Setup.exe File created C:\Program Files (x86)\VPNMaster\start\icons\[email protected] VPNMaster_setup_guard.exe File created C:\Program Files (x86)\VPNMaster\start\icons\[email protected] VPNMaster_setup_guard.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Reg.nbd BonziBDY_4.EXE File created C:\Program Files (x86)\VPNMaster\start\icons\[email protected] VPNMaster_setup_guard.exe File created C:\Program Files (x86)\VPNMaster\start\icons\[email protected] VPNMaster_setup_guard.exe File created C:\Program Files (x86)\VPNMaster\start\icons\[email protected] VPNMaster_setup_guard.exe -
Drops file in Windows directory 64 IoCs
Processes:
QHSafeMain.exeMSAGENT.EXEDriverUpdater.exemsiexec.exeExplorer.EXEsetup.exetv_enua.exeDesktopPlus64.exeexplorer.exedescription ioc Process File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ViewerPS.dll QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe QHSafeMain.exe File opened for modification C:\Windows\msagent\SET7FD.tmp MSAGENT.EXE File created C:\Windows\msagent\SET800.tmp MSAGENT.EXE File opened for modification C:\Windows\help\Agt0409.hlp MSAGENT.EXE File created C:\Windows\INF\c_display.PNF DriverUpdater.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfcm100_x64 QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\UKRAINE.TXT QHSafeMain.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\{FC965A47-4839-40CA-B618-18F486F042C6}\SkypeIcon.exe Explorer.EXE File opened for modification C:\Windows\msagent\SET7E8.tmp MSAGENT.EXE File opened for modification C:\Windows\installer\$patchcache$\Managed\00006109E70000000100000000F01FEC\16.0.12527\msvcp140.dll_x86 QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100deu_x64 QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\00006109E70000000100000000F01FEC\16.0.12527\vccorlib140.dll_x86 QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100kor_x86 QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1257.TXT QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\MakeAccessible.api_NON_OPT QHSafeMain.exe File opened for modification C:\Windows\Installer\{FC965A47-4839-40CA-B618-18F486F042C6}\SkypeIcon.exe setup.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100rus_x86 QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroPDFImpl.dll QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\EScript.api QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\icudt40.dll QHSafeMain.exe File opened for modification C:\Windows\Installer\MSI8BF.tmp msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\74A569CF9384AC046B81814F680F246C\7.32.104\F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA msiexec.exe File opened for modification C:\Windows\lhsp\tv\tv_enua.dll tv_enua.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100rus_x64 QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adobearmhelper.exe.BDCA7721_F290_4124_BBED_7A15FE7694EB QHSafeMain.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100chs_x64 QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\comdll.x.manifest QHSafeMain.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\74A569CF9384AC046B81814F680F246C msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\74A569CF9384AC046B81814F680F246C\7.32.104\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA msiexec.exe File opened for modification C:\Windows\Installer\MSI4DE0.tmp msiexec.exe File created C:\Windows\fonts\SET913.tmp tv_enua.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\a3dutils.dll QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CoolType.dll_NON_OPT QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\home.aapp QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\icucnv40.dll QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100u_x86 QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CORPCHAR.TXT2 QHSafeMain.exe File opened for modification \??\c:\windows\installer\{fc965a47-4839-40ca-b618-18f486f042c6}\skypeicon.exe DesktopPlus64.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100u_x64 QHSafeMain.exe File opened for modification \??\c:\windows\installer\{fc965a47-4839-40ca-b618-18f486f042c6}\skypeicon.exe explorer.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroForm.api__NON_OPT QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\BIBUtils.dll QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\QuickTime.mpp QHSafeMain.exe File opened for modification C:\Windows\Installer\MSI93D.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\weblink.api QHSafeMain.exe File created C:\Windows\Installer\SourceHash{FC965A47-4839-40CA-B618-18F486F042C6} msiexec.exe File opened for modification C:\Windows\INF\tv_enua.inf tv_enua.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrord32res.dll QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ccme_base_non_fips.dll QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1250.TXT2 QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ROMANIAN.TXT QHSafeMain.exe File opened for modification C:\Windows\lhsp\tv\tvenuax.dll tv_enua.exe File created C:\Windows\INF\c_media.PNF DriverUpdater.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeLinguistic.dll QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\EPDF_RHP.aapp QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\E39B69A3F3677E14587CF1C3CC73FE72\48.108.8828\fileCoreHostExe QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\00006109E70000000100000000F01FEC\16.0.12527\msvcp140_1.dll_x86 QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe QHSafeMain.exe File opened for modification C:\Windows\installer\$patchcache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\comments.aapp QHSafeMain.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 64 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
Processes:
WinRAR.exemsedge.exechrome.exedescription ioc Process File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[ModBot]-V1.0\120-[ModBot]-V1.0\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[SP2FIX-VNCBrute-Mohaa]-Test V1.0\120-[SP2FIX-VNCBrute-Mohaa]-Test V1.0\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[netapi-sym-mohaa]-(vncbrute-sp2patch)\120-[SP2FIX-VNCBrute-Mohaa]-Test V1.0\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Darkness IRC Bot\ResHacker.exe:Zone.Identifier WinRAR.exe File opened for modification C:\Users\Admin\Downloads\BonziBuddy432.exe:Zone.Identifier msedge.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\1.1.0.0\zsb Builder.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-MYSQL1THREAD-V2\RX-120-MYSQL-V2\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Aryan v0.5\Client\AryanRatClient.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\FUD Stub USG\VfCxbdJPjrhMHIGLwDK.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Cryptit\bin\Release\Hello.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\IMBot_SRC_$$\lib\stub.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[BruteTest]-V0.5\120-[BruteTest]-V0.5\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\AkBot-x0r-dns\ConfigGUI.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\DCI Bot\xor\Release\xor.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\DynastryCrypterSource\DynastryCrypterSource\Darow's Crypter 2.0\Client\OCX\Registrator.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Java_Botnet2\Java_Botnet\jshrink.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\1.2.4.2\server\zsbcs64.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[ModBot]-SNIFF-VNCBRUTE-SP2FIX-NICK\120-[ModBot]-VNCBRUTE-SP2FIX-2007\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\CC.Trojan.EMAIL3\CC.Trojan.IRC.EMAIL3\Activate Windows.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Cryptit\stub\bin\Release\stub.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\IMBOT_MOD\IMBot_SRC_$$\lib\stub.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-MYSQL-V2\RX-120-MYSQL-V2\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[ModBot]-SP2FIX-SYM-VNCBRUTE\120-[ModBot]-VNCBRUTE-SP2FIX-2007\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\@@ SKUZ FIXED DDOS @@\Extras\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Cryptit\bin\Release\Cryptit.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\IHS-H-A-V003-Exploits\OllyHole.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Dwighlight_Stealer\Stub\Stub.exe:Zone.Identifier WinRAR.exe File opened for modification C:\Users\Admin\Downloads\MentalMentor.exe:Zone.Identifier chrome.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[ModBot]-VNCBRUTE-MSSQL-2007\120-[ModBot]-VNCBRUTE-MSSQL-2007\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[SP2-PATCH]-V2.0\120-[SP2-PATCH]-V2.0\120-[SP2-PATCH]-V2.0\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\2.12\pstord.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\CpBoT\Lib\stub.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-VnC-Brute+pStore\120-[DVNC-TEST]-DDOS-V1.0\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-MYSQLBRUTE-V2\RX-120-MYSQL-V2\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\ChodeBot C++ v1 base\Release\ChodeBase.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\GENTOOreptile-base\Remove\Debug\remove.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\@@ SKUZ FIXED DDOS @@\SkuZ.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\I1.4b0\Iroffer.1.4b03.UD.Patch.by.iNs.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Java_Botnet\jshrink.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[SP2-PATCH-BRUTE]-V2.0\120-[SP2-PATCH-BRUTE]-V2.0\120-[SP2-PATCH-BRUTE]-V2.0\120-[SP2-PATCH-BRUTE]-V2.0\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\AkBot[IRC]-lsd_mod\ConfigGUI.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\GENTOOreptile-base\Extras\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\InTeL_m0dd-Test101-ms0640\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-PSTORE-MSSQL-SYM-NTPASS-VNC-NETAPI-2007\120-PSTORE-MSSQL-SYM-NTPASS-VNC-NETAPI-2007\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[SP2FIX-VNCBrute-Mohaa]-STRIP V1.0\120-[SP2FIX-VNCBrute-Mohaa]-STRIP V1.0\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[SP2fix-VncBrute]-FINALV1.0\120-[SP2fix-VncBrute]-FINALV1.0\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\AryanRat04\Client\AryanRATServer.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Beast Bot 6.2\Beast\Other\xor.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\DarkAnalNKX-BACKDOOR-REMOVED\DarkAnalNKX-BACKDOOR-REMOVED\Extras\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\GENTOOreptile-base\stub.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\InTeL_m0dd-Test101-ms0640\stub.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[DVNC-TEST]-DDOS-V1.0\120-[ModBot]-DDOS-V1.0\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[ModBot]-V0.5\120-[ModBot]-V0.5\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\IrINi bot 0.1 public limited version for win32\bin\IriNi.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Dwighlight_Stealer\Builder\Project1.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\H-Bot M0d 3.0 M0dd3d by TH & Sculay5\exe\nzm.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Imbot1.3_V3.1\Other\xor.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\1.2.4.2\builder.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\1.2.4.2\server\zsbcs.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-MYSQL-V999\RX-120-MYSQL-V999\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\CpBoT\stub.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Dbot.v3.1\MD5ChecksumTest.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120 Moded By t0nixx\Encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Akbot v0.4.1[netapi]\mkcfg.exe:Zone.Identifier WinRAR.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 10 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exenetsh.exeQHActiveDefense.exedescription ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh QHActiveDefense.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh QHActiveDefense.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh QHActiveDefense.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh QHActiveDefense.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target Process procid_target 8024 9036 WerFault.exe 405 8452 9036 WerFault.exe 405 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
7z.exe360TS_Setup.exe360SecureBrowser.exeOpera_90.0.4480.80_Setup.exe360SecureBrowser.exeregsvr32.execefutil.exeTASKKILL.exe360SecureBrowser.exe360SecureBrowser.exe360SecureBrowser.exeKB931125-rootsupd.execefutil.exeSkypeSetupFull_7.32.99.104_is.exe360InstantSetup.exeidle_report.exemaster_vpn-service.exe360SecureBrowser.exeQHSafeTray.exePopWndLog.exeupdroots.exeQHSafeMain.exeTASKKILL.exe360SecureBrowser_setup.exe360SecureBrowser.exeidle_report.exeregsvr32.exesetup.exetest_wpf.exeupdroots.exeAssistant_113.0.5230.31_Setup.exe_sfx.exeTASKKILL.exe360SecureBrowser.exementalmentor_crashpad_handler.exePowerSaver.exeQHActiveDefense.exeQHWatchdog.exeregsvr32.exe360TsLiveUpd.exeQtWebEngineProcess.exetest_wpf.exeupdroots.exeregsvr32.exeassistant_installer.exe360SecureBrowser.exe360SecureBrowser.exeMentalMentor.exe7z.exenet_updater32.exesetup.exeidle_report.exe360SecureBrowser.exe360SecureBrowser.exeassistant_installer.exeassistant_installer.exenetsh.exeQtWebEngineProcess.exeWscReg.exe360SecureBrowser.exetv_enua.exe7z.exenet_updater32.exeVPNMaster.exeidle_report.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360TS_Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360SecureBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Opera_90.0.4480.80_Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360SecureBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cefutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360SecureBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360SecureBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360SecureBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KB931125-rootsupd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cefutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SkypeSetupFull_7.32.99.104_is.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360InstantSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language idle_report.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language master_vpn-service.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360SecureBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHSafeTray.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PopWndLog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language updroots.