f67c9eb3930de4c767f522915503ce71ea4dbf02a003f5d44d1261d5c0db8f0e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2024, 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe
Size

4.8MB
MD5

11a07ae5b1c0322d338b600969f36d0f
SHA1

0b51fabe8a2bfff2dcbd13d4b0af7737c926e51f
SHA256

f67c9eb3930de4c767f522915503ce71ea4dbf02a003f5d44d1261d5c0db8f0e
SHA512

09268b1506524b10b02136bde864a66b93e44bb254179f2c6e3d5b792ba71decbd2f6c899682e88b6144193c8952dad8d9e308a7c016d2d28310a48776d3f56b
SSDEEP

98304:+7IyvTgqJ/BZXxkIjPG1f5ehM/Cw/khc5FbKEQ26PVR7m6gZ1MRGNCyI5AxV300e:4bg6BZBkIAhehM/Cw/khc5FbKEV6PVRz

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}	KB931125.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ = "RootsUpdate"	KB931125.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\IsInstalled = "1"	KB931125.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Version = "28,0,2195,0"	KB931125.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\Locale = "*"	KB931125.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF289A85-8E57-408d-BE47-73B55609861A}\ComponentID = "Windows Roots Update"	KB931125.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe

Executes dropped EXE 5 IoCs

pid	Process
400	KB931125.exe
648	updroots.exe
4172	updroots.exe
5056	updroots.exe
2860	updroots.exe

Loads dropped DLL 2 IoCs

pid	Process
824	2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe
400	KB931125.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KB931125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updroots.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updroots.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updroots.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updroots.exe

Modifies system certificate store 2 TTPs 64 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0048F8D37B153F6EA2798C323EF4F318A5624A9E	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\786A74AC76AB147F9C6A3050BA9EA87EFE9ACE3C	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\688B6EB807E8EDA5C7B17C4393D0795F0FAE155F	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4054DA6F1C3F4074ACED0FECCDDB79D153FB901D	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\293621028B20ED02F566C532D1D6ED909F45002F	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a09000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c02000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABB51672400588E6419F1D40878D0403AA20264\Blob = 0b000000010000006c0000004a006100700061006e002000430065007200740069006600690063006100740069006f006e002000530065007200760069006300650073002c00200049006e0063002e0020005300650063007500720065005300690067006e00200052006f006f0074004300410031000000090000000100000016000000301406082b0601050507030406082b06010505070301030000000100000014000000cabb51672400588e6419f1d40878d0403aa2026420000000010000002d030000308203293082021102085f60585f00000000300d06092a864886f70d01010505003057310b3009060355040613024a50312b3029060355040a13224a6170616e2043657274696669636174696f6e2053657276696365732c20496e632e311b3019060355040313125365637572655369676e20526f6f74434131301e170d3939303931353135303030315a170d3230303931353134353935395a3057310b3009060355040613024a50312b3029060355040a13224a6170616e2043657274696669636174696f6e2053657276696365732c20496e632e311b3019060355040313125365637572655369676e20526f6f7443413130820122300d06092a864886f70d01010105000382010f003082010a028201010094900c4b71291cdaf668797aa4bae7d2cc8dafe84790991fc62aea9763e81fce1757c61ab3a8c77c87ed353580baba6e6dbe17fecc2d1b6cef8a004916e1ee065e4a075dab3dd150b89146d4d4da15d8945c0ecad7dabfa0f7493cc8bbceea26810a142d9c0d37456b41ca578b38f0261f31fccf348e8f77c13fe3ab543c27b4ce324c551362fcfe3a1625cf1b6ba223b7e0ea0269bbf722716d7c0b1993a1979ce391691f68e42f7d106d8f67aec110a2b05e634a97f7e678a9ad26bb54c9dfb4eec59ed325dd136853f98fe8ece5de81d6783eee5040b4013cac15c1823b2e7ff152278b72e0e7dbf98b29c3c34a2b3389ab5c2a07fc7c231e2b4f0822fec10203010001300d06092a864886f70d0101050500038201010055ed6f7b93e545314e68d55581a2081f6cdd09c5781a7057c8df0881ae6677c6750fe4ef498b035c6cff1c90a472b2d31612b206f84686aebfa715db854dfac22d4db3b5b043ef7c7e07db5fb357465176078644fd07eaf1cb4b454d66a73326c4f943aa8d12b3d48d68b6f70279b42d5ad70398042c6999aff4663b64acb2c02bc869549e4c4e48188dce57b53b51e51bd7fa3960db564513bee766d523f67c4800b04cef348d22acb22ed14c38cdfa580306ee3a73870a053acae4afd4c1ee1c857f2516cf27011f848a7708d0d346e820ec9fa48cf1bccdc41236801ec70928afe808bec0d3b23ed72e673da3cebb34fae285cdacce551d455b7885d3857a	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\68ED18B309CD5291C0D3357C1D1141BF883866B1\Blob = 0b000000010000002000000058006300650072007400200045005a0020006200790020004400530054000000090000000100000016000000301406082b0601050507030406082b0601050507030103000000010000001400000068ed18b309cd5291c0d3357c1d1141bf883866b12000000001000000fc030000308203f8308202e0a003020102021100d01e40900000274b0000000100000004300d06092a864886f70d010105050030818c310b3009060355040613025553310d300b0603550408130455746168311730150603550407130e53616c74204c616b65204369747931183016060355040a130f586365727420455a20627920445354311830160603550403130f586365727420455a206279204453543121301f06092a864886f70d010901161263614064696773696774727573742e636f6d301e170d3939303731343136313431385a170d3039303731313136313431385a30818c310b3009060355040613025553310d300b0603550408130455746168311730150603550407130e53616c74204c616b65204369747931183016060355040a130f586365727420455a20627920445354311830160603550403130f586365727420455a206279204453543121301f06092a864886f70d010901161263614064696773696774727573742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100ad5418deb4bff7ade874aaed8b7c8fc2d4751ad584b9b662fc89efe4976192fb1db8e15a47349e9e0622fbd3ea38cbb88b07f71aa01777075a301cd4293820d72740d8509343bfd218a229760572aa6bb66998ab791e1c65f56a8bfcc516aaa272da60ed4e6e19257a0a1d30e3509b423c44eba1b0201edb027efe3d1fbfd0008adb4076a618a515a757b652c2011798778f8a81c61ab46a2ae6afa9d600accfd815497cdb1ba1fe81fa87f9d390c102c0f9d042e99168255fc6bf8739e995006028bf832cc0e75eb6d73616e7608776e8e727b2250d8b7ae5aa1de559cdce0b0e6fc6c89ce310d98539d3b79bfac6ba7c74d25d7556ab74a4a251bf527cee710203010001a3533051300f0603551d130101ff040530030101ff301f0603551d2304183016801408206c66eb810a6c5cd5b5a63c41dd1c96912777301d0603551d0e0416041408206c66eb810a6c5cd5b5a63c41dd1c96912777300d06092a864886f70d010105050003820101005a87588f2dab76216b540cd9f141f64ecd2b9ee31f9ba32d7fd92b7d58c867a429f5e9ecd5bd963fa373f8c45b367cd0632c34399b48b83d6ff614c59e63e6a7346ed3e833b3c73c186e23ae4392993f98c56930f1363badb93082d6b6591696020b291261b41189f70c2f94908598289c536c7e63dd73f419ff4a81d1b25223fd3c4a34ce5a1be0508aed4f8195d860e7e4c40dbb583e58f74e686f3e67c9cb7a971627ec42611476bb00c5eb083d157f4bb6225d873b90f4f3c0fe37b3e9d9620cc0c359af60bd1f0ddba1341f30c43d8badb01d0493ed5fd5e4bf203004f448e93301d12e902752b39bde3a1caba9977f9bebc28dc26decdc13d346c5797c	