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHSafeMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360SecureBrowser_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360SecureBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language idle_report.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language test_wpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language updroots.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Assistant_113.0.5230.31_Setup.exe_sfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360SecureBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mentalmentor_crashpad_handler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PowerSaver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHActiveDefense.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHWatchdog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360TsLiveUpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QtWebEngineProcess.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language test_wpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language updroots.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language assistant_installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360SecureBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360SecureBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MentalMentor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net_updater32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language idle_report.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360SecureBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360SecureBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language assistant_installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language assistant_installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QtWebEngineProcess.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WscReg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360SecureBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tv_enua.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net_updater32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPNMaster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language idle_report.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 14 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
msedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exepid Process 6000 msedgewebview2.exe 9848 msedgewebview2.exe 6952 msedgewebview2.exe 9556 msedgewebview2.exe 11128 msedgewebview2.exe 6924 msedgewebview2.exe 8888 msedgewebview2.exe 8964 msedgewebview2.exe 9244 msedgewebview2.exe 6416 msedgewebview2.exe 8788 msedgewebview2.exe 10452 msedgewebview2.exe 6284 msedgewebview2.exe 9324 msedgewebview2.exe -
NSIS installer 2 IoCs
Processes:
resource yara_rule behavioral2/files/0x000100000002b3c1-10143.dat nsis_installer_1 behavioral2/files/0x000100000002b3c1-10143.dat nsis_installer_2 -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
explorer.exeinstalltapx64.exeDrvInst.exesvchost.exeDrvInst.exeDriverUpdater.exesvchost.exedescription ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID installtapx64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs installtapx64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs installtapx64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags installtapx64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DriverUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags DriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs installtapx64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe -
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
QHActiveDefense.exenet_updater32.exeQHSafeMain.exeQHSafeTray.exe360TS_Setup.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString QHActiveDefense.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz net_updater32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 QHSafeMain.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 QHActiveDefense.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString QHSafeMain.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 QHSafeTray.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString QHSafeTray.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 net_updater32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 360TS_Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 360TS_Setup.exe -
Enumerates system info in registry 2 TTPs 21 IoCs
Processes:
msedgewebview2.exe360SecureBrowser.exemsedge.exechrome.exeVPNMaster_setup_guard.exemsedgewebview2.exeSearchHost.exeVPNMaster.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer 360SecureBrowser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion VPNMaster_setup_guard.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName 360SecureBrowser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS VPNMaster_setup_guard.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion VPNMaster.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS VPNMaster.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 360SecureBrowser.exe -
Kills process with taskkill 4 IoCs
Processes:
TASKKILL.exeTASKKILL.exeTASKKILL.exeTASKKILL.exepid Process 5612 TASKKILL.exe 8572 TASKKILL.exe 7000 TASKKILL.exe 4128 TASKKILL.exe -
Modifies Control Panel 8 IoCs
Processes:
QHSafeMain.exeDesktopPlus64.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Control Panel\Mouse\mousehovertime = "100" QHSafeMain.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Control Panel\Desktop\WindowMetrics DesktopPlus64.exe Set value (str) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Control Panel\Desktop\WindowMetrics\Shell Icon Size = "33" DesktopPlus64.exe Set value (str) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Control Panel\Desktop\WindowMetrics\Shell Icon Size = "32" DesktopPlus64.exe Set value (str) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Control Panel\Desktop\WaitToKillAppTimeout = "10000" QHSafeMain.exe Set value (str) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Control Panel\Desktop\HungAppTimeout = "3000" QHSafeMain.exe Set value (str) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Control Panel\Desktop\AutoEndTasks = "1" QHSafeMain.exe Set value (str) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Control Panel\Desktop\MenuShowDelay = "0" QHSafeMain.exe -
Processes:
IEXPLORE.EXEmsiexec.exeexplorer.exeiexplore.exeExplorer.EXEQHSafeMain.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER\Skype.exe = "6" msiexec.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Skype.exe = "11001" msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2565034803" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" Explorer.EXE Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER msiexec.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.22000.1\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432162348" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Main\NoUpdateCheck = "1" QHSafeMain.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CC957078-B838-47C4-A7CF-626E7A82FC58} msiexec.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Main explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Toolbar Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Explorer.EXE Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\Skype.exe = "6" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER\iexplore.exe = "10" QHSafeMain.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CC957078-B838-47C4-A7CF-626E7A82FC58}\Compatibility Flags = "1024" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024" iexplore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER\SkypeBrowserHost.exe = "6" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\iexplore.exe = "10" QHSafeMain.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Version Vector msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\SkypeBrowserHost.exe = "10001" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{830690FC-BF2F-47A6-AC2D-330BCB402664} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{830690FC-BF2F-47A6-AC2D-330BCB402664}\Compatibility Flags = "1024" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Main\SearchBandMigrationVersion = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31129187" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Recovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9" iexplore.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
net_updater32.exeQHActiveDefense.exeMsiExec.exeDrvInst.exemsiexec.exedescription ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates net_updater32.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 010000000000000021bccfd545feda01 QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed net_updater32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs net_updater32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates net_updater32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections net_updater32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA net_updater32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs net_updater32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs net_updater32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates net_updater32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust QHActiveDefense.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{289AF617-1CC3-42A6-926C-E6A863F0E3BA} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 0100000000000000266ecfd545feda01 QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\360Safe\360Scan\NetProbe QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\360Safe\360Scan QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs net_updater32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs net_updater32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot net_updater32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA net_updater32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs net_updater32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot QHActiveDefense.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates net_updater32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs net_updater32.exe -
Modifies registry class 64 IoCs
Processes:
BonziBuddy432.exechrome.exeBonziBDY_4.EXEmsiexec.exeBonziBDY_35.EXEexplorer.exeExplorer.EXEuninstall.exeAgentSvr.exeregsvr32.exeregsvr32.exeWinRAR.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{916694A9-8AD6-11D2-B6FD-0060976C699F}\ = "RegiCon" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Threed.SSRibbon.3 BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{311CFF50-3889-11CE-9E52-0000C0554C0A}\TypeLib BonziBuddy432.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Implemented Categories BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DACB7A39-CC0D-4B85-908B-10D2451761A5}\TypeLib\Version = "1.4" BonziBDY_4.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\InprocServer32\ThreadingModel = "Apartment" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{972DE6C2-8B09-11D2-B652-A1FD6CC34260}\ProgID BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{065E6FE5-1BF9-11D2-BAE8-00104B9E0792}\TypeLib\ = "{065E6FD1-1BF9-11D2-BAE8-00104B9E0792}" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E91E27A3-C5AE-11D2-8D1B-00104B9E072A}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B42750B-57A1-47E7-B340-8EAE0E3126A4}\InprocServer32\ = "C:\\PROGRA~2\\COMMON~1\\Skype\\SKYPE4~1.DLL" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Skype4COM.ConferenceCollection.1\CLSID\ = "{3506CDB7-8BC6-40C0-B108-CEA0B9480130}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{065E6FEA-1BF9-11D2-BAE8-00104B9E0792}\ = "DSSPanel" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4043742-AC8D-4F86-88E9-F3FD3369DD8C}\TypeLib\Version = "1.1" BonziBDY_35.EXE Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0EF6FD5D-607D-4EA3-9C90-683D73449E9D}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8CB09087-E389-4C6D-A6A2-7D4BCA8545D9} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C247F26-8591-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" BonziBuddy432.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74A569CF9384AC046B81814F680F246C\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908} BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FE9-1BF9-11D2-BAE8-00104B9E0792}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{82D97F2A-0E17-40F3-8E01-24937F936FF4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\Programmable BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FD8-1BF9-11D2-BAE8-00104B9E0792}\MiscStatus BonziBuddy432.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\LogicalViewMode = "1" Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{29D9184E-BF09-4F13-B356-22841635C733}\1.0\0\win32\ = "C:\\Program Files (x86)\\BonziBuddy432\\BonziCheckers.ocx" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8BDFA162-B97D-4320-A2E4-A53EADB60F60}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E91E27A2-C5AE-11D2-8D1B-00104B9E072A}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E91E27A3-C5AE-11D2-8D1B-00104B9E072A}\InprocServer32 BonziBuddy432.exe Set value (data) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 020000000100000000000000ffffffff Explorer.EXE Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{5E541E71-A474-4EAD-8FCB-24D400D023B7}\VersionIndependentProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SSCalendar.SSDateComboCtrl.1\CLSID\ = "{EB52CF7B-3917-11CE-80FB-0000C0C14E92}" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF1B5D50-3C5C-48CE-B991-0E86D26F6F5E}\VersionIndependentProgID BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7B93CA0-7B81-11D0-AC5F-00C04FD97575}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" AgentSvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC66B00F-14FB-4CA5-9A12-574998BAF005}\1.0\FLAGS\ = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE11629C-36DF-11D3-9DD0-89D6DBBBA800}\Insertable BonziBuddy432.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{885A186E-A440-4ADA-812B-DB871B942259} Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{28E4193C-F276-4568-BCDC-DD15D88FADCC}\ProxyStubClsid32 BonziBDY_4.