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\253F775B0E7797AB645F15915597C39E263631D1\Blob = 0b00000001000000240000004200490054002000410064006d0069006e002d0052006f006f0074002d00430041000000090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b06010505080202030000000100000014000000253f775b0e7797ab645f15915597c39e263631d1200000000100000059050000308205553082043da00302010202043bf381d0300d06092a864886f70d0101050500306c310b3009060355040613026368310e300c060355040a130561646d696e3111300f060355040b1308536572766963657331223020060355040b131943657274696669636174696f6e20417574686f726974696573311630140603550403130d41646d696e2d526f6f742d4341301e170d3031313131353038353130375a170d3231313131303037353130375a306c310b3009060355040613026368310e300c060355040a130561646d696e3111300f060355040b1308536572766963657331223020060355040b131943657274696669636174696f6e20417574686f726974696573311630140603550403130d41646d696e2d526f6f742d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100cbe0af441422fe6a1749f25d9dcf5c02620b80b95abfa855337ba312245e4c6f3b41894e833d9fb3952634a6cc12f4cc9d875e3d0c0d172f85263e2a265973a1a8bc3bebe546b8f3597b20b15e40016dba67b36bebefc5e2f935dd0c6a06b69a289a70b3402976c07146116b43afe55641fbe61c39834db7f6a2b166c9a80db2f077be36c1202732b9ccd75acaf61741364dfbbb5581639c935e836b7fb81577727c7d4d096b5995e6ed30ab4446d91501a55b8965b6e028d92808957e0823b222e8df254c3c68f76ee74bc790fd844126be5c833ad72379b71af80719825a6958c5ff88722bc7bef8d32d3377a71612a88b21c642ae7a64aff2b3c0ed77e4690203010001a38201fd308201f9300f0603551d130101ff040530030101ff3081990603551d2004819130818e30818b06086085740111030100307f302b06082b06010505070202301f1a1d54686973206973207468652041646d696e2d526f6f742d434120435053305006082b060105050702011644687474703a2f2f7777772e696e666f726d6174696b2e61646d696e2e63682f504b492f6c696e6b732f4350535f325f31365f3735365f315f31375f335f315f302e706466307f0603551d1f047830763074a072a070a46e306c311630140603550403130d41646d696e2d526f6f742d434131223020060355040b131943657274696669636174696f6e20417574686f7269746965733111300f060355040b13085365727669636573310e300c060355040a130561646d696e310b3009060355040613026368301d0603551d0e04160414829ffa237320f1978bb24c4dbe42c57f66cd64e83081990603551d2304819130818e8014829ffa237320f1978bb24c4dbe42c57f66cd64e8a170a46e306c310b3009060355040613026368310e300c060355040a130561646d696e3111300f060355040b1308536572766963657331223020060355040b131943657274696669636174696f6e20417574686f726974696573311630140603550403130d41646d696e2d526f6f742d434182043bf381d0300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100784f7a5c2611a72eae9a43ca5c3582467ec8368f7a66b5a932081c0ce46ea1f1c8c1d4e480e78cbd63b10cdff2b93ec20b71406946a36cf45b0f0d2144c72a2b3d1a0bc0a0c1cc88ca1c3fac52b6f667cd4c6dc4be23fd412b046e77a51678e99b5c23cf811a0621636adc2951b23af99bf75db12df50417067f9ce837852dee31bc2e01f8c4eb6b8e34c53939f69498bb1f0e1e112fa88c070a48a28c6a998534b72a6185781a29691f9d25505104ca17c339380771e7d1989bd5d1181596bce2f3c9672bf109b2ce9cf4432601fa576b90a9b1bee835d569fff039154ebc5ff0cf3bf4be233f4566c4b4965dbe8f0ddec76d0942f389f9f13ff5744fdfb865	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E0B4322EB2F6A568B654538448184A5036874384	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D8C5388AB7301B1B6ED47AE645253A6F9F1A2761\Blob = 5300000001000000230000003021301f060960857401590102010130123010060a2b0601040182373c0101030200c00b0000000100000014000000530077006900730073005300690067006e00000009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303030000000100000014000000d8c5388ab7301b1b6ed47ae645253a6f9f1a27612000000001000000be050000308205ba308203a2a003020102020900bb401c43f55e4fb0300d06092a864886f70d01010505003045310b300906035504061302434831153013060355040a130c53776973735369676e204147311f301d0603550403131653776973735369676e20476f6c64204341202d204732301e170d3036313032353038333033355a170d3336313032353038333033355a3045310b300906035504061302434831153013060355040a130c53776973735369676e204147311f301d0603550403131653776973735369676e20476f6c64204341202d20473230820222300d06092a864886f70d01010105000382020f003082020a0282020100afe4ee7e8b240e126ea9502d16443b92925ccab85d849242132abc655782403e5724cd508b252ab76ffcefa2d0c01f02244a13968f2313e6285800a347c706a784232bbbbd962b7f55cc8bc1571f0e62650fdd3d568a73daae7e6dba811c7e428c2035d9434d84fa84db522cf30e27770b6bbf112f72789f2ed83ee618375a2a72f9da62909295ca1f9ce9b33c2bcbf30113bf5acfc1b50a60bdddb5996453b8a096b36fe22677918ce06210029f340fa4d5923351debe8dba847a603c6adb9f2becdede013f6e4de55086cbb4afed4440c5ca5a8cdad22b7ca8eebea6e50aaa0ea5df0552b755c7225d326a97976313dbc9db79367b853a4ac55289f924e79d77a982ff551ca571692bd10224f2b326d46bda0455e5c10ac76d3037902ae49e14335e161755c55bb5cb348992f19d268fa107d4c6b27850db0c0c0b7c0b8c41d7b9e9dd8c88f7a34db232ccd817dacdb7ce669dd4fd5effbd973e2975e77ea76258af2534a541c73dbc0d50ca03030f085a1f95737862bfaf7214690ea5e5030e788e262842f0070b622010673946faa903cc04387a66ef2083b58c4a568e9100fc8e5c82de88a0c3e2686e7d8def3cdd65f45dac51ef2480aeaa56976ff9ad7dda613f98773ca591b61c8c26da65a2096dc1e254e3b9ca4c4c808f777b609a1edfb6f2481e0eba4e546d98e0e1a21aa27750cfc46392ec47199debe66bcec10203010001a381ac3081a9300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604145b257b96a465517eb839f3c078665ee83ae7f0ee301f0603551d230418301680145b257b96a465517eb839f3c078665ee83ae7f0ee30460603551d20043f303d303b0609608574015901020101302e302c06082b060105050702011620687474703a2f2f7265706f7369746f72792e73776973737369676e2e636f6d2f300d06092a864886f70d0101050500