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4ABF875-8100-11D0-AC63-00C04FD97575}\ = "IAgentCtlUserInput" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E27A73-69F0-11CE-9425-0000C0C14E92}\TypeLib\ = "{E8671A8B-E5DD-11CD-836C-0000C0C14E92}" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageListCtrl BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\74A569CF9384AC046B81814F680F246C\SourceList\Net\1 = "C:\\ProgramData\\Skype\\{FC965A47-4839-40CA-B618-18F486F042C6}\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{065E6FE2-1BF9-11D2-BAE8-00104B9E0792} BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04E-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32 BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D45FD31D-5C6E-11D1-9EC1-00C04FD7081F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9B9C33A-49A6-41D5-B13F-2AA4F284F406}\TypeLib\ = "{03282B5D-B38F-469D-849A-09B0A7F4881B}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F825FE12-9826-4BD2-BF7E-1ED95B8480FE}\TypeLib\Version = "1.0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ActiveSkin.ComMoveSize BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BonziBUDDY.clsBBPlayer\ = "BonziBUDDY.clsBBPlayer" BonziBDY_35.EXE Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{6AC51E9C-7947-4B46-A978-0AD601C4EFC9}\ProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2BC8C53B-3312-4A77-AC87-31DF18A1EC51}\TypeLib\ = "{03282B5D-B38F-469D-849A-09B0A7F4881B}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4BAC124B-78C8-11D1-B9A8-00C04FD97575}\InprocServer32\ = "C:\\Windows\\msagent\\AgentMPx.dll" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{B09AC3FF-0D5D-41C6-A34E-7C3F58A3127C} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{6CB8E0B5-CD63-4666-B8DA-F84E5CFB7052} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageListCtrl\ = "Microsoft ImageList Control, version 6.0" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ActiveTabs.SSTabs\CurVer\ = "ActiveTabs.SSTabs.2" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BF0-7DE6-11D0-91FE-00C04FD701A5}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A983C9EC-D73E-4364-B89B-ACD1E405674F}\VersionIndependentProgID\ = "Skype4COM.Conference" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F04A-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32 BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D0ECB27-9968-11D0-AC6E-00C04FD97575}\ = "IAgentCtlCommandsWindow" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7B93C89-7B81-11D0-AC5F-00C04FD97575}\TypeLib\ = "{A7B93C73-7B81-11D0-AC5F-00C04FD97575}" AgentSvr.exe -
Processes:
updroots.exeupdroots.exeQHSafeMain.exeWscReg.exeVPNMaster.exe360SecureBrowser.exe360InstantSetup.exesetup.exe360TS_Setup.exeupdroots.exedescription ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\150332A58DC591FC42D4C873FF9F1F0F81D597C9\Blob = 0b00000001000000200000004300410020004400410054004500560020005300540044002000300031000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030906082b0601050507030406082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000150332a58dc591fc42d4c873ff9f1f0f81d597c920000000010000000c04000030820408308202f0a00302010202106b1f3632189d2d6fdbca19486fd4140b300d06092a864886f70d0101050500303a310b30090603550406130244453111300f060355040a0c0844415445562065473118301606035504030c0f434120444154455620535444203031301e170d3039303130393131343233305a170d3137303130393133343233305a303a310b30090603550406130244453111300f060355040a0c0844415445562065473118301606035504030c0f43412044415445562053544420303130820122300d06092a864886f70d01010105000382010f003082010a028201010097e3ceecc420fa30928aaefb8b8f41bd3d9c652085fdbf4dfb4831748d7c99d11ffa33bcb654d7a824efce46c7600d19aa36698bb8dfa83241d338079d4c0c41294bf7a675289b7003b8fb8b9c70cb1d563e6bfc65b19082cf1e15a9c005735cbbbd681a64c9a26db6bdd1e62e92f9129d4c0c87d6dc53be8706709d73ab168b2e729ac47ed04f0ab6ef162cb27a78b8eb607cb23ea534e8eea460cdba612576f513c55b42b922d220b62d17ce58cdf3b0e3efd3a4d647abc7695f65b8c250c26460c9c009b786afdb8cdc4b5735ecb3c676cf372526971688856fbea079af7b8b63c6a7b4fb71fd7dee33f6b054e9ac8b797085403ccaf34e909ef2b1dff9850203010001a382010830820104300e0603551d0f0101ff04040302010630710603551d23046a30688014eb5bb204fe9cf2f892513b2cef53b1b3cad5cd09a13ea43c303a310b30090603550406130244453111300f060355040a0c0844415445562065473118301606035504030c0f43412044415445562053544420303182106b1f3632189d2d6fdbca19486fd4140b301d0603551d0e04160414eb5bb204fe9cf2f892513b2cef53b1b3cad5cd0930120603551d130101ff040830060101ff020100304c0603551d20044530433041060604008f7a01023037303506082b060105050702011629687474703a2f2f7777772e64617465762e64652f7a6572746966696b61742d706f6c6963792d737464300d06092a864886f70d01010505000382010100881a146e8050b6917560458e53d1b379cd881b7340e86387f31ce3422e5b7c122dca9861b3e1189cda1b5448d94b8fa368503d2187bb89779929c2228d8ad4656a5d27328b1a5076138792c94c2499a591930216ea00f3a6afe17804e3750be06d764eae1a6afe67229dadcbeeb2e74ac1fc5b5686c3255d1e544ed7fb6898d366e0aab70bd5626f21248dbaf59e52beacd5eeb454ca45d50f25946d0b8854389b0325172be417a383d1d13deedfada1ddef991da720895ab7f45caffa380e09a393ec509e660b5699541d9ab62a0a94ddbffa8e5712181fb0fdb36f48302970e9a60ad2aba381ae119a35f4a1432f0d5d4da04289be2600e39039bfb994304b updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4\Blob = 030000000100000014000000afe5d244a8d1194230ff479fe2f897bbcd7a8cb4090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b000000010000000e00000043004f004d004f0044004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c02000000001000000dc050000308205d8308203c0a00302010202104caaf9cadb636fe01ff74ed85b03869d300d06092a864886f70d01010c0500308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f72697479301e170d3130303131393030303030305a170d3338303131383233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a3423040301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201000af1d54684b7ae51bb6cb24d411400934c9ccbe5c054cfa0258e02f9fdb0a20df520983c132dac56a2b0d67e1192e92eba9e2e9a72b1bd19446c6135a29ab41612695a8ce1d73ea41ae82f03f4ae611d101b2aa48b7ac5fe05a6e1c0d6c8fe9eae8f2bba3d99f8d8730958466ea69cf4d727d395da3783721cd373e0a2479903385dd5497900291cc7ec9b201c0724695778b239fc3a84a0b59c7c8dbf2e936227b739da1718aebd3c0968ff849b3cd5d60b03e3579e14f7d1eb4fc8bd8723b7b6494379855cbaeb920ba1c6e868a84c16b11a990ae8532c92bba10918750c65a87bcb23b71ac22885c31bffd02b62efa47b099198678c1401cd68066a6321750380888a6e81c685f2a9a42de7f4a524104783cacdf48d7958b1069be71a2ad99d01d7947ded034acaf0dbe8a9013ef55699c91e8e493dbbe509b9e04f49923d168240cccc59c6e63aed122e693c6c95b1fdaa1d7b7f86be1e0e3246fbfb138f757f4c8b4b4663fe00344070c1c3b9a1dda670e204b341bce98091ea649c7ae12203a99c6e6f0e654f6c87875ef36ea0f975a59b40e853b2279d4ab9c077218dff87f2debc8cef17dfb7490bd1f26e300b1a0e4e76ed11fcf5e956b27dbfc76d0a938ca5d0c0b61dbe3a4e94a2d76e6c0bc28a7cfa20f3c4e4e5cd0da8cb9192b17c85ecb51469660e82e7cdcec82da6517f21c1355385064a5d9fadbb1b5f74 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F44095C238AC73FC4F77BF8F98DF70F8F091BC52\Blob = 030000000100000014000000f44095c238ac73fc4f77bf8f98df70f8f091bc52090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000003c000000430065007200740050006c0075007300200043006c00610073007300200033005400530020005000720069006d006100720079002000430041000000200000000100000087030000308203833082026ba003020102021100af3f646b56028666c6d843f94b7d96cf300d06092a864886f70d0101050500303f310b30090603550406130246523111300f060355040a130843657274706c7573311d301b06035504031314436c61737320335453205072696d617279204341301e170d3939303730373137313430305a170d3139303730363233353935395a303f310b30090603550406130246523111300f060355040a130843657274706c7573311d301b06035504031314436c61737320335453205072696d61727920434130820122300d06092a864886f70d01010105000382010f003082010a0282010100bd659a2343003cf9250143985b4634376737f45b578ea3decd8c2f41b3153de5988bf2cc5ca7c7af35c7b3a74fc7102957e903898372067652c170023740edf0ce8bb1b189ac02a85bdddcd5434506dc28b6e9511b6aeef37b48c59d11ae8da67293c0254291a83e46e2684c8140b042d37abe7b47d247500ca412a6cae412d0c07c3a3c01a9ca0296de825ac5fb19ba3c9cd80f741f9818ae945032075210114a4bec58552cd49e4b947b05d272df06f08dcb089ee4eeb444ad82f11b616af1b3f81631364224ba90bfb57e616ec2590c5479b44c88281ecc1bdf848b23c8beaf07f291b2da8dca8c5f7c283c7c896c0659bd3ecec582d36ac9ac6855eec5af0203010001a37a3078300f0603551d13040830060101ff02010a300b0603551d0f040403020106301d0603551d0e04160414a2760e39786b8fba2d714a08f7a27b6e00a2642530390603551d1f04323030302ea02ca02a8628687474703a2f2f7777772e63657274706c75732e636f6d2f43524c2f636c6173733354532e63726c300d06092a864886f70d01010505000382010100b59f689cc492f0777c13c215bc1cd40e6e7428a1fa86d2081b25fce47bd97dd30258676f046e50ee7b4a010263bf4236d6be0cfe220c993d8ef3ae1d94d6aaeaa63de3439e47bb09c9cbeecea12c0faa7cdf7c7392e54bb904c43bdb20fe60f90c6e781a3d48d7274898b591aca4dc22b3e79d5fece54062268f7a17c6eafb0ad6435b90db3616ed982e9e5fac1407822a50bfa6bf6fa6073472b66168ec5198195377e8c8bff6217bbcb0de7f743af91534389afb8933f0120d9fe8f1966df61d487e3e12effa066759deb3b2d6970b3b405742b2c17bc66dd826523425d285b6a10a0addaa94aa4e7b2093dda4804356cfb6c4e058e96c958f626e5806af78 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\ACED5F6553FD25CE015F1F7A483B6A749F6178C6\Blob = 030000000100000014000000aced5f6553fd25ce015f1f7a483b6a749f6178c609000000010000004a000000304806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030706082b06010505070306060a2b0601040182370a030406082b060105050703080b000000010000005c0000004e00650074004c006f0063006b0020004b006f007a006a006500670079007a006f0069002000280043006c006100730073002000410029002000540061006e007500730069007400760061006e0079006b006900610064006f0000002000000001000000810600003082067d30820565a00302010202020103300d06092a864886f70d01010405003081af310b30090603550406130248553110300e0603550408130748756e676172793111300f06035504071308427564617065737431273025060355040a131e4e65744c6f636b2048616c6f7a617462697a746f6e73616769204b66742e311a3018060355040b131154616e7573697476616e796b6961646f6b313630340603550403132d4e65744c6f636b204b6f7a6a6567797a6f692028436c6173732041292054616e7573697476616e796b6961646f301e170d3939303232343233313434375a170d3139303231393233313434375a3081af310b30090603550406130248553110300e0603550408130748756e676172793111300f06035504071308427564617065737431273025060355040a131e4e65744c6f636b2048616c6f7a617462697a746f6e73616769204b66742e311a3018060355040b131154616e7573697476616e796b6961646f6b313630340603550403132d4e65744c6f636b204b6f7a6a6567797a6f692028436c6173732041292054616e7573697476616e796b6961646f30820122300d06092a864886f70d01010105000382010f003082010a0282010100bc748c0fbb4cf4371ea90582d8e6e16c70ea78b56ed138440da883ce5dd2d6d581c5d44be75b947026db3b9d6a4c62f771f364d6613b3deb73a337d9cfea8c923bcdf707dc667497f44522ddf45ce0bf6df3be6533e4153abfdb98905538c4eda655630bb07804f4e36ec13f8efc51781f929e83c2fed9b0a9c9bc5a00ffa9a89874fbf62c3e15390db60455a80e982042b3b125ad7e9a6f5d53b1ab0cfcebe0f37ab3a8b3ff46f663a2d83a987bb6ac85ffb0254f7463e71307a50a8f05f7c0646f7ea7278096ded42e8660c76b2b5e737b17e7913f640cd84b22342b9b32f2481f9fa10a847ae2c2ad973d8ed5c1f956a350e9c6b4fa98a2ee95e62a038cdf0203010001a382029f3082029b300e0603551d0f0101ff04040302000630120603551d130101ff040830060101ff020104301106096086480186f84201010404030200073082026006096086480186f842010d048202511682024d46494759454c454d2120457a656e2074616e7573697476616e792061204e65744c6f636b204b66742e20416c74616c616e6f7320537a6f6c67616c7461746173692046656c746574656c656962656e206c6569727420656c6a617261736f6b20616c61706a616e206b65737a756c742e204120686974656c65736974657320666f6c79616d617461742061204e65744c6f636b204b66742e207465726d656b66656c656c6f737365672d62697a746f73697461736120766564692e2041206469676974616c697320616c616972617320656c666f6761646173616e616b2066656c746574656c6520617a20656c6f69727420656c6c656e6f727a65736920656c6a61726173206d6567746574656c652e20417a20656c6a61726173206c656972617361206d656774616c616c6861746f2061204e65744c6f636b204b66742e20496e7465726e657420686f6e6c61706a616e20612068747470733a2f2f7777772e6e65746c6f636b2e6e65742f646f63732063696d656e2076616779206b65726865746f20617a20656c6c656e6f727a6573406e65746c6f636b2e6e657420652d6d61696c2063696d656e2e20494d504f5254414e5421205468652069737375616e636520616e642074686520757365206f662074686973206365727469666963617465206973207375626a65637420746f20746865204e65744c6f636b2043505320617661696c61626c652061742068747470733a2f2f7777772e6e65746c6f636b2e6e65742f646f6373206f7220627920652d6d61696c20617420637073406e65746c6f636b2e6e65742e300d06092a864886f70d01010405000382010100482446f7ba566ffac82803404ee531396b266b537fdbdfdff3713d26c0140ec6677b23a80c73dd01bbc6ca6e373955d5c78c56200e280a0ed22aa4b04952c63807febe0a098cd198cfcada1431a14fd239fc0f112c43c3ddab93c7553e477c181a00dcf37bd8f27f526c20f40b5f6952f4eef8b22960ebe34931210dd6b51041e241096ce21a9a564b7702f6a09b9a2787e8552971c2909f45781ae115643dd00ed8a0769faec5d02eead60f56ec647f5a9b145801277e1350c76b2ae6683cbf5ca00a1be10e7ae9e280c3e9e9f6fd6c119ed0e528272b543242148275e64af02b6675638ca2fb043e830e9b36f018e42620c38cf02807ad3c176688b5fdb688 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\25019019CFFBD9991CB76825748D945F30939542 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\101DFA3FD50BCBBB9BB5600C1955A41AF4733A04 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\912198EEF23DCAC40939312FEE97DD560BAE49B1\Blob = 030000000100000014000000912198eef23dcac40939312fee97dd560bae49b1090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b000000010000002e00000056006500720069007a006f006e00200047006c006f00620061006c00200052006f006f0074002000430041000000200000000100000079030000308203753082025da003020102020101300d06092a864886f70d01010b0500305c310b300906035504061302555331193017060355040a0c10566572697a6f6e20427573696e6573733111300f060355040b0c084f6d6e69526f6f74311f301d06035504030c16566572697a6f6e20476c6f62616c20526f6f74204341301e170d3039303733303134323730345a170d3334303733303134323730345a305c310b300906035504061302555331193017060355040a0c10566572697a6f6e20427573696e6573733111300f060355040b0c084f6d6e69526f6f74311f301d06035504030c16566572697a6f6e20476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a02820101008a000c701dbfeb3486c39945351e7f43f7ab6f242dcd19c210bbb0ca295ba920abab722cc4e202396d82b8c511eaf8fbb39e62f8331eb01fc9e3f637db04c83b634f36e285a4251dc7691f04bd68451396071f9450f53ec527549ec04957448e0763d4a6aeed2299cc4d966904136e76899f741694f91d54bda2b9d28301220c4d4480aafe35892725a78689c6d51a92e38fc595a014729ae856c502551c97f9202ed0f53c13195af6e1f90b038269a78cb7d66f9c563e9de82a09606d4be6fb8b9914f7344f6559808db957c8a23521d88871565dee82572d2690189f9a9c9c8fefd4c563a7547d4791877d1a12a81b186fa96fb127bae40474ce371e7f66c50203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604144c3811b898005b5a2b703eaa78e4d5676767a77e300d06092a864886f70d01010b05000382010100015fa0b10601f479d76518603ecf79a0bac2234f23df87965f810e38152e5cc802682920fc8beea58a1881645c98357e393082a4828a50b5bac3e85ad6a89ee2c317dbdbc4ebb00a200de99ee3ff605447f13b9dd4283ca2aea3fbaa8b82222a358790b81c594790d59d2efa49e365a836ebc7e41c68dcb3316cab4ece248015c810591011724d7a9c989cc4fc61e0b3b29d4ea0c6c259ab18d6a25545ec29aa2537d64e4a3d0b40c1e493e4fccd910bf8e6abccb376c462bf19ed86b679c3295454bc997d4657cfa6cff4542a9a03654701a1422acb25476e7c5e004b91d9f91b100670f94215a65faad7401efdc9489d9781ea5c68c2a0e789a1534dbfc7e3 updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419 QHSafeMain.