038202010027bae3947cf1aec0de17e6e5d8d5f554b083f4bbcd5e057b4f9f7566af3ce8567efc72783803d92b621b00b9f8e960cdccce518ac750316ee14a7e182f6959b63d64812be38384e622878e7de0ee029961b81ef4b82b88121684c23193389631a6b93b533fc32493565b6992ecc5c1bb3800e3ec17a9b8dcc77c01839f3247ba5222341d327a0956a77c2536a93d4bdac0826f0abb12c8874b2711f91e2dc7933f9edb5f266b52d92e8af114c6448d15a9b7bfbddea61aeeae2dfb487717febbecaf18f52a51f0398497956c6e1bc32bc474607925b00a27dfdf5ed239cf457d424bdfb32c1ec5c65dca553aa09c699a8fdaefb2b03c9f876c122b65701552311a24cf6f3123501f8c4f8f23c37441631c55a814dd3ee05150cff11b30560e92b08285d883cb2264bc2db825d554a2b806eaad92a424a0c186b54a136a47cf2e0b569554cbce9adb6ab4a6b2db4108862777f76aa0426c0b38ced775503292c2df2b302248d0d54138255da4e95d9fc69475d045fd3097438f90ab0ac78673604a692ddea578d706da6a9e4b3e773a20132201d0bf689e63606b354d0b6dbaa13dc093e07f23b355ad72254e46f9d216efb064c1019ee9caa06a980ecfd860f22f49b8e442e1383516f4c86e4ff78156e8baa3be23afaefd6f03e0023b3076fa1b6d41cf01b1e9b8c966f4db26f33aa474f249245bc9b0d057c1fa3e7ae197c9	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\06083F593F15A104A069A46BA903D006B7970991\Blob = 0b00000001000000520000004e00650074004c006f0063006b0020004100720061006e0079002000280043006c00610073007300200047006f006c0064002900200046005101740061006e00fa007300ed0074007600e1006e0079000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030703000000010000001400000006083f593f15a104a069a46ba903d006b797099120000000010000001904000030820415308202fda003020102020649412ce40010300d06092a864886f70d01010b05003081a7310b30090603550406130248553111300f06035504070c08427564617065737431153013060355040a0c0c4e65744c6f636b204b66742e31373035060355040b0c2e54616ec3ba73c3ad7476c3a16e796b696164c3b36b202843657274696669636174696f6e205365727669636573293135303306035504030c2c4e65744c6f636b204172616e792028436c61737320476f6c64292046c59174616ec3ba73c3ad7476c3a16e79301e170d3038313231313135303832315a170d3238313230363135303832315a3081a7310b30090603550406130248553111300f06035504070c08427564617065737431153013060355040a0c0c4e65744c6f636b204b66742e31373035060355040b0c2e54616ec3ba73c3ad7476c3a16e796b696164c3b36b202843657274696669636174696f6e205365727669636573293135303306035504030c2c4e65744c6f636b204172616e792028436c61737320476f6c64292046c59174616ec3ba73c3ad7476c3a16e7930820122300d06092a864886f70d01010105000382010f003082010a0282010100c4245e73be4b6d14c3a1f4e397906ed230451e3cee67d964e01a8a7fca30ca83e320c1e3f43ad3945f1a7c5b6dbf304f8427f69f1f49bcc6990a90f20ff57f43843763518b7aa570fc7a58cd8e9bedc3466c84705ddaf3019023fc4e30a97ee12763e7ed643ca0b8c93363fe1690ffb0b8fdd7a8c0c094430bb6d559a69e56d0241f7079afdb39540d6575d915419401af5eecf68df1ffad64fe209ad75cebfea61f0864a38b7655ad1e3b28602e8725e8aaaf1fc6644620b7707f3cde48db9653b73977e41ae2c7168476975b2fbb191585f86985f599a7a9f234a7a9b6a603fc6f863d547c76049b6bf9405d0034c72e99759de58803aa4df803d24276c01b020300a88ba345304330120603551d130101ff040830060101ff020104300e0603551d0f0101ff040403020106301d0603551d0e04160414ccfa6793f0b6b8d0a5c01ef353fd8c53df83d796300d06092a864886f70d01010b05000382010100ab7fee1c16a99c3c5100a0c0110805a799e66f018854616ef1b918ad4aadfe814023942ffb757c2f284b622481820bf561f11c6eb86138eb81fa62a13b5a62d39465c4e1e66d82f82f2570b22126c172511f8c2cc38490c35a8fbacff4a765a5eb98d1fb05b2467515236a6f85633080f0d59e1f291cc26cb050595d905b3ba80d30cfbf7d7fcef19d83bdc9466e20a6f96151ba212f7bbea51563a1d49587f19eb9f389f33d85b8b8dbbeb5b929f9da3705004994038444e7bf4331cf758b25d1f4a664f592f6ab05eb3de9a50b3662dacc065f368bb65e31b82afb5ef671df44269ec4e60d91b42e759580516a4b30a6b062a193f19bd8cec463753f5947b1	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E0B4322EB2F6A568B654538448184A5036874384\Blob = 030000000100000014000000e0b4322eb2f6a568b654538448184a5036874384090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b000000010000000e00000045004400490043004f004d0000002000000001000000b9050000308205b53082039da0030201020208618dc7863b018205300d06092a864886f70d010105050030443116301406035504030c0d4143454449434f4d20526f6f74310c300a060355040b0c03504b49310f300d060355040a0c06454449434f4d310b3009060355040613024553301e170d3038303431383136323432325a170d3238303431333136323432325a30443116301406035504030c0d4143454449434f4d20526f6f74310c300a060355040b0c03504b49310f300d060355040a0c06454449434f4d310b300906035504061302455330820222300d06092a864886f70d01010105000382020f003082020a0282020100ff9295e1680676b42cc85848cafd805429556324ff90659b10757bc36adb620201f21886b57c5a38b1e458b9fbd3d82d9fbd3237bf2c156dbeb5f421d21391d907ad0105d6f3bd77ce5f42810af96ae38300a82b2e55136381ca471c7b5c16577a1b8360043a3e65c3cd01dedea4d60cba8eded904ee1756229b8f63fd4d160bb77b778cf925b5d16d99122e4f1ab8e6ea0492ae3d11b951423d87b03185af795a9cfee74e5e924f43fcab3aada5122666b9e20cd798ced458a595400ab7449d13742bc2a5eb22159810d88bc5049f1d8f60e5061b9bcfb979a03da2233f423f6bfa1c037b308dce6cc0bfe61b5fbf67b88419d515ef7bcb90363162c9bc02ab465f9bfe1a6894343d908eadf6e41d097f4a88383fbe67fd3496f51dbc3074cb38eed56cabd4fcf400b7005b8532167633e9d8a3999d0500aa16e6f3817d6f7daa866dad1574d3c4a271aaf4147de732b81fbcd5f14ebd6f170239d70e95423ac7003ee9266311ea0bd14aff189db2d77b2f3ad996fbe81e92ae1355c8d927f6dc481bb024c185e3779d9aa4f30c111d0dc8b414eeb5825709bf20587f2f2223d870cb796cc94bf2a92ac8fc872bd71a50f827e82f43e33abdd85771fdcea6525bf9dd4dede5f66f89edbb939c762175f0924c29f72f9c012efe50469e640c14b3075bc5c2736cf1075c45241435ae83f16a4d897afab3d82d66f03687f52b530203010001a381aa3081a7300f0603551d130101ff040530030101ff301f0603551d23041830168014a6b3e12b2b49b6d773a1aa94f501e773654cac50300e0603551d0f0101ff040403020186301d0603551d0e04160414a6b3e12b2b49b6d773a1aa94f501e773654cac5030440603551d20043d303b30390604551d20003031302f06082b060105050702011623687474703a2f2f6163656469636f6d2e656469636f6d67726f75702e636f6d2f646f63300d06092a864886f70d01010505000382020100ce2c0b525162267d0c27838fc5f6daa0687b4f925eeaa47332115344b244cb9dec0f7942b310a6c70d9dcbb6fa3f3a7ceabf88531b3cf782fa053533e135a857c0e7fd8d4f3f93324f786603770758e995c87e3ed079008cf21b51339bbc94e93a7b6e522d329e23a445fbb62e13b08b18b1ddced51da7427f55befb5bbb47d4fc24cd04ae960515d6acce30f3ca0bc5bae222e0a6ad22e402ee74117f4cff781d35dae60234eb1812617706091663ea18ada2871ff2c7800909754e10a88f3d86b87511c024628a967b4a45e9ec59c5be6b83e6e1e8acb5301efe050780f9e1230d508f0598ff2c5fe83bb6adcf81b52187ca082a232730202bcfed945bacb27ad2c728a18a0b9b4d4a2c6d853f09723c67e2d9dc07baeb657b5a0163d6905b4f17663d7f0b19a3936310522a9f141658e2dca5f4a1168b0e918b81ca9b59fad86b910765555f521faf3afb90dd69a55b9c6d0e2cb6faceaca57c324a6740dc303423ddd7042366f0fc5580a7fb66198235676270395e6fc7ea904044081eb8b2d6dbee59a70d187934bc54185e53ca3451ed450ae68ec782363ea73863a9302c171060929f5587125910c20f676911cc4e1e7e4a9aadaf40a875ac569074b8a09ca5796fdce91ac86905e9bafa03b37ce4e04ec2ce9de8b6460d6e7e573a6794c2cb1f9c774a674e6986439338fbb6db4f8391d4607e4b3e2b380755985ea4	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\409D4BD917B55C27B69B64CB9822440DCD09B889	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2964B686135B5DFDDD3253A89BBC24D74B08C64D	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A0A1AB90C9FC847B3B1261E8977D5FD32261D3CC	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A69A91FD057F136A42630BB1760D2D51120C1650	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\40E78C1D523D1CD9954FAC1A1AB3BD3CBAA15BFC	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 0b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030703000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7FBB6ACD7E0AB438DAAF6FD50210D007C6C0829C\Blob = 0300000001000000140000007fbb6acd7e0ab438daaf6fd50210d007c6c0829c090000000100000074000000307206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030606082b0601050507030706082b0601050508020206082b06010505070308060a2b0601040182370a0304060a2b0601040182370a030c06082b060105050703090b000000010000001e000000480061006c0063006f006d00200043004100200050004f0020003200000020000000010000001d0200003082021930820182a00302010202030134e2300d06092a864886f70d01010505003037310b3009060355040613025349310f300d060355040a130648616c636f6d311730150603550403130e48616c636f6d20434120504f2032301e170d3034303230373138333333315a170d3139303230373138333333315a3037310b3009060355040613025349310f300d060355040a130648616c636f6d311730150603550403130e48616c636f6d20434120504f203230819f300d06092a864886f70d010101050003818d00308189028181009417f24937303209083cbef537b7746c103bcb22710706b9c6ecda48f39f276d648d55de794750fb68ce7901bea71bf661ad7d310b5320ad31f15bce23faffcc12025a009cfccd6b1252e8acd4333b732610719040bf0388dfbc5f210d8cd68a931fe7ae1554c64ce4996192e0f78d72c7dc621333a33e4929fb84bf703a91210203010001a3333031300f0603551d130101ff040530030101ff30110603551d0e040a040848af5766bfd2c002300b0603551d0f040403020106300d06092a864886f70d01010505000381810090165776b879cefcc4d13700a2cdff38071173130549eddfc1c5cec640d8f702960db76f11843866fb71f71001677c5d7d24daf6643b088048a64ebd44e2b007328f7c8637466fc0830393b5f4f3127ca3e8cbe23a2378fa686ffe58ca0ca757512d6290f9e4a8dcf5cadf0e87516e3775260ed77e788a03a29519b65e910156	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A7F8390BA57705096FD36941D42E7198C6D4D9D5	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\016897E1A0B8F2C3B134665C20A727B7A158E28F\Blob = 030000000100000014000000016897e1a0b8f2c3b134665c20a727b7a158e28f090000000100000036000000303406082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030c0b00000001000000740000004e00650074004c006f0063006b0020004d0069006e006f0073006900740065007400740020004b006f007a006a006500670079007a006f0069002000280043006c0061007300730020005100410029002000540061006e007500730069007400760061006e0079006b006900610064006f0000002000000001000000d5060000308206d1308205b9a00302010202017b300d06092a864886f70d01010505003081c9310b30090603550406130248553111300f06035504071308427564617065737431273025060355040a131e4e65744c6f636b2048616c6f7a617462697a746f6e73616769204b66742e311a3018060355040b131154616e7573697476616e796b6961646f6b31423040060355040313394e65744c6f636b204d696e6f736974657474204b6f7a6a6567797a6f692028436c617373205141292054616e7573697476616e796b6961646f311e301c06092a864886f70d010901160f696e666f406e65746c6f636b2e6875301e170d3033303333303031343731315a170d3232313231353031343731315a3081c9310b30090603550406130248553111300f06035504071308427564617065737431273025060355040a131e4e65744c6f636b2048616c6f7a617462697a746f6e73616769204b66742e311a3018060355040b131154616e7573697476616e796b6961646f6b31423040060355040313394e65744c6f636b204d696e6f736974657474204b6f7a6a6567797a6f692028436c617373205141292054616e7573697476616e796b6961646f311e301c06092a864886f70d010901160f696e666f406e65746c6f636b2e687530820122300d06092a864886f70d01010105000382010f003082010a0282010100c75225b2d83dd4845509a71bbd6cb914f48a02db76fc6a2a78abe577f06ee08c2367dba56499b9dd013e6fef2d9a3c22f05dc957a055417ff2435e5882533165ce1ef226ba00541eafb0bc1ce4528ca032afb737b1536768746750f62d2e64deae2679dfdf9986abab7f85eca0fb80ccf4b80c1e934563b9dcb85b9bed5b39d45f62b0a78e7c66382caab1086317677dccbdb3f1c33fcf5039edd1198315db87122796b7daeae59dbcbaea394f8bef749ae7c5d0d2ea86511ce4fe640828047905ebcac5710e0befabeaec1211a118053269d10c2c1a3d25993fb57cca6db0ae9999fa0860e719c2f2bd51d3ccd302acc1110c80ceabdc949d6ba339533ad685020300c57da38202c0308202bc30120603551d130101ff040830060101ff020104300e0603551d0f0101ff0404030201063082027506096086480186f842010d048202661682026246494759454c454d2120457a656e2074616e7573697476616e792061204e65744c6f636b204b66742e204d696e6f73697465747420537a6f6c67616c74617461736920537a6162616c797a61746162616e206c6569727420656c6a617261736f6b20616c61706a616e206b65737a756c742e2041206d696e6f73697465747420656c656b74726f6e696b757320616c6169726173206a6f67686174617320657276656e796573756c6573656e656b2c2076616c616d696e7420656c666f6761646173616e616b2066656c746574656c652061204d696e6f73697465747420537a6f6c67616c74617461736920537a6162616c797a617462616e2c20617a20416c74616c616e6f7320537a65727a6f646573692046656c746574656c656b62656e20656c6f69727420656c6c656e6f727a65736920656c6a61726173206d6567746574656c652e204120646f6b756d656e74756d6f6b206d656774616c616c6861746f6b20612068747470733a2f2f7777772e6e65746c6f636b2e68752f646f63732f2063696d656e2076616779206b65726865746f6b20617a20696e666f406e65746c6f636b2e6e657420652d6d61696c2063696d656e2e205741524e494e4721205468652069737375616e636520616e642074686520757365206f66207468697320636572746966696361746520617265207375626a65637420746f20746865204e65744c6f636b205175616c69666965642043505320617661696c61626c652061742068747470733a2f2f7777772e6e65746c6f636b2e68752f646f63732f206f7220627920652d6d61696c20617420696e666f406e65746c6f636b2e6e6574301d0603551d0e04160414096a621692b05abb550ecb75323a32e5b221c928300d06092a864886f70d01010505000382010100916a509cdb78819b3f8b42e33bfca6c3ee43e0cff3e2803549457602e2e32f05c5f12ae7c04133c6b69bd03339cdc0dba1ad6c37024c58413bf29792c648a8cde58a398961f95297e9bdf6f99474e8710ebc7786c306cc5a7c4a7e3450302efb7f329a8d3df3205bf86aca86f3314c2c5980027dfe38c930751cb755e3bc9fbaa86d84280575b38b0dc0915421e7a60bb499f55141dccda34722d9c70181c4dc474f26ea1feddbcd0d98f4a39cb473324a9699febc7fc82558f858f376668954a4a63ec4505cba891882754821d24f13e8607e0776db10b551e6aab968aacdf69d907512ea381aca44e8b799a72a68956695abadef89cb60a90612c69447e928	