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\37F76DE6077C90C5B13E931AB74110B4F2E49A27 QHSafeMain.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE\Blob = 040000000100000010000000ce0490d5e56c34a5ae0be98be581185d0f0000000100000020000000279cd652c4e252bfbe5217ac722205d7729ba409148cfa9e6d9e5b1cb94eaff1140000000100000014000000722d3a02319043b914054ee1eaa7c731d1238934190000000100000010000000bb048f1838395f6fc3a1f3d2b7e976540300000001000000140000008f43288ad272f3103b6fb1428485ea3014c0bcfe2000000001000000f1050000308205ed308203d5a00302010202103f8bc8b5fc9fb29643b569d66c42e144300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131303332323232303532385a170d3336303332323232313330345a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100b28041aa35384d13723268224db8b2f1ffd552bc6cc7f5d24a8c36eed1c25c7e8c8aaeaf13286fc073e33aced025a85a3a6defa8b859ab132368cd0c2987d16f805c8f447f5d90015258ac51c55f2a87dcdcd80a1dc103b97bb056e8a3de6461c29ef8f37cb9ec0db554fe4cb6654f88f09c48990c420b097c315917790678288d893a4c0325be716a5c0be78460a49922e3d2af84a4a7fbd198ed0ca9de9489e10ea0dcc0ce993dea0852bb5679e41f84ba1eb8b4c4495c4f314b87dddd0567269980e07111a3b8a541e2a453b9f73229830c13bf365e04b34b43472f6be2911ed3984fdd4207c8e81d12fc99a96b3e927ec8d6693afc64bdb6099dcafd0c0ba29b77604b0394a4306912d6422dc1414ccadcaafd8f5b83469ad9fcb1d1e3b3c97f487acd24f0418f5c74d0acb010200649b7c72d21c857e3d086f30368fbd0ce71c189994a64016cfdec3091cf413c92c7e5ba861d6184c75f833962aeb4922f47f30bf855eba01f59d0bb749b1ed076e6f2e906d710e8fa64de69c635968802f046b83f27996fcb71892935f7481602358fd5797c4d02cf5feb8a834f457188f9a90d4e72e9c29c07cf491b4e040e63518c5ed800c1552cb6c6e0c2654ec93439f59cb3c47ee8616e135f15c45fd97eed1dceee44eccb2e86b1ec38f670edab5c13c1d90f0dc780b255ed34f7ac9be4c3dae7473ca6b58f31dfc54bafebf10203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414722d3a02319043b914054ee1eaa7c731d1238934301006092b06010401823715010403020100300d06092a864886f70d01010b050003820201007f72cf0fb7c515db9bc049ca265bfe9e13e6d3f0d2db975ff24b3f4db3ae19aeedd797a0acefa93aa3c241b0e5b8919e13812403e609fd3f574039212456d1102f4b40a936864bb453579afbf17e898f11fe186c51aae8ed0995b5e571c9a1e98775a6157fc97e37545e7493c5c367cc0d4f6ba8170c6d08927e8bdd81aa2d7021c33d0614bbbf245ea784d73f0f2122bd4b0006db971cd85ed4c50b5c876e50a4e8c338a4fbcb2cc592669b855ecb7a6c937c8029585b57b54069ba0879a66462159d879645b5662320038b1c73a0d3a27933e0505986db2fe50225ea732a9f0014c836c7923be94e00ecd85609b9334912d2540b01abac47b691297d4cb475805201e8ca82f69fccac9c8f17ea2f26b0ab72ac0bfe9e511ec74355674f51b357d6b6ecee52b73ae94ee1d78188bc4f8e75bb4ba8f035aa26d4676749b2704c3b93dc1ddf78908672b238a4d1dc924dc958eb2b125cd43bae8c6bb083e5013ff80932f693353422afdd370d7709802bcd4800f18c9919470501e9d1bfd14ed0e628433799a40a4a08d99a7173d2aacd31136376a1376f92381e7d123c6632e7cb6de1fc5289ddcad666059a9661bea228c71ca3a736503c3aa4df4a6ee6873bceebf0e081379d133c528ebdb91d34c61dd50a6a3d9829708c892ad1ab8210481fdcf4efa5c5bb551a3863844eb76cad9554ec6522104917b8c01ec70fac5447 WscReg.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F\Blob = 0b000000010000001600000043004e004e0049004300200052006f006f0074000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070300000001000000140000008baf4c9b1df02a92f7da128eb91bacf498604b6f200000000100000059030000308203553082023da003020102020449330001300d06092a864886f70d01010505003032310b300906035504061302434e310e300c060355040a1305434e4e4943311330110603550403130a434e4e494320524f4f54301e170d3037303431363037303931345a170d3237303431363037303931345a3032310b300906035504061302434e310e300c060355040a1305434e4e4943311330110603550403130a434e4e494320524f4f5430820122300d06092a864886f70d01010105000382010f003082010a0282010100d335f73f7377ade85b7317c2d16fed55bc6eeae8a479b26cc3a3efe19fb13b4885f59a5c2122102cc582cedae39a6e37e1872cdcb90c5aba8855dffdaadb1f31ea01f1df3901c113fd485221c455dfdad8b35476ba74b1b77dd7c0e8f659c54dc8bdad1f14dadf58442532192ac77e7e8eae38b0307b47720931f030dbc31b7629bb69764e57f91b64a29356b76f996edb0a049c11e3801fcb6394100aa9e1648231f98c27eda69900f6709318f8a13486a3dd7ac21879f67a6535cf90ebbd33939f53ab733be69b34202f1defa91d631aa080db032ff9261a86d28dbba9be523a8767480dbfb4a0d826be235f73377f26e69204a37fcf20a7b7f33acacb99cb0203010001a3733071301106096086480186f8420101040403020007301f0603551d2304183016801465f231ad2af7f7dd52960ac702c10eefa6d53b11300f0603551d130101ff040530030101ff300b0603551d0f0404030201fe301d0603551d0e0416041465f231ad2af7f7dd52960ac702c10eefa6d53b11300d06092a864886f70d010105050003820101004b35eecce4aebfc36ead9f953b4b3f5b1edf5729a259ca38e2b91aff9ee66e32dd1eaeea35b7f593914eda42e1c3176050f2d15c26b982b7ea6de49c84e7037917af983d94dbc7ba00e7b8bf0157c17745320c3bf1b41c08b0fd51a0a1dd9a1d13369a6db7c73cb9e1c5d917fa83d53d15a03cbb1e0be2c8903fa8860cfcf98b5e85cb4f5b4b621147c5457c052f41b19e10691b9996e05579fb4e8699b894da86386a93a3e7cb6ee5dfea2155899c7d7d7f98f50089eee384c05c96b5c546ea46e08555b61bc912d6c1cdcd80f302013cc869cb454863d894d0ec850e3b4e1165f4828ca63dae2e229409c85cea3c815d162a0397165509db8a41829e669b11 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7B4C065DFFB0A9C9DD861958E70400E591159874 VPNMaster.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0281400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc5300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f 360SecureBrowser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\EDB3CB5FB419A185066267E5791554E1E28B6399 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2E14DAEC28F0FA1E8E389A4EABEB26C00AD383C3\Blob = 0300000001000000140000002e14daec28f0fa1e8e389a4eabeb26c00ad383c3090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b0000000100000016000000430065007200740069006e006f006d006900730000002000000001000000a00500003082059c30820384a003020102020101300d06092a864886f70d01010505003063310b300906035504061302465231133011060355040a130a43657274696e6f6d697331173015060355040b130e30303032203433333939383930333126302406035504030c1d43657274696e6f6d6973202d204175746f726974c3a920526163696e65301e170d3038303931373038323835395a170d3238303931373038323835395a3063310b300906035504061302465231133011060355040a130a43657274696e6f6d697331173015060355040b130e30303032203433333939383930333126302406035504030c1d43657274696e6f6d6973202d204175746f726974c3a920526163696e6530820222300d06092a864886f70d01010105000382020f003082020a02820201009d859f86d3e3afc7b26b6e33e09eb74234559df981be63d823760e9754cd994c1af139c788d817500c9e61dac04e55dee75ab87a4e77870de5b8ebfa9e5e7b1ec4cf2874c793f514c6222804f991c3ab27736a0e2e4df32e281f70df552f4eedc7716f09722eedd53297d0f15877d160bc4e5edb9a84f64761452bf650a67f6a71274884359eacfe69a99e7a5e3525fab4a749357796a7365be1cddf2370d85d4ca50883f1a6243813a8ec2fa8a167c7a62d8647ee8afcec9b0e74f42b49027b90758cfc99390139d64a89e59e76ab3e962838268bdd8d8cc0f6011e6fa53112387d95c271eeed74aee436a24375d5f1009be2e4d7cc42034b787ae57dbbb8ae2e2093d3e461df71e17667973fb6df6a735a6422e542dbcf810393d8f4e310e072f60070acf0c17a0f057fcf346945b593e419db52162305890e8d48e4256fb378bf62f507fa9524c296b2e8a323c25d03fcc3d3e57cc97523d7f4f5bcdee4dfcd80bf91887da713b439ba2cbabdd16bccf3a528ed449e7d52a36f962e197e1cf35bc7168ebb607d77664754820011606c32c1a8381beb6e9813d6ee38f5f09f0eeffe3181c1d224952f537a69a2f00f86458e58822b4c22d45ea0e77d262748df25468d4a287c869ef99b1a59b965bf05ddb6425d3de60048825e20f71182decad89fe63747261eeb78f761c34164580241f9dae0d1f8f9e8fd5238b6f589df0203010001a35b3059300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604140d8cb661da44b8d1147dc3be7d5e48f0ceca6ab030170603551d200410300e300c060a2a817a01560202000101300d06092a864886f70d01010505000382020100243e60067e1def3a3edbeaaf1c9a2c010bf4c5b5d94931f45d418d890c4eff6ca2fdffe206c8399ff15aa9dd225815a88ad3b1e6320982036cd73f08c7f8b9ba006db9d6fc52325da47fa43194bbb64c387f283035ff9f2353b7b6ee147000402bda47ab347e5ea75630612b8b43acfdb68828f56bb63e604aba429034678deaeb5f45543b17ac8be4c6650feed08c5d6639ce32a7d81097c07e349c9f94f3f6861fcf1b73ad9479876870c333a570e7d8d538946f6379ebbf0a0e08e7c52f0f42a02b1440ff21e005c527e1841113bad6861d410b132389d3c90be88aba7aa3a3733735807d12b833774038c0fa5e30d2f2b6a3b1d6a29597819b52ed694cff80e453db545b036d545fb1b8ef24bd6f9f11c3c764c20f286285665e1a7bb2b7efae35c91933a8b827db3355bf68e175484456fbcdd348bb47893aac69f580c6e444502f54c4aa43c5313158bd96c5ea756c9a75b14df8f797ff9616f2974de8f6f311f93a7d8a386e04cbe1d34515aaa5d11d9d5d63e824e63614e287ad1b59f5449bfbd7777c1f017062a1201aa2c51a28f42103ee2ed9c180eab9d982d65b76c2cb3bb5d200f0a30ee1ad6e40f7dba0b4d046ae15d744c24d35f9d20bf217f6ac66d524b24fd11c99c06ef57deb7404b8f94d7709d7b4cf073009f1b80056d91716160a2b86df8f01191ae5bb8263ffbe0b76165e3737e6d87497a2994579 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8B1A1106B8E26B232980FD652E6181376441FD11\Blob = 0300000001000000140000008b1a1106b8e26b232980fd652e6181376441fd1109000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703090b0000000100000022000000430065007200740069006300e1006d00610072006100200053002e0041002e00000020000000010000001504000030820411308202f9a003020102020101300d06092a864886f70d010105050030818c310b300906035504061302434f311f301d060355040713164361727265726120392031362d323120426f676f746131323030060355040a1329436572746963616d61726120532e412e20456e74696461642064652043657274696669636163696f6e312830260603550403131f436572746966696361646f20456d70726573617269616c20436c6173652d41301e170d3031303532333232303030305a170d3131303532333232303030305a30818c310b300906035504061302434f311f301d060355040713164361727265726120392031362d323120426f676f746131323030060355040a1329436572746963616d61726120532e412e20456e74696461642064652043657274696669636163696f6e312830260603550403131f436572746966696361646f20456d70726573617269616c20436c6173652d4130820122300d06092a864886f70d01010105000382010f003082010a0282010100afcabc86bad29bb76a57e70d1435816d3ee181ae40084153f8ba404d284a8831cbd257fb2b6f035c0d181caf51df1a43ea9e0c0127a045c9b34e0fd4f9e75c545a74a0fa3bd3a7e4f992be61720eedf5607a944f28613529f95d16af3db8e7c3708c484656af3e88b35cdfc5586e476e93355c508c230bdc5979e7b70a1179e05ac33fdf8cab32499f09add9f4202369377fee8816a6da674e1d4b4099187429703fedeefb10a3d59fc6848d05b15c018218b3f046c9432d860df3b86a95e917e0cc1ec13df1736e537214213589c397677e9853aa8ea457a33e92b7efd59f8c56e025c5d5fee74cf3eba83ab96e6c0e64e09f36fbfa4c630a0475def3dd7f430203010001a37c307a30250603551d11041e301c861a687474703a2f2f7777772e636572746963616d6172612e636f6d300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301106096086480186f8420101040403020007301d0603551d0e0416041453791f6d07cf7e40b7104ef3c8a2d89d412d2b21300d06092a864886f70d010105050003820101009c6e0cf3d8db6d72d2b8a5e9e892ce1fbb8c9edff1537645eb00cb44f5a6bafa91a59ee6e23127d963cfd121aa21be21be8af371b8c9b3380f19c6b37b97f95efe753b845729e72aeabbed349ef9e4a32489820aa597497c28cfe333b27bd1422ae177f70466e00445d7a7d4e62ef2bcbbddb5c7e34feabcf29a92e59c2832063850d6155ba27cb99a4c40402f21e0d236b653ef7954cd02b697d3db5c98e1a34a728337eb597387100b4a416748597115ec6e909c65856748375df87965ad9f1b599179509557a48d3e51fe72bededf51fdd6ba3804ba20ea64894744e32e072092c19919373ff0bece33e32d1de4e18af913e4b76ce8f2ec877f60fba4cdc1 updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F5C27CF5FFF3029ACF1A1A4BEC7EE1964C77D784 QHSafeMain.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE 360InstantSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\027268293E5F5D17AAA4B3C3E6361E1F92575EAA updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D2441AA8C203AECAA96E501F124D52B68FE4C375\Blob = 0b000000010000005200000049002e00430041002000132020005100750061006c00690066006900650064002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000d2441aa8c203aecaa96e501f124d52b68fe4c3752000000001000000220500003082051e30820406a003020102020400a037a0300d06092a864886f70d01010b05003081b7310b300906035504061302435a313a303806035504030c31492e4341202d205175616c69666965642043657274696669636174696f6e20417574686f726974792c2030392f32303039312d302b060355040a0c245072766ec3ad20636572746966696b61c48d6ec3ad206175746f726974612c20612e732e313d303b060355040b0c34492e4341202d20416363726564697465642050726f7669646572206f662043657274696669636174696f6e205365727669636573301e170d3039303930313030303030305a170d3139303930313030303030305a3081b7310b300906035504061302435a313a303806035504030c31492e4341202d205175616c69666965642043657274696669636174696f6e20417574686f726974792c2030392f32303039312d302b060355040a0c245072766ec3ad20636572746966696b61c48d6ec3ad206175746f726974612c20612e732e313d303b060355040b0c34492e4341202d20416363726564697465642050726f7669646572206f662043657274696669636174696f6e20536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100b53684cb4282f0cf65e2549a58732ce3eb155752f0cf225888840d782aefd471e6fd8a4621d63f67ae3471e6a792342f217ee6db704ae0e482e8a3bc919600df3a293b3e8614238a5763ef2ee91b73e7368a617a90b1c4bfaa8d03c5b184f6d1df12b09470f0076ca15b3a3b577415803446f37b2e82a427b4a602dcb9e54c66c9a4d3fe033ef68293bd007527fc8061164e24b1cf25612d8bf460b2f42b2674a4813fbf29f70f0bc7bbc32ea90382dd7fcc1adc51699249bec013f04f11e32bc9057521d23a9e51a70615a45ce61fe8649d6b2270f3a6edbb10bbbe20ca36b6e9e381e3411692c67a7a3b77ada35c780df898770fd86c915eec48e4c52401cb0203010001a382012e3082012a300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201063081e70603551d200481df3081dc3081d90604551d20003081d03081cd06082b060105050702023081c01a81bd54656e746f20636572746966696b6174206a6520767964616e206a616b6f206b76616c6966696b6f76616e792073797374656d6f767920636572746966696b617420706f646c65207a616b6f6e6120632e203232372f323030302053622e207620706c61746e656d207a6e656e692f54686973206973207175616c69666965642073797374656d206365727469666963617465206163636f7264696e6720746f20437a65636820416374204e6f2e203232372f3230303020436f6c6c2e301d0603551d0e0416041479cbd023e93a677091744fd351e2e020fde128fb300d06092a864886f70d01010b050003820101007d95a536d788586811cf65fb5b0d2ff674818b59d99d49b8f53996c9f0b20f04cc588cfa0432acc047be2dc3de938ba69645ae5674e59a4ba23faa26c42856612405575f99a4c767b01852c9fb41a8f9e4f19e32ce9e1545d95dacfb9edb9bc73c8fafdb4ba223e83b29707118a5f8e387ae21136af4692a590e31b328533a629aac08937ca987b65f5aa618c2d0c2f35d8c6fa73f308938eb94132a485ade79e590cb5ea4b917b66306395fc8366311f4b612cf4876893c6a57f9eb7322f7fa3e05ae3ac0c60e924dcfd48954d11a826a375b9628a8002283ced02ab9b38d53582e655cd5f2db8c0125736c978bfc6001ec4093c1ed51b8aacb62d82530a23d updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\93057A8815C64FCE882FFA9116522878BC536417\Blob = 