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7639C71847E151B5C7EA01C758FBF12ABA298F7A	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C73026E325FE21916B55C4B53A56B13DCAF3D625	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8782C6C304353BCFD29692D2593E7D44D934FF11\Blob = 53000000010000002600000030243022060c6086480186fd64010102040130123010060a2b0601040182373c0101030200c00b00000001000000140000005400720075007300740077006100760065000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080300000001000000140000008782c6c304353bcfd29692d2593e7d44d934ff112000000001000000bc030000308203b8308202a0a00302010202100cf08e5c0816a5ad427ff0eb271859d0300d06092a864886f70d01010505003048310b30090603550406130255533120301e060355040a1317536563757265547275737420436f72706f726174696f6e311730150603550403130e5365637572655472757374204341301e170d3036313130373139333131385a170d3239313233313139343035355a3048310b30090603550406130255533120301e060355040a1317536563757265547275737420436f72706f726174696f6e311730150603550403130e536563757265547275737420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aba481e595cdf5f6148ec24fcad4e27895589c41e10d9940241739913366e9bee183af625c89d1fc245b61b3e01111411c1d6ef0b8bbf8dea781baa648c69f1dbdbe8ea9413eb894ed291ad48ed2031d03ef6d0d671c57d706adcac8f5fe0eaf66254804960b5da3ba16c3084fd146f8145cf2c85e01996dfd88cc86a8c16f31426c523e68cbf31934dfbb8718568026c4d0dcc06fdfdea0c29116a064114b44bc1ef6e7fa63de66ac76a471a3ec3694687a77a4b1e70e2f817ae2b57286efa26b8bf00fdbd3593fba72bc44249ce373b3f7af572f42269da974ba0052f24bcd537c470b36850e66a90897163457c166f780e3ed7054c793e02e28155987babb0203010001a3819d30819a301306092b060104018237140204061e0400430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604144232b616fa04fdfe5d4b7ac3fdf74c401d5a43af30340603551d1f042d302b3029a027a0258623687474703a2f2f63726c2e73656375726574727573742e636f6d2f535443412e63726c301006092b06010401823715010403020100300d06092a864886f70d0101050500038201010030ed4f4ae1583a52725bb5a6a36518a6bb513b77e99dead39f5ce045657b0dca5be27050b2940514ae49c78d41071273947e0c2321fdbc107f60105a72f5980eacecb97fdd7a6f5dd31cf4ff88056942a90571c8b7ac26e82eb48c6aff71dcb8b1df99bc7c21542be458a2bb5729ae9ea9a319260f992e08b0effd69cf991a098de3a79f2bc936347b24b3784c9517a406261eb66452365f6067d99cc505740be76723d208fc88e9ae8b7fe130f4377efdc632da2d9e4430306cee07ded234fcd2ff40f64bf466460654a6f2320a6326306b9bd1dc8b47bae1b9d562d0a2a0f467057829631a6f04d6f8c64ca39ab137b48de5284b1d9e2cc2b868bced02ee31	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4313BB96F1D5869BC14E6A92F6CFF63469878237\Blob = 0300000001000000140000004313bb96f1d5869bc14e6a92f6cff63469878237090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030806082b060105050703030b000000010000002e000000540065006c006900610053006f006e00650072006100200052006f006f007400200043004100200076003100000020000000010000003c0500003082053830820320a00302010202110095be16a0f72e46f17b398272fa8bcd96300d06092a864886f70d0101050500303731143012060355040a0c0b54656c6961536f6e657261311f301d06035504030c1654656c6961536f6e65726120526f6f74204341207631301e170d3037313031383132303035305a170d3332313031383132303035305a303731143012060355040a0c0b54656c6961536f6e657261311f301d06035504030c1654656c6961536f6e65726120526f6f7420434120763130820222300d06092a864886f70d01010105000382020f003082020a0282020100c2beeb27f021a3f36926557e9dc55516915cfdef21bf53807a2dd2918c6331f0ec24f0c3a5d2727c106df437b7e5e67c79ea8cb5828bae48b6ac00dc6575ec2a4d5fc187f520652b81a8473e8923953016907fe8570748e719aebf4567b1371b062afedef9ac7d83fb5ebae48f9767be4b8e8d64075738556934363d1348ef4fe2d3661ea4cf1ab75e3633d4b406bd1801fd7784500045f58c5de823bc7efe35e1ed507ba9308d19d3098e68675dbf3c971853bb2962c5ca5e72c1c796d4db2da0b41f6903eceae250f10c3cf0acf3532df01cf5ed6c3939738016c852b023cde03edcdd3c47a0bb358ae298688bbee5bf72eed2faa5ed12edfc9818a92676dc284b10201cd37f16772ded6f80f749bb5305bb5d68c7d4c875163f895a8bf71747d44cf1d289793e4d3d98a861de3a1ed2f85e03e0c1c91c8cd38d4dd39536b3375f63639b3314f02d266b537c898c32c26eec3d210039c9a168e250832eb03a2bf336a0ac2fe46f61c25109393e8b53b9bb67dadc53b97659369d43e520e03d3260852251b7c733bbdd152fa478a6077b8146360486dd7935c7952c3bb0a31735e5731fb45c59efdaea10657b7ad07f9fb3b42a373b708b9b5bb92bb7ecb251129753295ad4f01210dc4f02bb12922f62d43f69437c0dd6fc587501889d58164bdeba90ff470189066af65fb2906ab302a60288bfb3477e2ad9d5fa6878354d0203010001a33f303d300f0603551d130101ff040530030101ff300b0603551d0f040403020106301d0603551d0e04160414f08f593800b3f58f9a960cd5ebfa7baa17e81312300d06092a864886f70d01010505000382020100bee45c624e24f40c08fff0d30c68e49349223f44276fbb6dde8366cea8cc0dfcf59a06e5771491eb9d417b992a84e5fffc21c15df0e41f57b775a9a15f0226ffd7c7f74ede4ff8f71c46c07a4f402c2235f019b1d06b672cb0a8e0c0403735f6845c5ce3af4278fea7c90d50ea0d8476f651ef8353c67aff0e56492e8f7ad60ce62754e34d0a607262cd9107d6a5bfc8996bedc419e6ab4c1138c56f31e26e49c83f768026032629e036f6f62053e3177034179d63681e6becc34d86b813302f5d460d4743d51baa590eb95c8d0648ad74875fc7fc31544113e2c7210e9ee01e0de1c07b438590c58a58c6650a7857f2c6230f01d9204bde0ffb9285752a5c738d6d7b2591caee45ae064b00ccd3b15950da3a883b2943465e972b54ce536f8d4ae796fabf710e428b7cfd28a0d048cadac4814cbba2739326c8eb0cd62688b6c024cfbbbd5beb757de9088e86332c79770969a589fcb3709087768fd322bb42cebd730b20262ad09b3d701e246ccd8776a91796b7cf0d92fb8e18a99849d19efe60447221b919edc2f531f13948889024755416adcef4f869146439fba3b8ba7040c7271cbfc45653fa6365d0f31c0e16f56b86584d18d4e40d8ea59d5b91dc7624503fc62afbd9b79cb5d6e6d0d9e8198b157148adb7ead85988d490bf16b3d9e9ac596154c81cbacac1cae1b9204c8f3a9389a5a0ccbfd3f675a475966d56	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F9DD19266B2043F1FE4B3DCB0190AFF11F31A69D\Blob = 030000000100000014000000f9dd19266b2043f1fe4b3dcb0190aff11f31a69d090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b000000010000003400000043006f007200720065006f00200055007200750067007500610079006f0020002d00200052006f006f007400200043004100000020000000010000001e0600003082061a30820402a003020102021000ca227908232af0f582b885d363ddf1300d06092a864886f70d0101050500307f310b3009060355040613025559312b3029060355040a0c2241444d494e495354524143494f4e204e4143494f4e414c20444520434f5252454f53311f301d060355040b0c16534552564943494f5320454c454354524f4e49434f533122302006035504030c19436f7272656f20557275677561796f202d20526f6f74204341301e170d3038303731343136353231355a170d3330313233313032353935395a307f310b3009060355040613025559312b3029060355040a0c2241444d494e495354524143494f4e204e4143494f4e414c20444520434f5252454f53311f301d060355040b0c16534552564943494f5320454c454354524f4e49434f533122302006035504030c19436f7272656f20557275677561796f202d20526f6f7420434130820222300d06092a864886f70d01010105000382020f003082020a0282020100b13dd2a725709783780ed732c9660e7823e42a1becc3ef538583bbcacf7eea53996d2755c8d13821406e494dc33df6092b061943a998c9014ef4aa80300755f3f5b77d99b77385d51c65566c0d329b080e34612a40098437c366ed0d4c9c0c78403aecedabcca484f275319540a8aabb93b577986cf2c8e0215a23e442a793c8a81d38cea41a4040bf3c93909b5fd694c1225b46d7c50015d58fc6f7de0baf6e8b058f5b80950ea3bd93cc90f27de3487eb2cd073d1bed149074f3dd341f7ce40359f12dcde0a3a03b212e5caeac080650153135ee5ff91f0d34a5806e62724fe321ba38405d5fdb682a5c34c6083bf67c2ea88dc4b7a6add99bbf19410e483909666e0d3401c5bb071123a4dafe60962847dc8f679b13af7d790e78cdc08c2fbb212cfc74161edec0329dfa783a86ba3ec9780a00d1e4e0c912e25bdcebbb809a3235abf030c30e48842f8d080af62c8c4d3280455508dbcd0da8bf087ab8e7685d9a948995bcfc9a8eb87f3ad86cd5f418ac69e2a4c10bb31fa3829ff38a3c85403809fac2053ee19c89fac3056c088f5d51f47fbbc4f36c01bd3d4fc4198b39d9cacce979880455ab6db8da16456539150518fb0b2c7301ed9452e57d0c013b09a04df13d08816634361744f067f35bf205b6219858d9f4a137d96fe6ef56c4fbbf566202ac3030b602d6d216fc4eea87439a685d88a39146282bbf3915150203010001a3819130818e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147dbb69eb8861e140cf4723640086a2666bdc8495304c0603551d200445304330410604551d20003039303706082b06010505070201162b687474703a2f2f7777772e636f7272656f2e636f6d2e75792f636f7272656f636572742f6370732e706466300d06092a864886f70d0101050500038202010056df1389be62b70e812173a4d437caedb72f9574d789f84b4781ee67edb829df21a0fc546767c8572c5ba10a75782121caa0a8df6b9cd936028db801c16f8e7b6cc9a4b2c546a9ca4c0281faa37b9d3d48e6ca4066d2449d76e055b9a69ca7d143d8f5a0b49df8f7e5a6a642f302325946722b14ec5e65d5518178ceaa2f8d9689796afb0fc85bcfb4ae90b65fe37c626cb7a6ff9081b59891731230afc7e88102687329bb58753db7d643d5ae4df242b9f0dfda310013dae1b3b6068b5bfdc998b8a213d1ba8fc18a1a9e0fff82be0482e52b933e1eb5a20c1bc61ab073897683bc8e3bbb176d14c38bbe7d1526b5a99c177a507a2debe99994ae9810bdee2a5d5dd68e345bac1e87606b98c7878fd39cb268054907f9a931669cfebfa759e82cf036d4f2a81982c09ea739f9b19834a31ffacdc9192d78deb7fd62f093a3fe005bd60ae4f37e7c9728e105ec05344513ff2913618a274fdbb8d2922127b5887767a87ecf243c87080433738f0bb686f8cfefb2a6241e0b91910050163212d80925da634edddb2dd7e7046be3631fa9fea90163c4ca4c146883bc05ac5916fb6ea1076fbb4bbe6d984876257b4a11965408aca9f337ab83c3d1cd8198c0e54035b89f91e76fe64b20168a537bac3ad1983554d0d4bfae7e9a4b1ee975a325b03be765bf4f95f41dbdc4bac94d8151c23f5ad912f4211bd695ea3d90fea993e2	updroots.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\838E30F77FDD14AA385ED145009C0E2236494FAA\Blob = 0b000000010000003400000054004300200054007200750073007400430065006e00740065007200200043006c00610073007300200032002000430041000000090000000100000016000000301406082b0601050507030406082b06010505070301030000000100000014000000838e30f77fdd14aa385ed145009c0e2236494faa2000000001000000600300003082035c308202c5a003020102020203ea300d06092a864886f70d01010405003081bc310b30090603550406130244453110300e0603550408130748616d627572673110300e0603550407130748616d62757267313a3038060355040a1331544320547275737443656e74657220666f7220536563757269747920696e2044617461204e6574776f726b7320476d624831223020060355040b1319544320547275737443656e74657220436c61737320322043413129302706092a864886f70d010901161a636572746966696361746540747275737463656e7465722e6465301e170d3938303330393131353935395a170d3131303130313131353935395a3081bc310b30090603550406130244453110300e0603550408130748616d627572673110300e0603550407130748616d62757267313a3038060355040a1331544320547275737443656e74657220666f7220536563757269747920696e2044617461204e6574776f726b7320476d624831223020060355040b1319544320547275737443656e74657220436c61737320322043413129302706092a864886f70d010901161a636572746966696361746540747275737463656e7465722e646530819f300d06092a864886f70d010101050003818d0030818902818100da38e8ed3200297183010dbf8c01dcdac6ad39a4a98a2fd58b5c685f50c662f566bdca9122ecaa1d51d73db351b2834e5dcb49b0f04c55e56b2dc7850b301c924e82d4ca02edf76fbedce0e314b80553f29af4568b5a9e8593d1b48256ae4dbba84b5716bcfef8589ef8298db07bcd78c94fac8b670cf19cfbfc579b575c4f0d0203010001a36b3069300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186303306096086480186f842010804261624687474703a2f2f7777772e747275737463656e7465722e64652f67756964656c696e6573301106096086480186f8420101040403020007300d06092a864886f70d0101040500038181008452fb28dfff1f7501bc01be0456976a7442243183f946b1068a89cf962c33bf8cb55f7a72a18506ce86f8058ee8f925cada838c06aceb366d8591340436f442f0f8792e0a485cabcc514f7876a0d9ac19bd2ad169042891ca36102780575bd25cf5c25bab6481637451f497bfcd1228f74d667fa7f01c012678b26647705164	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F17F6FB631DC99E3A3C87FFE1CF1811088D96033\Blob = 