03000000010000001400000093057a8815c64fce882ffa9116522878bc53641709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030b000000010000001400000041004300430056005200410049005a00310000002000000001000000d7070000308207d3308205bba00302010202085ec3b7a6437fa4e0300d06092a864886f70d010105050030423112301006035504030c09414343565241495a313110300e060355040b0c07504b4941434356310d300b060355040a0c0441434356310b3009060355040613024553301e170d3131303530353039333733375a170d3330313233313039333733375a30423112301006035504030c09414343565241495a313110300e060355040b0c07504b4941434356310d300b060355040a0c0441434356310b300906035504061302455330820222300d06092a864886f70d01010105000382020f003082020a02820201009ba9abbf614a97af2f97669a745fd0d996fdcfe2e466ef1f1f4733c244a3df9ade1fb554dd157c6935116fbbc80c8e6a181ed88fd916bc1048365cf063b3905a5c2437d7a3d6cb0971b9f1017284b07ddb4d80cdfcd36fc9f8dab60e82d24585a81b68a83de8f4446cbda1c2cb03be8c3e130084df4a48c0e3220ae8e937a7184cb1090d23567f044dd9178418a5c8da409473ebce0e573c03813a9d0aa1574369ac576d799078e5b5b43bd8bc4c8d28a1a7a3a7ba024e25d12aaeedae0322b86b200f302854957fe0eece0a669dd1402d6e22af9d1ac10519d26fc0f29ff87bb30242fb50a91d2d930f23abc6c10f92ffd0a215f55309711cff451384e6265ef8e0881c0afc16b6a87306b8f0638402a0c65aece774df70aea38325ead6c7978793a7c68a8a33976037103e973e6e2915d6a10fd1882c129f6faaa4c642eb41a2e39543d301856d8ebb3bf32336c7fe3be0a1250748abc98974ff088f80bfc09665f3eeec4b68bd9d88c331b340f1e8cff638bb9ce4d17fd4e5589b7cfad4f30e9b7591e4ba522e197ed1f5cd5a19fcba06f6fb52a84b9904ddf8f9b48b50a34e6289f08724fa8342c187fad52d292a5a717a646ad72760630ddbce49f58d1f90893217f87343b8d25a938661d6e1750aea796676884f71eb0425d60a5a7a93e5b94b17400fb1b6b9f5de4fdce0b3ac3b117060844a436e9920c029710ac0650203010001a38202cb308202c7307d06082b060105050701010471306f304c06082b060105050730028640687474703a2f2f7777772e616363762e65732f66696c6561646d696e2f4172636869766f732f636572746966696361646f732f7261697a61636376312e637274301f06082b060105050730018613687474703a2f2f6f6373702e616363762e6573301d0603551d0e04160414d287b4e3df37279355f656ea81e536cc8c1e3fbd300f0603551d130101ff040530030101ff301f0603551d23041830168014d287b4e3df37279355f656ea81e536cc8c1e3fbd308201730603551d200482016a30820166308201620604551d2000308201583082012206082b06010505070202308201141e820110004100750074006f0072006900640061006400200064006500200043006500720074006900660069006300610063006900f3006e00200052006100ed007a0020006400650020006c00610020004100430043005600200028004100670065006e0063006900610020006400650020005400650063006e006f006c006f006700ed00610020007900200043006500720074006900660069006300610063006900f3006e00200045006c006500630074007200f3006e006900630061002c002000430049004600200051003400360030003100310035003600450029002e002000430050005300200065006e00200068007400740070003a002f002f007700770077002e0061006300630076002e00650073303006082b060105050702011624687474703a2f2f7777772e616363762e65732f6c656769736c6163696f6e5f632e68746d30550603551d1f044e304c304aa048a0468644687474703a2f2f7777772e616363762e65732f66696c6561646d696e2f4172636869766f732f636572746966696361646f732f7261697a61636376315f6465722e63726c300e0603551d0f0101ff04040302010630170603551d110410300e810c6163637640616363762e6573300d06092a864886f70d010105050003820201009731029fe7fd4367484414e42987ed4c2866d08f35da4d61b74a974db5db90e0052e0ec679d0f297690fbd0447d9bedbb529da9bd9aea999d5d33c3093f58da1a8fc068d44f4ca16957c33dc628ba837f827d8092d1befc8142720a96444ff2ed675aa6c4d60401949435463dae2ccba66e54f447a5bd96a812b40d57ff90127582cc8ed48917c3fa600cfc429731136de86193e9dee198a1bd5b0ed8e3d9c2ac00dd83d66e33c0dbdd5945ce2e2a7351b0400f63f5a8dea43bd5f891da9c1b0cc99e24d000adac9275be713905ce4f533a2556ddce0094d2fb1265b27750009c4627729085f9e59acb67ead9f54302203c11e7164fef9380a9618dd0214ac23cb061c1ea47d8d0dde2741e8adda15b7b023dd2ba8d3da2587ede855444d88f4367e849a78acf70e56490ed63325d68450426c20121d2ad5bebcf27081a47060be05b59b9e0444be6123ace9a5248c1180945aa2a2b949d2c1dcd1a7ed31112c9e19a6eee155e1c0eacf0d84e417b7a27ca5de552506eeccc0875c40dacc953f55e035c7b884beb45dcd7a830172ee87e65f1daeb585c626dfe6c19ae91e02479f2aa86da95bcfec45777f98279a325d2ae384eec598662f96201dddd8c327d7b0f9fed97dcdd09f8f0b1458519f2f8bc3382ddee88fd68d87a4f5564316992cf4a456b434b86137c9c258801ba097a1fc598de911f6d10f4b5534462a8b863b updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5F3B8CF2F810B37D78B4CEEC1919C37334B9C774\Blob = 0300000001000000140000005f3b8cf2f810b37d78b4ceec1919c37334b9c774090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b00000001000000380000005300450043004f004d002000540072007500730074002000530079007300740065006d007300200043006f0020004c00740064002e00000053000000010000002400000030223020060a2a83088c9b1b6485510130123010060a2b0601040182373c0101030200c020000000010000007b030000308203773082025fa003020102020100300d06092a864886f70d01010b0500305d310b3009060355040613024a5031253023060355040a131c5345434f4d2054727573742053797374656d7320434f2e2c4c54442e31273025060355040b131e536563757269747920436f6d6d756e69636174696f6e20526f6f74434132301e170d3039303532393035303033395a170d3239303532393035303033395a305d310b3009060355040613024a5031253023060355040a131c5345434f4d2054727573742053797374656d7320434f2e2c4c54442e31273025060355040b131e536563757269747920436f6d6d756e69636174696f6e20526f6f7443413230820122300d06092a864886f70d01010105000382010f003082010a0282010100d0153952b152b3bac55982c45d52ae3a4365804bc7f296bcdb3697d6a6648ca85ef0e30a1cf7df973d4baef65dec21b541abcdb97e769fbef93e3634a03bc1f631114574933d5780c5f98999cae5ab6ad4b5da419010c1d6d64289c2bff43812954c5405f736e445837b1465d6dc0c4dd1de7e0cab3bc415be3a56a65a6f766952a97ab9c8eb6a9a5d52d02d0a6b3516091084d06aca3a06003747e47e574f3f8beb67b888aac5be5355b291c47db9b0851906782edb611afa85f54a91a1e716d58ea239df94b8701f283f8bfc405e63833c832a1a996bcfde596a3bfc6f16d71ffd4a10eb4e82163aac270c53f1add524b06b0350c12d3c16dd4434271a75fb0203010001a3423040301d0603551d0e041604140a85a9776505987c4081f80f972c38f10aec3ccf300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101004c3aa344acb945b1c7937ec80b0a42df64ea1cee596c08ba895f6aca4a959e7a8f07c5da457282710e3ad2cc6fa7b4a123bbf6249fcb17fe8ca6cec2d2dbcc8dfc71fc0329c16c5d335f64b6653b896f187678f5dca2481f193f8e93ebf1fa17eecd4ee3041255d6e5e4ddfb3e057ce21d5ec6a7bc974f683af5e92e0a43b6af575c62687cb7fda38a84a0ac62be2b098734f06a01bb9b29563cfe0037cf236cf14eaab67446126c91ee34d5ec9a91e744be903172d54902f602e5f41feb7cd99655a9ffec8af99947ff355a02aa04cb8a5b87712991bda4b47a0dbd9af55723000721173f4a39d105490ba7b63781a55d8caa335e81287ca77d27eb00ae8d37 updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\23E594945195F2414803B4D564D2A3A3F5D88B8C QHSafeMain.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D23209AD23D314232174E40D7F9D62139786633A\Blob = 5300000001000000230000003021301f06092b06010401f022010630123010060a2b0601040182373c0101030200c00b0000000100000012000000470065006f00540072007500730074000000090000000100000020000000301e06082b0601050507030406082b0601050507030106082b06010505070303030000000100000014000000d23209ad23d314232174e40d7f9d62139786633a2000000001000000240300003082032030820289a003020102020435def4cf300d06092a864886f70d0101050500304e310b30090603550406130255533110300e060355040a130745717569666178312d302b060355040b1324457175696661782053656375726520436572746966696361746520417574686f72697479301e170d3938303832323136343135315a170d3138303832323136343135315a304e310b30090603550406130255533110300e060355040a130745717569666178312d302b060355040b1324457175696661782053656375726520436572746966696361746520417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c15db158670862eea09a2d1f086d911468980a1efeda046f13846221c3d17cce9f05e0b801f04e34ece28a950464acf16b535f05b3cb6780bf42028efedd0109ece100144ffcfbf00cdd43ba5b2be11f80709915579316f10f976ab7c268231ccc4d5930ac511e3baf2bd6ee63457bc5d95f50d2e3500f3a88e7bf14fde0c7b90203010001a38201093082010530700603551d1f046930673065a063a061a45f305d310b30090603550406130255533110300e060355040a130745717569666178312d302b060355040b1324457175696661782053656375726520436572746966696361746520417574686f72697479310d300b0603550403130443524c31301a0603551d1004133011810f32303138303832323136343135315a300b0603551d0f040403020106301f0603551d2304183016801448e668f92bd2b295d747d82320104f3398909fd4301d0603551d0e0416041448e668f92bd2b295d747d82320104f3398909fd4300c0603551d13040530030101ff301a06092a864886f67d074100040d300b1b0556332e3063030206c0300d06092a864886f70d01010505000381810058ce29eafcf7deb5ce02b917b585d1b9e3e095cc25310d00a6926e7fb692639e5095d19a6fe411de63856e98eea8ff5ac8d355b2667157dec021eb3d2aa72349010486427bfcee7fa21652b56767d340db3b2658b228773dae147761d6fa2a6627a00dfaa7735cea70f1942165445ffafcef2968a9a28779ef79ef4fac077738 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5F43E5B1BFF8788CAC1CC7CA4A9AC6222BCC34C6 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3913853E45C439A2DA718CDFB6F3E033E04FEE71\Blob = 0b000000010000001a000000450043005200610069007a00450073007400610064006f000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070300000001000000140000003913853e45c439a2da718cdfb6f3e033e04fee712000000001000000720500003082056e30820356a003020102020f42ea5b0a5111267cd82774b7df7f71300d06092a864886f70d01010505003033310b3009060355040613025054310d300b060355040a0c04534345453115301306035504030c0c45435261697a45737461646f301e170d3036303632333133343132375a170d3330303632333133343132375a3033310b3009060355040613025054310d300b060355040a0c04534345453115301306035504030c0c45435261697a45737461646f30820222300d06092a864886f70d01010105000382020f003082020a0282020100dbefa2436ec8a9fd6ed7dfaca29284a1c859a00c9a53feefaecc190d728aa4c23323efe70672ea6d4b3a41520fc9480e2de7ba64eea23a4c635c66298bdfa988c5bde8f1f78e4bfc013c4412392a70a2c0dbc5a2df5fc74bc6a8dc3d617c4a58c1443293de7099a12326563fa3e1ea5f3046d878f530a3960989b03df1869305b6126a188df0a5643b2b87645e3d178e0b6ee698cc973838208c705a692bbd658dcd37595c6cd1727459064ec8b701d777bff04886a8b31a5d41d4371711105f4a6e8d75c503407d21ae00f0dbfc9f6c3a66a4dff7cadf80665ad9d87f14a22619f4ae0b21e0ca3e05dd16d87e59daa1b069c39d3413fa65493987ee762f8dbd3c2719034ead0e0b2b2cc62e7113352957e970dc1b51eacd97f1958db286fa26062f801a95f1983beef6e586a5ce1b01e5f4e933ca0f55445f688a2cc75b6628dd964b839d5e1d7e18d5feb260fb9a5168c3968c1f684b50520b36e63127e4d7290c1bda1b2fe10453b8d47949b03b815e08882277e229c0ae72aaabb47252bd6cbbf5ba78d99cb8206f308d4a9d32f9f401e66279984240057a6f1c2a3fb5fbdfcd18408ee510c4395b56f13c5705abd2394d3ff88b23c76bb940b1e2feffb31c0a691f9b8c0fb41fe00ade48fd8d5f8f99f5017605365d8edc338e516e11e241fdccb78d2a5f3e92e5f2b1e0a423e2a2b7c68d189b294ad1467ff4642018dd0203010001a37f307d300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414717f35def577716d1d129ce190a4baf0a9838f80303b0603551d200434303230300604551d20003028302606082b06010505070201161a687474703a2f2f7777772e656365652e676f762e70742f647063300d06092a864886f70d010105050003820201008cad9c72a5b56776673887e93a8cfe9d5935be90f10300a058d898d1bffcfcf350dcb465d5dabaf08c2e7c0de609915f4da3f65d789c585d6a7094a3afdb2f00c903406bdf510316198c2bbc9936f6c0ad9218138ca7ed1dd2df039005ecb093989bf74d5a13f8e79bf73676de7c26f811384f494eb3731f5f275be19e321ef6c0981bd9202c5c968d86c90b45d792ad8abdea57a2a356b6203cecb2c7397eb080febd512b2ab4c37269c3f9472e6eff9c87eddc75cb1088e0b4ce2e0e531d0be86e1e424cd0be397875c914de279173aaec6a80f0f01796624fbe04cbe2a7e55d0f9345cb59482613deddb1f50ada16b1a81d8f7e581bb7d509de886bce843ea8be5262cad2a1a1c7cb3c16e07656303fe60f6b0677fe649d5a6a737ceede21e99a499737b6847fa2913e45fbd75a06c58735dcba484c8601084736b6385095119973d137490afa424f2f1054d34190fac8dcbb11dc0dcc7d7c9bdc0e9171864db8f2159a2b381711a1f29ea86c9ce3ceaee2e64b8bf28a063b07770211ee83ea9d6686caf062a9d55783a415f14514fe1a757fa50fdc527459750af8fb5541a95c8d3144ddcd944e33d11b41aadbd7a13cf0c5486d454135b57983e6f94df15638d7bf4022fb2080e31cc2594607630261003b9b50bb43c3b0e90a9ab876f447615564704f37d99c11a313b2e1dd4042bb98d7a0068be668574b0e38687fba updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E098ECF355C19953274D84772A1CEC96DC3356CA updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\20CB594FB4EDD895763FD5254E959A6674C6EEB2\Blob = 03000000010000001400000020cb594fb4edd895763fd5254e959a6674c6eeb2090000000100000056000000305406082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a0304060a2b0601040182370a030c06082b060105050703090b00000001000000340000004d004f004700410048004100200047006f007600740020006f00660020004b006f007200650061002000470050004b004900000020000000010000008e0300003082038a30820272a003020102021045f8e0e401c53e71e6bd716d979c4123300d06092a864886f70d0101050500304f310b3009060355040613024b52311c301a060355040a1313476f7665726e6d656e74206f66204b6f726561310d300b060355040b130447504b49311330110603550403130a47504b49526f6f744341301e170d3037303331353036303030345a170d3137303331353036303030345a304f310b3009060355040613024b52311c301a060355040a1313476f7665726e6d656e74206f66204b6f726561310d300b060355040b130447504b49311330110603550403130a47504b49526f6f74434130820121300d06092a864886f70d01010105000382010e0030820109028201005a2b41159bdb762601f054720b87131fa0d03f96aa0db33481de485a9ff3705ac2f13a9e04f04e947997e1f4b5144cd76fc48b18b7dc122b1d0a9bee200c5b8ffff9af829e9846d03d5d28f39716c15ce556bf44a400a17acb9b7a5bdcd4edfbf2a00267001e44e58a01dca5a34efed60c67ca49b9f0d0a0f94d1f03d386ef0d85754df3edfbcd6a660457f4579bac668a4fc2a84f718909dd4c00df96bbd5900ab4b66a6dc6bfd39929ff62f010da45ac09720b8210e815a88b5fe2a25a791ec267fde944570b03d0211551b000f38f6de223f04921d96dcf623decebfd2892013f7aa3727cebf3aee7f80aec6ead7a9b55c9304b9cb661466b581afe9f481d0203010001a3633061301f0603551d23041830168014166732f4685e683147dbedecce612e9a2446c47d301d0603551d0e04160414166732f4685e683147dbedecce612e9a2446c47d300e0603551d0f0101ff0404030201ae300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100356352c660181cb7c2c15a5802ec07d5a19093fc8047d05278ab85f876d3b8b01832a0b6906813663d6faf8edcf6a3c4ce395fafed0a66e07c11c80ccb9e1f38298a8bdec8632ec7b4d2ce369194e04f8492b6aa22a8fd31a73348c95bf613d81616eb1f3fa54e06933ad906653096fa8d06dba11af42bfa0f68f0c12b7c9d05d709423bd22f9190fc0e6b385bb275a9579c5764f59820a4ffd43004e4ce1f90c92fc1df5a56b8cbaaaab4bfebb8f7224a4dc135f465bd78bc6f781b563a81e80df5c2a51730d38d5777cba5c14cb130dd34b8ab920a2202368bf66cf761b908ee30ad1aa844f12e32ec83a248483a675fe96f1b1733082ac1c9c3679a0e8567 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5\Blob = 0f000000010000002000000008fba831c08544208f5208686b991ca1b2cfc510e7301784ddf1eb5bf03932390300000001000000140000003b1efd3a66ea28b16697394703a72ca340a05bd50b00000001000000540000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020003200300031003000000069000000010000000e000000300c060a2b0601040182373c0302140000000100000014000000d5f656cb8fe8a25c6268d13d94905bd7ce9a18c42000000001000000f1050000308205ed308203d5a003020102021028cc3a25bfba44ac449a9b586b4339aa300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3130303632333231353732345a170d3335303632333232303430315a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313030820222300d06092a864886f70d01010105000382020f003082020a0282020100b9089e28e4e4ec064e5068b341c57bebaeb68eaf81ba22441f6534694cbe704017f2167be279fd86ed0d39f41ba8ad92901ecb3d768f5ad9b591102e3c058d8a6d2454e71fed56ad83b4509c15a51774885920fc08c58476d368d46f2878ce5cb8f3509044ffe3635fbea19a2c961504d607fe1e8421e0423111c4283694cf50a4629ec9d6ab7100b25b0ce696d40a2496f5ffc6d5b71bd7cbb72162af12dca15d37e31afb1a4698c09bc0e7631f2a0893027e1e6a8ef29f1889e42285a2b1845740fff50ed86f9cede2453101cd17e97fb08145e3aa214026a172aaa74f3c01057eee8358b15e06639962917882b70d930c246ab41bdb27ec5f95043f934a30f59718b3a7f919a793331d01c8db22525cd725c946f9a2fb875943be9b62b18d2d86441a46ac78617e3009faae89c4412a2266039139459cc78b0ca8ca0d2ffb52ea0cf76333239dfeb01fad67d6a75003c6047063b52cb1865a43b7fbaef96e296e21214126068cc9c3eeb0c28593a1b985d9e6326c4b4c3fd65da3e5b59d77c39cc055b77400e3b838ab839750e19a42241dc6c0a330d11a5ac85234f773f1c7181f33ad7aeccb4160f3239420c24845ac5c51c62e80c2e27715bd8587ed369d9691ee00b5a370ec9fe38d80688376baaf5d70522216e266fbbab3c5c2f73e2f77a6cadec1a6c6484cc3375123d327d7b84e7096f0a14476af78cf9ae166130203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414d5f656cb8fe8a25c6268d13d94905bd7ce9a18c4301006092b06010401823715010403020100300d06092a864886f70d01010b05000382020100aca5968cbfbbaea6f6d7718743315688fd1c32715b35b7d4f091f2af37e214f1f30226053e16147f14bab84ffb89b2b2e7d409cc6db95b3b64657066b7f2b15adf1a02f3f551b8676d79f3bf567be484b92b1e9b409c2634f947189869d81cd7b6d1bf8f61c267c4b5ef60438e101b3649e420caada7c1b1276509f8cdf55b2ad08433f3ef1ff2f59c0b589337a075a0de72de6c752a6622f58c0630569f40b930aa40771582d78becc0d3b2bd83c5770c1eaeaf1953a04d79719f0faf30ce67f9d62ccc22417a07f2974218ce59791055de6f10e4b8da836640160968235b972e269a02bb578cc5b8ba69623280899ea1fdc0927c7b2b3319842a63c5006862fa9f478d997a453aa7e9edee6942b5f3819b4756107bfc7036841873eaeff9974d9e3323dd260bba2ab73f44dc8327ffbd61592b11b7ca4fdbc58b0c1c31ae32f8f8b942f77fdc619a76b15a04e1113d6645b71871bec92485d6f3d4ba41345d122d25b98da613486d4bb0077d99930961817457268aab69e3e4d9c788cc24d8ec52245c1ebc9114e296deeb0ada9edd5fb35bdbd482ecc620508725403afbc7eecdfe33e56ec3840955032539c0e9355d6531a8f6bfa009cd29c7b336322edc95f383c15acf8b8df6eab321f8a4ed1e310eb64c11ab600ba412232217a3366482910412e0ab6f1ecb500561b440ff598671d1d533697ca9738a38d7640cf169 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 360TS_Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 360TS_Setup.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\253F775B0E7797AB645F15915597C39E263631D1 QHSafeMain.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\490A7574DE870A47FE58EEF6C76BEBC60B124099\Blob = 030000000100000014000000490a7574de870a47fe58eef6c76bebc60b124099090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030906082b0601050507030406082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b00000001000000300000004200750079007000610073007300200043006c0061007300730020003200200052006f006f007400200043004100000020000000010000005d0500003082055930820341a003020102020102300d06092a864886f70d01010b0500304e310b3009060355040613024e4f311d301b060355040a0c14427579706173732041532d3938333136333332373120301e06035504030c174275797061737320436c617373203220526f6f74204341301e170d3130313032363038333830335a170d3430313032363038333830335a304e310b3009060355040613024e4f311d301b060355040a0c14427579706173732041532d3938333136333332373120301e06035504030c174275797061737320436c617373203220526f6f7420434130820222300d06092a864886f70d01010105000382020f003082020a0282020100d7c75ef7c107d477fb4321f4f4f569e4ee3201dba3861fe4590dbae7758352ebea1c611548bb1d07ca8caeb0dc969deac36092868228739c5606ff4b64f00c2a3749b5e5cf0c7ceef14abb733065f3d52f83b67ee3e7f59eab60f9d3f19d92748ae41c96ac5b80e9b5f43187a351fcc77ea16f8e5377d497c15533923e182f75d4ad8649cb95af54066cd806138d5bffe1261959c024ba8171799044506824945fb8b311f1294161a341cb2336d5c1f13250104e7ff48693ec84d38ebc4bbf5c014e073ddc148a940aa4ea73fb0b51e8130718fa0ef12bd154157d3ce1f7b4194267625e77e0a255ecb6d96917d53aaf44ed4ac59ee47a277ce575d7aacb25e7df6b0adb0f4d934ea8a0cd7b2ef259016ab70db807817e8b381b38e60a57993dee21e8a3f50c16dd8bec348e9c2a1c0015178d6883d2709f1808cd1168d5c96b52cdc4468fdcb5f3d857731ee9943904bfd3de38deb453ec691ca27ec48fe41b70adf2a2f9fbf7166466699f4951a2e2151867064a7fd56cb54db333e061eb5dbee9980f32d71d4b3c2e5a01529109f2dfea8dd8064063aa11e4fec3379e14523ff4e2ccf26193d1fd676bd752aebf68ab4043a057355378f053f861420764c6d76f9b4c380d63ac62af368ba2730a0df521bd74aa4dea720349dbc75f1d6263c7fddd91ec33eef56db46e3068dec8d626b0755e7bb4072098a17632b84d6c4f0203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e04160414c98077e0629282f5469cf3baf74cc3deb8a3ad39300e0603551d0f0101ff040403020106300d06092a864886f70d01010b05000382020100535f21f5bab03a52392c92b06c00c9efce20ef06f2969ee9a4747f7a16fcb7f5b6fb151b3faba6c0725d10b171eebc4fe3adac036d2e712eafc4e3ada3bd0c11a7b4ff4ab27b10101fa75741b2c0aef42c59d6471088f321512930ca6086af46ab1ded3a5bb094de44e34108a2c1ec1dd6fd4fb6d647d0140bcae6cab57b777e411f5e83c7b68c3996b03f9681416f6090e2e8f9fb2271d97db33d46bfb484af901c0f8f126aafefee1e7aae024a8a172b76feac5489242c4f3fb6b2a74e8ca89197fb29c67b5c2db9cb66b6b7a85b125185b5097e627870fea96a60b61d0e790cfdcaea248072c3973ff277ab43220ac7ebb60c84822c806b418a08c0eba56bdf9912cb8ad55e800c91e026083648c5fa381135ff25832df27abfdafd8efea5cb452c1fc48853ae770ed99a76c58e2c1da3bad5ec32aec0aaacf7d17a4debd407e248f7228eb0a49f6ace8eb2b260f4a322d023eb945a7a69dd0fbf4057ac6b5950d9a399e16efe8d0179272315de929d7b094d5ae74b48305a18e60a6de68fe0d2bbe6df7c6e2182c168394db498586662cc4a905ec3fa2704b179157499ccbead20de26601ceb5651a6a3eae4a33fa7ff61dcf15a4d6c322343eeaca8eeee4a12093c5d71c2be79fac287681d0bfd5c69cc06d09a7d54992ac9391a19af4b2a43f3635d5a58e22fe31de4a9d6d00ad09ebfd78109f1c9c7260dac981656a0 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19965300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c00b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A69A91FD057F136A42630BB1760D2D51120C1650 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\75E0ABB6138512271C04F85FDDDE38E4B7242EFE updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD 360SecureBrowser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9C615C4D4D85103A5326C24DBAEAE4A2D2D5CC97 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C93C34EA90D9130C0F03004B98BD8B3570915611 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B12E13634586A46F1AB2606837582DC4ACFD9497\Blob = 030000000100000014000000b12e13634586a46f1ab2606837582dc4acfd949709000000010000005c000000305a06082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b0601050507030906082b0601050507030606082b0601050507030706082b060105050802020b00000001000000120000004300650072007400690067006e006100000053000000010000002400000030223020060a2a817a0181310112010230123010060a2b0601040182373c0101030200c02000000001000000ac030000308203a830820290a003020102020900fedce3010fc948ff300d06092a864886f70d01010505003034310b300906035504061302465231123010060355040a0c094468696d796f7469733111300f06035504030c084365727469676e61301e170d3037303632393135313330355a170d3237303632393135313330355a3034310b300906035504061302465231123010060355040a0c094468696d796f7469733111300f06035504030c084365727469676e6130820122300d06092a864886f70d01010105000382010f003082010a0282010100c868f1c9d6d6b3347526821eecb4beea5ce126ed114761e1a27c16784021e4609e5ac863e1c4b19692ff186d6923e12b62f7dde2362f9107b948cf0eec79b62ce7344b700825a33c871b19f281070f389019d311fe86b4f2d15e1e1e96cd806cce3b3193b6f2a0d0a995127da59acc6bc884568a33a9e722155316f0cc17ec575fe9a20a9809dee35f9c6fdc48e3850b155aa6ba9fac48e309b2f7f432de5e34be1c785d425bce0e228f4d90d77d3218b30b2c6abf8e3f141189200e7714b53d940887f7251ed5b26000ec6f2a28256e2a3e186317253f3e442016f626c825ae054ab4e7632cf38c16537e5cfb111a08c146629f22b8f1c28d69dcfa3a5806df0203010001a381bc3081b9300f0603551d130101ff040530030101ff301d0603551d0e041604141aedfe413990b42459be01f252d545f65a39dc1130640603551d23045d305b80141aedfe413990b42459be01f252d545f65a39dc11a138a4363034310b300906035504061302465231123010060355040a0c094468696d796f7469733111300f06035504030c084365727469676e61820900fedce3010fc948ff300e0603551d0f0101ff040403020106301106096086480186f8420101040403020007300d06092a864886f70d0101050500038201010085031e9271f642afe1a3619eebf3c00ff2a5d4da95e6d6be68363d7e6e1f4c8aefd10f216d5ea55263ce12f8ef2ada6feb37fe1302c7cb3b3e226bda612e7fd4723ddd30e11e4c40198c0fd79cd183307b9859dc7dc6b90c294ca133a2eb673a6584d396e2ed7645708fb52bdef923d6496e3c14b5c69f351e50d0c18f6a70440262cbae1d6841a7aa57e853aa07d206f6d514060b9103752c6c72b561959a0d8bb90de7f5df54cddee6d8d609089763e5c12eb0b74426c026c0af55309e3bd5362a1904f45c1effcf2cb7ffd0fd874011d51123bb48c021a9a4282dfd15f8b04e2bf4305b21fc119134be41ef7b9d9775ff9795c096582feabb46d7bbe4d92e updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B435D4E1119D1C6690A749EBB394BD637BA782B7 updroots.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\971D3486FC1E8E6315F7C6F2E12967C724342214 QHSafeMain.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 53000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000140000005500530045005200540072007500730074000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\490A7574DE870A47FE58EEF6C76BEBC60B124099 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656\Blob = 190000000100000010000000181c2be05851f96993e196f279954b23030000000100000014000000be36a4562fb2ee05dbb3d32323adf445084ed65668000000010000000800000000409120d035d9017e000000010000000800000000c0032f2df8d60109000000010000000c000000300a06082b060105050703080b000000010000000e00000074006800610077007400650000001d00000001000000100000006454a4aa36f9b5cc8338e5a67fabff17140000000100000014000000ddbcbd869c3f07ed40e31b08efcec4d188cd3b156200000001000000200000006b6c1e01f590f5afc5fcf85cd0b9396884048659fc2c6d1170d68b045216c3fd0f0000000100000010000000e8a598be84828efeae701115013576b22000000001000000a5020000308202a13082020aa003020102020100300d06092a864886f70d010104050030818b310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311430120603550407130b44757262616e76696c6c65310f300d060355040a1306546861777465311d301b060355040b13145468617774652043657274696669636174696f6e311f301d060355040313165468617774652054696d657374616d70696e67204341301e170d3937303130313030303030305a170d3230313233313233353935395a30818b310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311430120603550407130b44757262616e76696c6c65310f300d060355040a1306546861777465311d301b060355040b13145468617774652043657274696669636174696f6e311f301d060355040313165468617774652054696d657374616d70696e6720434130819f300d06092a864886f70d010101050003818d0030818902818100d62b587861458653ea347b519cedb0e62e180efee05fa827d3b4c9e07c594e160e735460c17ff69f2ee93a8524153cdb470463c39ec4941a5adf4c7af3d9431d3c107a7925db90fef051e730d64100fd9f28df79be94bb9db614e32385d7a941e04ca479b02b1a8bf2f83b8a3e45ac719200b4904198fb5fedfab72e8af888370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010405000381810067dbe2c2e6873d40838637357d1fce9ac30c6620a8baaa048986c2f510080dbfcba2058ad04d363ef4d7ef69c65ee4b0946f4ab9e7de5b88b67bdbe327e576c3f035c1cbb5279b3379dc90a6009e77fafccd279442169cd31c68ecbf5cdde5a97b100a32745413318b85038491b75801301438af28cafcb150191909ac8949d3 360InstantSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\750251B2C632536F9D917279543C137CD721C6E0 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\FEB8C432DCF9769ACEAE3DD8908FFD288665647D\Blob = 53000000010000002400000030223020060a2a83088c9b1b6485510130123010060a2b0601040182373c0101030200c00b00000001000000360000005300450043004f004d002000540072007500730074002000530079007300740065006d007300200043004f0020004c00540044000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308030000000100000014000000feb8c432dcf9769aceae3dd8908ffd288665647d2000000001000000810300003082037d30820265a003020102020100300d06092a864886f70d01010505003060310b3009060355040613024a5031253023060355040a131c5345434f4d2054727573742053797374656d7320434f2e2c4c54442e312a3028060355040b1321536563757269747920436f6d6d756e69636174696f6e20455620526f6f74434131301e170d3037303630363032313233325a170d3337303630363032313233325a3060310b3009060355040613024a5031253023060355040a131c5345434f4d2054727573742053797374656d7320434f2e2c4c54442e312a3028060355040b1321536563757269747920436f6d6d756e69636174696f6e20455620526f6f7443413130820122300d06092a864886f70d01010105000382010f003082010a0282010100bc7fec579b24e0fe9cba4279a9888afa80e0f5072943ea8e0a34368d1cfaa7b53978ff9775f72fe4aa6b048444caa6e2688efd5550620fa4710ece07382d428550ad3c966f8bd5a20ecfde49893dd6642e38e51e6cb5578a9eef480ecd7a69168744b590e4069daea104975879ef204a826b8c22bfec1f0fe98471edf10ee4b81813cc56365dd19a1e516b396e607688340bf3b3d1b09dca61e2641dc14607b863dd1e3365b38e0955523db5bdff07ebad6155182ca969984aaa40c53314657400f991deaf0348c54054dc0f84906820c59296dc2ee50245aac05f54f86dea49cf5d6c4bafef9ac2565cc63556426a305fc2abf6e23d3fb3c9118f314cd79f490203010001a3423040301d0603551d0e04160414354af54daf3fd78238acab716517758c9d5593e6300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100a887e9ecf840675dc3c166c7404b97fc8713905ac4efa0ca5f8bb7a7b7f1d6b564b78ab3b81bccdafbac668841cee8fce4db1e88a6ed27501b0230244679fe048770974073d1c0c157199a69a52799ab9d6284f651c12cc92315d828b7ab2513b546e18602ff268cc488921d56fe1967f255e480a36b9cab77e151710d20db109adbbd767907779928ad9a5edab14f442c358ea596c7fd83f058c679d6987ca88dfe863e071692e17be71dec33767e422e4a85f9918968840381a59b9abee337c554ab563b182d41a40cf842db99a0e0726fbb5de1164f530a64f94ef4bf4e54bd786c88eabf9c1324c27069a27f0fc83cad08c9b09840a32ae78883ed778f74 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\293621028B20ED02F566C532D1D6ED909F45002F\Blob = 53000000010000002400000030223020060a2b06010401828f09020230123010060a2b0601040182373c0101030200c00b00000001000000180000005400720065006e00640020004d006900630072006f000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000293621028b20ed02f566c532d1d6ed909f45002f2000000001000000500300003082034c30820234a00302010202087c4f04391cd4992d300d06092a864886f70d01010505003044310b300906035504061302555331143012060355040a0c0b41666669726d5472757374311f301d06035504030c1641666669726d5472757374204e6574776f726b696e67301e170d3130303132393134303832345a170d3330313233313134303832345a3044310b300906035504061302555331143012060355040a0c0b41666669726d5472757374311f301d06035504030c1641666669726d5472757374204e6574776f726b696e6730820122300d06092a864886f70d01010105000382010f003082010a0282010100b484cc33172e6b946c6b6152a0eba3cf79944ce5948099cb556444658f6764e206e35c3749f62f9b84841e2df2609d304ecc8485e22ccf1e9efe36ab33773544d835961a3d36e87a0ed8d547a16a698bd9fcbb3aae795ad5f4d671bb9a90236b9ab78874870c1e5fb99e2dfaab532bdcbb763e934c08088c1ea2231cd46aad22ba99012e6d65cbbe246655244b4044b11bd7e1c285c0de103f3dedb8fcf1f12353dcbf65976fd9f940718d7dbd95d4cebea05e2723defda6d0260e0029eb3c46f03d60bf3f50d2dc2641519e14374204a37057a81b87ed2dfa7bee8c0ae3a9668919cb41f9dd443661cfe27746c87df6f4928136fddb34f1727ef30c16bdb4150203010001a3423040301d0603551d0e04160414071fd2e79cdac26ea240b4b07a50105074c4c8bd300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106300d06092a864886f70d010105050003820101008957b2167aa8c2fdd6d99b9b34c29cb432144da7a4dfecbea7bef843db9137ceb4322e50551a354e76437120ef93774e15702e87c3c11d6ddccbb527d42c56d152533a44d273c8c41b05655a62929cee418d31dbe734ea5921d5017ad764b86439cdc9edafed4b0348a7a0990180dc65a336ae6559484f824bc865f1571de5592e0a3f6cd8d1f5e509b46c54000ae0154d87756db758965add6dd200a0f49b48bec337a4ba36e07c8785971a15a2de2ea25bbdaf18f99050cd7059f8276747cbc7a0073a7dd12c5d6c193a66b57dfd916f82b1be0893db1447f1a237c7459e3cc777af64a893dff669838260f2494234ed5a0054851c1636920c5cfaa6adbfdb updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\FA0882595F9CA6A11ECCBEAF65C764C0CCC311D0 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072\Blob = 5c000000010000000400000000100000190000000100000010000000983b132635b7e91deef54a6780c092691400000001000000140000000eac826040562797e52513fc2ae10a539559e4a4030000000100000014000000cdd4eeae6000ac7f40c3802c171e30148030c0720b000000010000004a0000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900000069000000010000000e000000300c060a2b0601040182373c03020f0000000100000014000000391be92883d52509155bfeae27b9bd340170b76b040000000100000010000000e1c07ea0aabbd4b77b84c228117808a720000000010000009d0500003082059930820381a003020102021079ad16a14aa0a5ad4c7358f407132e65300d06092a864886f70d0101050500305f31133011060a0992268993f22c6401191603636f6d31193017060a0992268993f22c64011916096d6963726f736f6674312d302b060355040313244d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479301e170d3031303530393233313932325a170d3231303530393233323831335a305f31133011060a0992268993f22c6401191603636f6d31193017060a0992268993f22c64011916096d6963726f736f6674312d302b060355040313244d6963726f736f667420526f6f7420436572746966696361746520417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a0282020100f35dfa8067d45aa7a90c2c9020d035083c7584cdb707899c89dadecec360fa91685a9e94712918767cc2e0c82576940e58fa043436e6dfaff780bae9580b2b93e59d05e3772291f734643c22911d5ee10990bc14fefc755819e179b70792a3ae885908d89f07ca0358fc68296d32d7d2a8cb4bfce10b48324fe6ebb8ad4fe45c6f139499db95d575dba81ab79491b4775bf5480c8f6a797d1470047d6daf90f5da70d847b7bf9b2f6ce705b7e11160ac7991147cc5d6a6e4e17ed5c37ee592d23c00b53682de79e16df3b56ef89f33c9cb527d739836db8ba16ba295979ba3dec24d26ff0696672506c8e7ace4ee1233953199c835084e34ca7953d5b5be6332594036c0a54e044d3ddb5b0733e458bfef3f5364d842593557fd0f457c24044d9ed6387411972290ce684474926fd54b6fb086e3c73642a0d0fcc1c05af9a361b9304771960a16b091c04295ef107f286ae32a1fb1e4cd033f777104c720fc490f1d4588a4d7cb7e88ad8e2dec45dbc45104c92afcec869e9a11975bdece5388e6e2b7fdac95c22840dbef0490df813339d9b245a5238706a5558931bb062d600e41187d1f2eb597cb11eb15d524a594ef151489fd4b73fa325bfcd13300f95962700732ea2eab402d7bcadd21671b30998f16aa23a841d1b06e119b36c4de40749ce15865c1601e7a5b38c88fbb04267cd41640e5b66b6caa86fd00bfcec1350203010001a351304f300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e041604140eac826040562797e52513fc2ae10a539559e4a4301006092b06010401823715010403020100300d06092a864886f70d01010505000382020100c5114d033a60dd5d5211778fb2bb36c8b205bfb4b7a8d8209d5c1303b61c22fa061335b6c863d49a476f2657d255f104b1265fd6a95068a0bcd2b86eccc3e9acdf19cd78ac5974ac663436c41b3e6c384c330e30120da326fe515300ffaf5a4e840d0f1fe46d052e4e854b8d6c336f54d264abbf50af7d7a39a037ed63030ffc1306ce1636d4543b951b51623ae54d17d40539929a27a85baabdecbbbee3208960716c56b3a513d06d0e237e9503ed683df2d863b86b4db6e830b5e1ca944bf7a2aa5d9930b23da7c2516c28200124272b4b00b79d116b70beb21082bc0c9b68d08d3b2487aa9928729d335f5990bdf5de939e3a625a3439e288551db906b0c1896b2dd769c319123684d0c9a0daff2f6978b2e57adaebd70cc0f7bd6317b8391338a2365b7bf285566a1d6462c138e2aabf5166a294f5129c6622106bf2b730922df229f03d3b144368a2f19c2937cbce3820256d7c67f37e24122403088147eca59e97f518d7cfbbd5ef7696effdcedb569d95a042f99758e1d73122d35f59e63e6e2200ea4384b625dbd9f3085668c0646b1d7cecb693a262576e2ed8e7588fc4314926ddde293587f53071705b143c69bd89127deb2ea3fed87f9e825a520a2bc1432bd930889fc810fb898de6a18575337e6c9edb7313646269a52f7dca966d9ff8044d30923d6e211421c93de0c3fd8a6b9d4afdd1a19d9943773fb0da QHSafeMain.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\67EB337B684CEB0EC2B0760AB488278CDD9597DD updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8D08FC43C0770CA84F4DCCB2D41A5D956D786DC4 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000002a000000302806082b0601050507030106082b0601050507030406082b0601050507030206082b060105050703030b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c020000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A\Blob = 030000000100000014000000627f8d7827656399d27d7f9044c9feb3f33efa9a09000000010000000c000000300a06082b060105050703030b000000010000000e000000740068006100770074006500000053000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c020000000010000002b0300003082032730820290a003020102020101300d06092a864886f70d01010405003081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d301e170d3936303830313030303030305a170d3230313233313233353935395a3081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d236366a8bd7c25b9eda8141628f38ee490455d6d0ef1c1b951647ef1848353a52f42b6a068f3b2fea56e3af868d9e17f79eb46575024defcb09a22151d89bd067d0ba0d92061473d493cb972a009c5c4e0cbcfa1552fcf2446eda114a6e089f2f2de3f9aa3a8673b6465358c88905bd8311b8733faa078df4424de7409d1c370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010405000381810026482c16c258fae816740caaaa5f543ff2d7c978605e5e6e37632277367eb217c434b9f50885fcc90138ff4dbef2164243e7bb5a46fbc1c6111ff14ab02846c9c3c4427dbcfaab596ed5b7518811e3a485196b824ca40c12ade9a4ae3ff1c349659a8cc5c83e25b79499bb92327107f0865eed5027a60da623f9bbcba6071442 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30779E9315022E94856A3FF8BCF815B082F9AEFD updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85 updroots.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\74207441729CDD92EC7931D823108DC28192E2BB updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E70715F6F728365B5190E271DEE4C65EBEEACAF3\Blob = 0b000000010000004600000041007500730074007200690061002000540065006c0065006b006f006d002d0043006f006e00740072006f006c0020004b006f006d006d0069007300730069006f006e00000009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070309030000000100000014000000e70715f6f728365b5190e271dee4c65ebeeacaf320000000010000001c0400003082041830820300a003020102020100300d06092a864886f70d0101050500305d310b300906035504061302415431233021060355040a131a54656c656b6f6d2d436f6e74726f6c2d4b6f6d6d697373696f6e312930270603550403132054656c656b6f6d2d436f6e74726f6c2d4b6f6d6d697373696f6e20546f702031301e170d3032303932343132343030305a170d3035303932343132343030305a305d310b300906035504061302415431233021060355040a131a54656c656b6f6d2d436f6e74726f6c2d4b6f6d6d697373696f6e312930270603550403132054656c656b6f6d2d436f6e74726f6c2d4b6f6d6d697373696f6e20546f70203130820122300d06092a864886f70d01010105000382010f003082010a028201010095b13a9aee1a9b2544635081e648da4808e3d57565ca4ad6df683325582ece9e956d41ab3cb2aef4bb62ad9a7af5dadc7821fc0347fcf2482afad52f412b9835b3b2361dbaa933eb41de32936bff11e83b4014e8cc71a5841422be68bc92a3f440a2e5da6c7c537e99d279d40cdd7707f06f954ed7bc53fbe4f3d9dad41de6f802f65fb09c2e5bde2e0a2e0561dabc0541df7cb44d985a40666b8278d81dda95c1beb7107abd2562165c92189e1b9f83fdb2acf8e38352762a749b56eabc10288fdfd9efcc960be781cc788d02ec74b0bfbe2d17ad8ef21f0fae725d105937da4f62cbbc6ffa114529dde3699d4860f97563e12fba597c25df5c2a43e68ec8110203010001a381e23081df301d0603551d0e0416041465cd574ebb9dd3ffa6bcbb79209de9e04653ed0b30370603551d1f0430302e302ca02aa0288626687474703a2f2f7777772e7369676e617475722e7274722e61742f63757272656e742e63726c300c0603551d240405300380010030560603551d20044f304d304b06092a2800150001000100303e303c06082b060105050702011630687474703a2f2f7777772e7369676e617475722e7274722e61742f64652f6469726563746f72792f6370732e68746d6c300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020204300d06092a864886f70d0101050500038201010050477ca049b1c8fe1d672da4f64d2037ae90ee9ba141e1abf6ed68d1324b0c1c63df882b8b66f0340c7f882de1c0461bf8fa32ba9bbba8622878120534da8df696e1fed7be372c0452b5e9b84145792b914a72a0a40ede39d973f9a9da43cfacc25ea20f913194d44d2191b72df116950ff98f4d59cd3575526f0157fa441fec91d70728de28df89f9ed32ad8543fa56f3fc2bb564c17030c800d67c743290e683006b7123ca56a23922ac79141b031793e3a8989b6ac756af00f1d7dd0fc2c0a7e2665e3de479fe6ca8cf6ae7a9ff0cbba7101cce7f31b3db919364be316cb3f8785fe7ebb5c42a61851dc4b583cc994c3a0470efe456da0701ca15cf8e6772 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4812BD923CA8C43906E7306D2796E6A4CF222E7D\Blob = 0300000001000000140000004812bd923ca8c43906e7306d2796e6a4cf222e7d09000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090b000000010000002c000000510075006f0056006100640069007300200052006f006f0074002000430041002000330020004700330000002000000001000000640500003082056030820348a00302010202142ef59b0228a7db7affd5a3a9eebd03a0cf126a1d300d06092a864886f70d01010b05003048310b300906035504061302424d31193017060355040a131051756f5661646973204c696d69746564311e301c0603550403131551756f566164697320526f6f742043412033204733301e170d3132303131323230323633325a170d3432303131323230323633325a3048310b300906035504061302424d31193017060355040a131051756f5661646973204c696d69746564311e301c0603550403131551756f566164697320526f6f74204341203320473330820222300d06092a864886f70d01010105000382020f003082020a0282020100b3cb0e10678eea1497a7322a0a56367f684cc7b36f3a231491ff197fa5caaceeb3769d7ae98b1bab6b31dbfa0b534cafc5a51a793c8a4cffacdf25de4ed982320b44decadb8caca36e16833ba6644b3289fb1616387eeb43e2d3744ac2620a730add49b357d2b00a859d713cdea3cbc032f3013920431b35d153b3b1eec59369823e16b52846a1deea8909ed43b805468a86f55947be1b6f012110b9fda9d228ca103909ca1336cf9cadad4074792b023f34fffa20697dd3ee61f5bab3e730d0372386726145294859686f77a62e81be074d6fafcec44513911470068f1f9ff88769b10eefc38919ebea1c61fc7a6c8adcd6030b9e26ba12ddd45439ab26a333ea7581da2dcd0f4fe403d1ef15971b6b90c5029093660221b147de8b9a4a80b9558fb5a22fc0d63367da7ec4a7b40444eb47fbe658b9f70cf07b2bb1c07029c340622d3b4869dc233c48eb7b0979a96ddaa83098cf80720388a65b46ae72797c08032165aeb7e11ca5b12aa231de6604f7c074e871deff3d59cc9626128b8595571aab6b750b443d11283c7b61b7e28f674fe5ec3c4c60806957381e015b8d55e8c7dfc0cc77233449757cf69811eb2ddeed412e1405027fe0fe20eb35e711ac22ce573ddec9306d100385cdf1ff8c16b5c1b23e886c607f904f95f7f62dad01390704fa75807dbf4950edefc9c47c1ceb807edbb6d0dd13fec9d39cd7b297a90203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c617d0bca8ea0243f21b06995d2b9020b9d79ce4300d06092a864886f70d01010b050003820201003461d956b51287554ddda3353146bba40772bc5f6162e8a5fb0b37b13cb6b3fa299d7f02f5a4c9a893b77a7128698f73e15290dad5be3ae5b7766a568021df5de6e93a9ee53ef6a269c72a0ab01847dc20707d52a33e597cc1bac9c8154061ca72d670acd2b7f01ce48629f0ceef6863d0b5208a15619a7e8698b4c9c276fbccba3016cca361c67413e56befa315ea03fe138b64e4d3c1d2e884fb49d1104d7966ebaafdf48d311e7014addcde67134c811561bcb7d9917771198160bbf058a5b59c0bf78f225527c04b016d3b990dd41d9b63672fd0ee0dca66bc944fa6adedfcee63ac573f6525cfb2868fd008ffb876146edee527ecab78b553b9b63fe820f9d2a8be6146ca878c84f3f9f1a0689b221e81269b10049171c0061fdca0d3b956a7e3982d7f839ddf8c2b9c328e3294f0013c222a9f43c22ec3983907387bfc5e00421ff33226798384f6e5f0c15112c00b1e04230c54a54c2f49c54ad1b66e600d6bfc6b8b852464b7890eab25475b3ccf7e49bdc7e90ac6daf77e0e1708d34897d07192f00f393e346a1c7dd8f222aebb69f433b4a64855d10f0e26e8ecb60b2da78535cdfd59c89fd1cd3e5a2934b93d84ceb165d4599191567521c1779ef97ae1609dd3ad0418f47ceb5e938f534a2229f8482b3e4d86ac5b7fcb06995960d85865958d44d1f77f7e277f7dae80f5074cb63e9c715499044bfd58f998f4 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\61EF43D77FCAD46151BC98E0C35912AF9FEB6311\Blob = 03000000010000001400000061ef43d77fcad46151bc98e0c35912af9feb6311090000000100000020000000301e06082b0601050507030306082b0601050507030206082b060105050703040b000000010000001200000056006500720069005300690067006e00000020000000010000001d040000308204193082030102106170cb498c5f984529e7b0a6d9505b7a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203139393920566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732032205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204733301e170d3939313030313030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203139393920566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732032205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473330820122300d06092a864886f70d01010105000382010f003082010a0282010100af0a0dc2d52cdb67b92de59427dda5bee0b04d8fb361563cd67cc3f4cd3e86cba288e2e1d8a469c5b5e2bfc1a647505e46398bd596bab56f14bf10ce27139e05479b317a13d81fd9d302378bad2c47f08e8106a70d300cebf73c0f201ddc7246eea502c85bc3c956694cc518c1917b0bd513009bbcefc3483e466020852ad590b6cd8ba0cc32ddb7fd4055b2501c56aecc8d774dc7204da73176ef68928a901e088156b2ad69a352d0cb1cc4233d1f99fe4ce816638ec6088ef631f6d2fae576ddb51c92a349cdcd01cd68cda969baa3eb1d0d9ca420a6c1a0c5d1464c176dd2ac663f968ce084d436ff2259c5f91160a85f047df21af62542610fc44ab83e890203010001300d06092a864886f70d010105050003820101003426153cc08d4d43491dbde92192d7669cb7dec5b8d0e45d5f7622c026f9843a3af98cb5fbec60f1e8ce04b0c8dda7038f30f398dfa4e6a431dfd31c0b46dc72203faeee053ca4333f0b39ac7078734b992bdf30c254b0a83b55a1fe1628cd42bd746e80db2744a7ce445dd41b90980d1e4294b1002c04d074a30205226363cd83b5fbc16d626b6975fd5d7041b9f5bf7cdfbec1327322218b58817b15917abae36448b07ffb3625da95d0f1241417dd18806b46233954f58e6209041d9490a69be625e24245aab890adbe088fa90b421894cf7239e1b143e028cfb7e75a6c136b49b3ffe3187c898b335dac33d7a7f9da3a55c95810f9aaef5ab6cf4b4bdf2a updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\31F1FD68226320EEC63B3F9DEA4A3E537C7C3917\Blob = 53000000010000002500000030233021060b2b0601040181b53701010130123010060a2b0601040182373c0101030200c00b00000001000000480000005300740061007200740043006f006d002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200047003200000009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030303000000010000001400000031f1fd68226320eec63b3f9dea4a3e537c7c3917200000000100000067050000308205633082034ba00302010202013b300d06092a864886f70d01010b05003053310b300906035504061302494c31163014060355040a130d5374617274436f6d204c74642e312c302a060355040313235374617274436f6d2043657274696669636174696f6e20417574686f72697479204732301e170d3130303130313031303030315a170d3339313233313233353930315a3053310b300906035504061302494c31163014060355040a130d5374617274436f6d204c74642e312c302a060355040313235374617274436f6d2043657274696669636174696f6e20417574686f7269747920473230820222300d06092a864886f70d01010105000382020f003082020a0282020100b689365b07b72036bd82bbe1162003957aaf0ea355c925994ac5d0564187904d2160a414873bcdfdb23eb467036aede10f4bc091857045e0429ede2923d4010da01079b8db03bdf3a92fd1c6e00fcb9e8a140ab8bdf65662f1c572b63225d9b2f3bd65c50d2c6ed5926f188b004114826f4020267a280ff51e7f27f794b1373db7c791f7e201ecfd9489e1cc6ed336d60a1979aed7348265ff7c42bbb6dd0ba634af4b60fe7f4349068b8c43b856f2d97f214317eaa74895017575ea2ba54395ea15849d088d266e559babdcd239d2311d60e2accc564524f51c54abee86dd963285f84c4fe89576b605dd362367bcff15e2ca3be6a6ec3bec261134488df6802b1a2302eb8a1c3a762a7b56161c722ab3aae360a5009f049be26f1e14585ba56c8b583cc3ba4e3a5cf7e1962b3eef07bca4e55dcc4d9f0de1dcaabbe16e1aec8fe1b64c4d79725d17350b1dd7c147da9624e0d072a85a5f662d10dc2f2a13ae26fe0a1c19ccd03e0b9cc8092ef95b967a479ce97af305507495739e3009f397825ee68f39081e59e535144213ff009cf7beaa50cfe25148d7b86faff84e7e33989214623a7563cf7bfade823ba9bb39e2c4bd2c000ec817ac13ef4d258ed8b3902fa9da297d1daf743ab227c0c11e3e75a316a9af7a225d9f131acfa7a0ebe3860ad3fde69695d723c837ddc47caa36ac981a12b1e04ee8b13bf5d66ff130d70203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604144bc5b4406bad1cb3a51c656e46368987050c0eb6300d06092a864886f70d01010b0500038202010073573f2cd595327e37db9692eb195e7e53e741ec11b647efb5deed745cc5f18e49e0fc6e9913cd9f8adacd3a0ad83a5a093f5f34d02f03d2661d1abd9c9037c80c8e075a9445462ae6be7adaa1a9a4691292b07d36d44487d751f12963d675cd16e427891df8c23248fddb99d08f5f5474ccac67341162d90c0a3787d1a317488ed2171df6d7fddb65ebfda8d4f5d64fa45b75e8c5d260b2db097e258b7bba52929e3ee8c577a13ce04a736b61cf86dc43ffff21fe235d244af5d36d0f6204055782da6ea43325794b2e54198bcc2c3d30e9d106ffe83246beb5337677a8015d96c1c1d5beae25c0c91e0a092088a10ec9f36f4d82540020a7d28fe43954172e8d1eb81bbb1bbd9a4e3b1034dc9c8853efa2315b584f9162c8c29a9acd155d38a9d6bef813b59f1269f25062acfb1737f4eeb875676010fb8350f944b5759c4017b2fefd795d6e58585f30fc00aeaf33c10e4e6cbaa7a6a17f32db38e0b172170a2b91ec6a6326ed89d478cc741e05f86bfe8c6a763929ae6523129508221c97ce5b06ee0ce2bbbc1f4493f6d838450521ede4adab12b603a4422e2dc4093a036769849ae159908a2885d55d74b1d10e20589b13a5b063a6ed7b47fd455530a4ee9ad4e6e287ef98c93282112922bc000a315e2d0fc08ee96bb28f2e06d8d191c7c612f44cfd3017c3c1da385be3a9eae6a1ba79ef73d8b653572df6d0e1d748 updroots.