0b00000001000000640000005400dc0052004b0054005200550053005400200045006c0065006b00740072006f006e0069006b00200053006500720074006900660069006b0061002000480069007a006d00650074002000530061001f016c0061007900310163003101730031010000090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b06010505070307030000000100000014000000f17f6fb631dc99e3a3c87ffe1cf1811088d960332000000001000000410400003082043d30820325a003020102020101300d06092a864886f70d01010505003081bf313f303d06035504030c3654c39c524b545255535420456c656b74726f6e696b20536572746966696b612048697a6d6574205361c49f6c6179c4b163c4b173c4b1310b3009060355040613025452310f300d06035504070c06416e6b617261315e305c060355040a0c5554c39c524b54525553542042696c676920c4b06c657469c59f696d2076652042696c69c59f696d2047c3bc76656e6c69c49f692048697a6d65746c65726920412ec59e2e20286329204172616cc4b16b2032303037301e170d3037313232353138333731395a170d3137313232323138333731395a3081bf313f303d06035504030c3654c39c524b545255535420456c656b74726f6e696b20536572746966696b612048697a6d6574205361c49f6c6179c4b163c4b173c4b1310b3009060355040613025452310f300d06035504070c06416e6b617261315e305c060355040a0c5554c39c524b54525553542042696c676920c4b06c657469c59f696d2076652042696c69c59f696d2047c3bc76656e6c69c49f692048697a6d65746c65726920412ec59e2e20286329204172616cc4b16b203230303730820122300d06092a864886f70d01010105000382010f003082010a0282010100abb73e0a8cc8a55815e68aef273d4ab4e825d3cd33c220dc19ee883f4d62f0dd13778f61a92ab5d4f2b93158293b2f3f6a9c6f737625ee342080eeeab7f0c40acd2b8694c9e360b14452b25a29b4919783d8b7a6142f2949a2f30506fbb44fdaa16c9a669ff04309caea728feb00d73539d75617471730f4bebf3fc268af3640c1a9f4a9a7e8106b088af7861edc9a2a1506f6a3f0f4e0c714d4517fcfb4db6daf4796179b7771d8a7719d240cf6943f8531124fbaee4e82b8b93e8f23375ecca2aa75f7186f09d3aea7542834fbe1e03b607da0be798986c89f2df90a4bc450a2e7fd7916c77a0b18cfce4cef7dd6076f98f1afb1c17ad78135b8aa17b4e0cb0203010001a3423040301d0603551d0e0416041429c590ab25af11e461bfa3ff886191e60efe9c81300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100100ddaf83aec28d1149582b1122c517a4125364c9fec3f1f849d65545ca8160240fa6e1a3784ef729d860a559d5628ac662cd03a5693340725ad08b08fc80f0959ca9d981ce554f8b9457f6a976f88684d4a06263788020eb6c6d67299ce6b77da6231a4561fae5f8d77da5df688fc1ad99eb581f032b8e388d09cf36aa0b99b145935364fcff38e5e5d17ad1595d8ddb2d5156e004eb34bcf6694e4e0cdb505da63578be5b3aadbc02e1c9044db1a5d18a4eebe045b99d5715f55656462d5a29b045986c86277e77c82456a3d17bfec9d750caea36f5ad32f9836f4f0f519ab115dc8a6e32a586a4209c3bd922666320d5d085574ff8c98d00aa6846ad1397d	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3C71D70E35A5DAA8B2E3812DC3677417F5990DF3	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\59AF82799186C7B47507CBCF035746EB04DDB716	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\339B6B1450249B557A01877284D9E02FC3D2D8E9\Blob = 030000000100000014000000339b6b1450249b557a01877284d9e02fc3d2d8e9090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b00000001000000300000004300680061006d006200650072007300690067006e00200047006c006f00620061006c00200052006f006f00740000002000000001000000c9040000308204c5308203ada003020102020100300d06092a864886f70d0101050500307d310b300906035504061302455531273025060355040a131e41432043616d65726669726d61205341204349462041383237343332383731233021060355040b131a687474703a2f2f7777772e6368616d6265727369676e2e6f72673120301e06035504031317476c6f62616c204368616d6265727369676e20526f6f74301e170d3033303933303136313431385a170d3337303933303136313431385a307d310b300906035504061302455531273025060355040a131e41432043616d65726669726d61205341204349462041383237343332383731233021060355040b131a687474703a2f2f7777772e6368616d6265727369676e2e6f72673120301e06035504031317476c6f62616c204368616d6265727369676e20526f6f7430820120300d06092a864886f70d01010105000382010d00308201080282010100a270a2d09f42ae5b17c7d87dcf1483fc4fc9a1b713af8ad79e3e040a928b6056fab4322f884da16008f4b7094ea0492f49d6d3df9d975a9f940470ec3f59d9b7cc668b9852280902dfc52f848d7a9777bfec409d2572abb53f3298fbb7b7fc7284e53587f955faa31f0e6f2e28dd69a0d94210c6f8b544c2d0437fdbbce4a23c6a55780a77a9d8ea1932b72ffe5c3f1beeb198eccaad7a6945e3960f55f6e6ed75ea65e83256934689a8258a6506ee6bbf7907d0f1b7afed2c4d92bbc0a85fa7677d04f2150870ac92d67d04d233fb4cb60b0bfb1ac9c48d03a97e5cf250ab12a5a1cf4850a5efd2c81a13fab07fb1821c776a0f5fdc0b958fef437ee6450925020103a38201503082014c30120603551d130101ff040830060101ff02010c303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e6368616d6265727369676e2e6f72672f6368616d6265727369676e726f6f742e63726c301d0603551d0e04160414439c369fb09e304dc6ce5fad10abe503a5faa914300e0603551d0f0101ff040403020106301106096086480186f8420101040403020007302a0603551d1104233021811f6368616d6265727369676e726f6f74406368616d6265727369676e2e6f7267302a0603551d1204233021811f6368616d6265727369676e726f6f74406368616d6265727369676e2e6f7267305b0603551d20045430523050060b2b0601040181872e0a01013041303f06082b060105050702011633687474703a2f2f6370732e6368616d6265727369676e2e6f72672f6370732f6368616d6265727369676e726f6f742e68746d6c300d06092a864886f70d010105050003820101003c3b7091f904542791e1ededfe687f615de541654f32f11805946a1cde1f70db3e7b320234b50c6ca18a7ca5f48fffd4d8ad17d52d04d13f5880e2815988bec0e3469324fe90bd26a2302de89726573589749618f615e2af2419560202b2ba0f14eac68a66c18645558bbe92be9ca404c7493c9ee8297a89d7feafff68f5a51790bdac99cca58657096746dbd616c246f1e4a950f58fd19215d35f3ec600493a6e58b2d1d1270d25c832f82011cd7d32334894544cdddc79c4309feb8eb855b5d7885cc56a243db2d3050351c607efcc1472743d6e72ce18288c4aa077e5092b454447acb7677f018a055a93bea1c1fff8e70e67a44749765d75901af5268ff0	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\273EE12457FDC4F90C55E82B56167F62F532E547	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CFDEFE102FDA05BBE4C78D2E4423589005B2571D	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\56E0FAC03B8F18235518E5D311CAE8C24331AB66\Blob = 03000000010000001400000056e0fac03b8f18235518e5d311cae8c24331ab66090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080b000000010000003c000000530077006900730073005300690067006e00200050006c006100740069006e0075006d00200047003200200052006f006f00740020004300410000002000000001000000c5050000308205c1308203a9a00302010202084eb200670c035d4f300d06092a864886f70d01010505003049310b300906035504061302434831153013060355040a130c53776973735369676e204147312330210603550403131a53776973735369676e20506c6174696e756d204341202d204732301e170d3036313032353038333630305a170d3336313032353038333630305a3049310b300906035504061302434831153013060355040a130c53776973735369676e204147312330210603550403131a53776973735369676e20506c6174696e756d204341202d20473230820222300d06092a864886f70d01010105000382020f003082020a0282020100cadfa202e2daf8fc0716b1de60aade965c641fc72f7ecf67fa4442d6766395aeebaf72208a454786627886d6203926f4aea3fd23e7a59cb5222119b7379322c0509c827bd4d504445ccbb4c29f92be24d87b6722e2695fe50578d487d97170332553b4873b299028369a55443068a483977f0d1e9c76ff159d6097008d8a8503ec80beea2c6e105192cc7ed5a333d8d649de582aaff616eb4b7b903297b9ba9d58f1f85749041ea25d0670dd71dbf9dd8b9a1b8ccf3da34dcecb7cf6bb9ca0fa09ce2362b2e90d1fe272288f9fac68207d6f3ba88531097f0bc7e865e9e3780e0967308b3482fb5de0cc9d816d62ee081e042c4e9becfea94f5ffd6978ef091fa1b4bffaf3ef901e4c058b1eea7a917ac3d7e5fb30bc6c1b105898f71a5fd029320313464d616a854c52742f061f7b11e28497c699f36d7fd767837e1368d871285ad8cedde810149afe6d23876e8e5a703cd58d0900a7aabcb031376dc884141e5bbd4563206b4b748cbddb3a0ec1cf5a168fa598f27689b213123b0b7777acbbe53c294a9272ca611a2b5e4ce2837477fa35487a854d8d9a53c4df78ca9791482b452b01f71c1aa2ed18ba0abd83fa6fbc8d57933bd4d4a6ce1ef1a0b1ceabfd2b289a4f1bd7c372dba4c4bf5d4cf5dd7b9669ee6880e6e798ba36b7fe6eed2bbd20f86519da55097e25dcfe616272f97e1802ef63b4d0fbafe53b638c678f0203010001a381ac3081a9300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041450afcc078715476f38c5b465d1de95aae9df9ccc301f0603551d2304183016801450afcc078715476f38c5b465d1de95aae9df9ccc30460603551d20043f303d303b0609608574015901010101302e302c06082b060105050702011620687474703a2f2f7265706f7369746f72792e73776973737369676e2e636f6d2f300d06092a864886f70d010105050003820201000885a6f5160cfc441ac163e0f9554608fc701c4228968eb7c5c141754e097179e56d96ca4ba58860d03074b8ca08dcb4309e4007166b65957701aea4b7350b81da7115a97417387b58caf92ffbc065768d5b01b97dde823d64b8be1474a30a54d32c95181735f5516b3f8fa2966139786b4be5a6a0f853df51109362e7802fe2d1e0bc8e36467733ecb8fb8e9a2c894d31110f269e04bbb7048d0bf2b9fc5a9d3b16b72fc898abfe8a50592ea33bfc295d8bc14bc9e28a131db1bfbb421d52dd4ed8145e10c63107ef7127f71b3909dc82ea8bb395865efdf5da5d31a6e031b694e6444974c516e5f71f036128c5c8cb12a0424bf96b88088db43218f3759fc47f004f05959ca31702c3b3539baa2039292b66fa9daf5eb392d2b5a6e11af92d41698114b4b4b5ed893dcefba99d354244b11c147381cf2a01359a31d52d8f6d84df804d57e33fc58475da89c630bbeb8fcb2208a0aeaaf1036c3a4b4d09a50e72c6566b21424e23251468ae760a7c0c077064f99a2ff6053926c60c8f197f435e6ef45b152fdb615de6672f3f0894f960b49831da74f18493714d5ffb6058d1fbc4c16d89a2bb201f9d7191cb329b133d3e7d925235ac9294a2d318c27cc7eaaf760516dd6727c27e1c072221f3400a1b34074413c2846a8edf195abf7feb1de21a38d15caf47926b80b530a5c98dd8ab31811fdfc26637d393a985867965d2	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3BC0380B33C3F6A60C86152293D9DFF54B81C004	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\67248980DE775D2C9B04E40307940BADB351F395	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D8A6332CE0036FB185F6634F7D6A066526322827\Blob = 030000000100000014000000d8a6332ce0036fb185f6634f7d6a066526322827090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b0000000100000018000000410066006600690072006d0054007200750073007400000053000000010000002400000030223020060a2b06010401828f09020330123010060a2b0601040182373c0101030200c020000000010000004a050000308205463082032ea00302010202086d8c1446b1a60aee300d06092a864886f70d01010c05003041310b300906035504061302555331143012060355040a0c0b41666669726d5472757374311c301a06035504030c1341666669726d5472757374205072656d69756d301e170d3130303132393134313033365a170d3430313233313134313033365a3041310b300906035504061302555331143012060355040a0c0b41666669726d5472757374311c301a06035504030c1341666669726d5472757374205072656d69756d30820222300d06092a864886f70d01010105000382020f003082020a0282020100c412dfa95ffe41ddddf59f8ae3f6ace13c789abcd8f07f7aa0332adc8d205bae2d6fe793d936706a68cf8e51a3855b6704a010246f5d2882c19757d8482913b6e1be914ddf850c53189a1e24a24f8ff0a2850bcbf4297fd2a458ee264dc9aaa87b9ad9fa38de445715e5f88cc8d948e20d16271d1ec8838525b7baaa5541cc03224b2d918d8be689af66c7e9ff2be93cacdad2b3c3e1689c89f87a0056def455956cfbba64dd628bdf0b7732eb62cc269a9bbbaa62834cb4067a30c829bfed064d97b91cc4312bd55fbc5312179c9957296677612131072e25499d18f2eef32b718cb5ba39074977fcef2e9290058d2d2f777bef43bf35bb9ad8f973a72cf2d057ee284e265f8f9068092fb8f8dc06e92e9a3e51a7d122c40aa738486cb3f9ff7dab8657e3bad6857877ba43ea487ff6d8be236d1ebfd1366c585cf1eea419541af503d276e6e18cbd3cb3d3484be2c8f87f92a876469c42653ea41ec107035a462db897f3b7d5b25521efbadc4c0097fb14952733bfe8434746d2089916603b9a7ed2e6ed38eaec011e3c48564909c74c37009e880ec073e16f66e97247303e10e50b03c99a42006cc5947e61c48adf7f821a0b59c4593277b3bc60695639fdb4067b2cd66436d9bd48ed841f7ea5228f2ab842f482b7d45390784e2d1afd816f44d73b01749642e000e22e6beac5ee72acbbbffeeaaaa8f8dcf6b2798ab6670203010001a3423040301d0603551d0e041604149dc067a60c22d926f545aba665521127d845ac63300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106300d06092a864886f70d01010c05000382020100b3574d10624e3ae4aceab81caf3223c8b3495a519c76288d79aa574617d5f552f6b744e80844bf1884d20b80cdc512fd005505618741dcb5249e3cc4d8c8fb709e2f7896832036de7c0f691388a575369808a6c6dfaccee358d6b73edebaf3eb3440d8a281f5783f2fd5a5fcd9a2d45e040e17adfe41f0e5b272fa44823342e82d58f7568c623fba42b09c0c5c7e2e65265c534f00b2787ea10d992d8db81d8ea2c4b0fd60d030a48ec80462a9c4ed35de7a97ed0e385e922f9370a5a99c6fa77d131d7ec60848b15e67eb510825e9e6256b5229919cd239730857de9906b45b9d1006e1c200a8b81c4a020a14d0c141cafb8c35217d8238f2a95491193593946d6a3ac5b2d0bb898693e89bc90f3aa77ab8a1f07846fafc372fe58a84f3dffe04d9a168a02f24e2099506d595cae12496eb7cf69305bbed73e92dd17539d7e724dbd84e5f438f9ed01439bf557048995731b49cee4a980396301f6006ee1b23fe8160231a476285a5cc1934806fb3ac1ae39ff07b48add501d967b6a97293ea2d66b5b2b8e43d3cb2ef4c8ceaeb07bfab359a5586bc18a6b5a85eb4836c6b6940d39fdcf1c3696bb9e16d09f4f1aa50760a7a7d7a17a1559642993109dd60118d05307ee68e46d19d14dac717e405968cc424b51bcf1407b240f8a39e4186bc04d06b96c82a8034fdbfef06a3dd58c5853d3e8ffe9e29e0b6b80968191c1843	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B72FFF92D2CE43DE0A8D4C548C503726A81E2B93\Blob = 0b000000010000001c000000440053005400200052006f006f007400430041002000580031000000090000000100000016000000301406082b0601050507030406082b06010505070301030000000100000014000000b72fff92