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B94294BF91EA8FB64BE61097C7FB001359B676CB\Blob = 030000000100000014000000b94294bf91ea8fb64be61097c7fb001359b676cb090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b0000000100000044000000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790020006f006600200057006f005300690067006e0000005300000001000000230000003021301f06092b06010401829b510230123010060a2b0601040182373c0101030200c020000000010000007a050000308205763082035ea00302010202105e68d61171946350560068f33ec9c591300d06092a864886f70d01010505003055310b300906035504061302434e311a3018060355040a1311576f5369676e204341204c696d69746564312a30280603550403132143657274696669636174696f6e20417574686f72697479206f6620576f5369676e301e170d3039303830383031303030315a170d3339303830383031303030315a3055310b300906035504061302434e311a3018060355040a1311576f5369676e204341204c696d69746564312a30280603550403132143657274696669636174696f6e20417574686f72697479206f6620576f5369676e30820222300d06092a864886f70d01010105000382020f003082020a0282020100bdca8dacb8911556977b6b5c7ac2de6bd9a1b0c31023faa7a1b2cc31fa3ed9a6296f163de06bf8b8405fdb39a8007a8ba04d547dc22278fc8e09b8a885d7cc95974b74d89e7ef000e40e89ae4928441a1099320f258853a40db30f1208160b0371271c7fe1dbd2fd6768c4055d0a0e5d70d7d897a0bc53419a918df49e36667a7e56c1905fe6b1682036a48c242c2c470b59766630b5bedeed8ff89dd3bb0130e6f2f30ee02c9280f385f9288ab4542e9aedf776fc156816eb4a6ceb2e128fd4cffe0cc75c1d0b7e0532be5eb0092a42d5c94e90b3590dbb7a7ecdd5085ab47fd81c6911f9270f7b06af5483187be1dd547a51686e77fcc6bf524a6646a1b2671abba34f77a0be5dfffc560b43727790ca9ef9f239f50da9f4ead7e7b3102f30423721cc3070c986980fcc584d83bb7de51aa5378db6ac3297003a6371241e9e37c4ff74d437c0e2fe88466011dd083f5036abb87aa495626a6eb0ca6a215a69f3f3fb1d703995f3a76ea68189a188c53b71caa352ee83bbfda077f4e46fe742db6d4a998a3448bc17dce4800822b6f231c03f043eeb9f2079d6b80664640231d7a9cd52fb84456909002adc558bc406464bc04a1d095b3928fda9abce00f92e484b26e6304ca558cab444824fe7911e33c3b093ff11fc81d2ca1f7129dd764f9225af1d81b70f2f8cc306cc2f27a34ae40e99ba7c1e451f7faa194596fdfc3d0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414e166cf0ed1f1b34bb7062014fe8712d5f6fefb3e300d06092a864886f70d01010505000382020100a8cb7240b276c17e7bfcad64e3327bcc3cb65d46d3f52ce2705dc82ed8067d98d10b21a0895924019df9af097d0a238234d5fc7c7299b9a3d754f4ea52700ec5f5d63be13a0932e6213993bdb315ea4f6af4f58b3f2f7c8d582ec5e139a03ec73d4a739e407ac02b61a967c9f324b9b36d552c5a1d9e2572ce0badaac755620bbefb63b3614423a3cbe11a0ef79a064dded4234e21965b395b571d2f5d085e0979ff7c97b54d83ae0dd6e6a379e033d099960230a73effd2a3433f055a06ea4402da7cf848d033a9f907c795e1f53ef55d71baf295a974886159e3bfca5a13ba72b48c5d3687e9a6c53c13bfded04426eeb7ec2e70fad79db7ace5c5405ae6d76c7b2cc3569b47cd0bcefa1bb421d7b766b8f425308b5c0db9ea67b2f46daed5a19e4fd89fe92702b01d06d68fe3fb48129f7f11a1103e4c513a96b0d113f1c7d826ae3aca91c4699ddf012964516f68da14ec084197908dd0b280f2cfc23dbf9168c580671ec4601355d56199577cba950f61493aca75bcc90a933f670e12f228e2311bc05716df087c19c17e0f1f851e0a367c5b7e27bc7abfe0dbf4da52bdde0c547031914395c8bcf03edd097e306450ed7f01a433674d684fbe15efb0f60211a21b13253adcc259f1e35c46bb672c0246ea1e48a6e65bd9b5bc51a29296dbaac63722a6fecc2074a32da92e6bcbc0821121b59379ee4486bed71ee41efb updroots.exe -
NTFS ADS 64 IoCs
Processes:
luminati.exeWinRAR.exechrome.exeExplorer.EXEchrome.exechrome.exe360SecureBrowser_setup.exedescription ioc Process File opened for modification C:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\lum_sdk_session_id:LUM:$DATA luminati.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Beast Bot 6.2\Beast\build.cmd:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[ModBot]-SNIFF-VNCBRUTE-SP2FIX-NICK\120-[ModBot]-VNCBRUTE-SP2FIX-2007\CleanUp.bat:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[SP2FIX-VNCBrute-Mohaa]-Test V1.0\120-[SP2FIX-VNCBrute-Mohaa]-Test V1.0\CleanUp.bat:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Cryptit\bin\Release\Hello.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\IrINi bot 0.1 public limited version for win32\bin\IriNi.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Java_Botnet2\Java_Botnet\Run.bat:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\DynastryCrypterSource\DynastryCrypterSource\Darow's Crypter 2.0\Client\OCX\Registrator.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\FUD Stub USG\VfCxbdJPjrhMHIGLwDK.exe:Zone.Identifier WinRAR.exe File opened for modification C:\Users\Admin\Downloads\Virus-Collection-main.zip:Zone.Identifier chrome.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-MYSQL-V2\RX-120-MYSQL-V2\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Aryan v0.5\Client\_default.pif:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\DCI Bot\xor\Release\xor.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Beast Bot 6.2\Beast\Other\crypt.cmd:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\GENTOOreptile-base\stub.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\IHS-H-A-V003-Exploits\OllyHole.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Java_Botnet\Run.bat:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\DarkAnalNKX-BACKDOOR-REMOVED\DarkAnalNKX-BACKDOOR-REMOVED\Extras\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\@@ SKUZ FIXED DDOS @@\Extras\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\CC.Trojan.EMAIL3\CC.Trojan.IRC.EMAIL3\Activate Windows.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Dbot.v3.1\MD5ChecksumTest.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\H-Bot M0d 3.0 M0dd3d by TH & Sculay5\exe\nzm.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\AkBot[IRC]-lsd_mod\ConfigGUI.exe:Zone.Identifier WinRAR.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\Temp1_malware-samples-master.zip\malware-samples-master\Downloader-CUZ\022aeb126d2d80e683f7f2a3ee920874.zip:Zone.Identifier Explorer.EXE File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\AryanRat04\Client\AryanRATServer.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120 Moded By t0nixx\Encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-VnC-Brute+pStore\120-[DVNC-TEST]-DDOS-V1.0\CleanUp.bat:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[DVNC-TEST]-DDOS-V1.0\120-[ModBot]-DDOS-V1.0\CleanUp.bat:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[ModBot]-VNCBRUTE-MSSQL-2007\120-[ModBot]-VNCBRUTE-MSSQL-2007\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[SP2FIX-VNCBrute-Mohaa]-STRIP V1.0\120-[SP2FIX-VNCBrute-Mohaa]-STRIP V1.0\CleanUp.bat:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Darkness IRC Bot\current.bat:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\IMBot_SRC_$$\xBuild.cmd:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-MYSQLBRUTE-V2\RX-120-MYSQL-V2\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[ModBot]-SP2FIX-SYM-VNCBRUTE\120-[ModBot]-VNCBRUTE-SP2FIX-2007\CleanUp.bat:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\DarkAnalNKX-BACKDOOR-REMOVED\DarkAnalNKX-BACKDOOR-REMOVED\stub.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Dwighlight_Stealer\Stub\Stub.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\IrINi bot 0.1 public limited version for win32\bin\BinToAscii.lnk:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Java_Botnet\jshrink.exe:Zone.Identifier WinRAR.exe File opened for modification C:\Users\Admin\Downloads\MentalMentor.exe:Zone.Identifier chrome.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Cryptit\bin\Release\Cryptit.exe:Zone.Identifier WinRAR.exe File opened for modification C:\Users\Admin\Downloads\oardefault.jpg:Zone.Identifier chrome.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-MYSQL-V999\RX-120-MYSQL-V999\CleanUp.bat:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[SP2FIX-VNCBrute-Mohaa]-STRIP V1.0\120-[SP2FIX-VNCBrute-Mohaa]-STRIP V1.0\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\@@ SKUZ FIXED DDOS @@\CleanUp.bat:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\CpBoT\stub.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\I1.4b0\Iroffer.1.4b03.UD.Patch.by.iNs.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\1.2.4.2\server\zsbcs64.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[BruteTest]-V0.5\120-[BruteTest]-V0.5\CleanUp.bat:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[ModBot]-V1.0\120-[ModBot]-V1.0\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[SP2fix-VncBrute]-FINALV1.0\120-[SP2fix-VncBrute]-FINALV1.0\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\2.12\pstord.exe:Zone.Identifier WinRAR.exe File opened for modification C:\Program Files (x86)\360\Total Security\config\newui\themes\default\ϹC:\Users\Admin\AppData\Local\Temp\CR_E5D63.tmp\setup.exe 360SecureBrowser_setup.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\1.1.0.0\zsb Builder.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[SP2-PATCH-BRUTE]-V2.0\120-[SP2-PATCH-BRUTE]-V2.0\120-[SP2-PATCH-BRUTE]-V2.0\120-[SP2-PATCH-BRUTE]-V2.0\CleanUp.bat:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Cryptit\stub\bin\Release\stub.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\GandCrab-Swarm\99eb1d90eb5f0d012f35fcc2a7dedd2229312794354843637ebb7f40b74d0809\99eb1d90eb5f0d012f35fcc2a7dedd2229312794354843637ebb7f40b74d0809.doc:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\1.2.4.2\server\zsbcs.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-PSTORE-MSSQL-SYM-NTPASS-VNC-NETAPI-2007\120-PSTORE-MSSQL-SYM-NTPASS-VNC-NETAPI-2007\CleanUp.bat:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[ModBot]-V0.5\120-[ModBot]-V0.5\encrypt.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\120-[SP2fix-VncBrute]-FINALV1.0\120-[SP2fix-VncBrute]-FINALV1.0\CleanUp.bat:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\ChodeBot C++ v1 base\Release\ChodeBase.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\CpBoT\Lib\stub.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\Darkness IRC Bot\ResHacker.exe:Zone.Identifier WinRAR.exe File created C:\Users\Admin\AppData\Local\Temp\Rar$EXa12396.29714.rartemp\Virus-Collection-main\Others\1.2.4.2\builder.exe:Zone.Identifier WinRAR.exe -
Office document contains embedded OLE objects 2 IoCs
Detected embedded OLE objects in Office documents.
Processes:
resource yara_rule behavioral2/files/0x000100000003af41-167891.dat office_ole_embedded behavioral2/files/0x000100000003af4a-167936.dat office_ole_embedded -
Suspicious behavior: AddClipboardFormatListener 3 IoCs
Processes:
mentalmentor.exeExplorer.EXEexplorer.exepid Process 5692 mentalmentor.exe 3296 Explorer.EXE 12776 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exechrome.exemsedge.exechrome.exemsedge.exeMentalMentor.tmpluminati.exementalmentor.exeQtWebEngineProcess.exeQtWebEngineProcess.exeav360_inst.exepid Process 2484 msedge.exe 2484 msedge.exe 3900 msedge.exe 3900 msedge.exe 1008 msedge.exe 1008 msedge.exe 920 identity_helper.exe 920 identity_helper.exe 2260 chrome.exe 2260 chrome.exe 2396 msedge.exe 2396 msedge.exe 2396 msedge.exe 2396 msedge.exe 2260 chrome.exe 2260 chrome.exe 1212 chrome.exe 1212 chrome.exe 1212 chrome.exe 1212 chrome.exe 1468 msedge.exe 1468 msedge.exe 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 1008 luminati.exe 1008 luminati.exe 1008 luminati.exe 1008 luminati.exe 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 5692 mentalmentor.exe 5692 mentalmentor.exe 5692 mentalmentor.exe 5692 mentalmentor.exe 6092 QtWebEngineProcess.exe 6092 QtWebEngineProcess.exe 6108 QtWebEngineProcess.exe 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 3520 MentalMentor.tmp 5848 av360_inst.exe -
Suspicious behavior: GetForegroundWindowSpam 11 IoCs
Processes:
mentalmentor.exeExplorer.EXEWinRAR.exeWinRAR.exeexplorer.exeWinRAR.exeWinRAR.exeWinRAR.exeWinRAR.exeWinRAR.exeWinRAR.exepid Process 5692 mentalmentor.exe 3296 Explorer.EXE 6516 WinRAR.exe 7788 WinRAR.exe 12776 explorer.exe 4424 WinRAR.exe 4988 WinRAR.exe 12024 WinRAR.exe 3300 WinRAR.exe 8616 WinRAR.exe 12396 WinRAR.exe -
Suspicious behavior: LoadsDriver 30 IoCs
Processes:
360TS_Setup.exeQHActiveDefense.exepid Process 660 660 660 660 660 660 7108 360TS_Setup.exe 7108 360TS_Setup.exe 660 660 660 660 2548 QHActiveDefense.exe 2548 QHActiveDefense.exe 2548 QHActiveDefense.exe 2548 QHActiveDefense.exe 660 660 2548 QHActiveDefense.exe 660 2548 QHActiveDefense.exe 2548 QHActiveDefense.exe 2548 QHActiveDefense.exe 2548 QHActiveDefense.exe 660 660 2548 QHActiveDefense.exe 660 660 660 -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 55 IoCs
Processes:
msedge.exechrome.exemsedgewebview2.exemsedgewebview2.exepid Process 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 10028 msedgewebview2.exe 9304 msedgewebview2.exe 9304 msedgewebview2.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid Process Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exechrome.exepid Process 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe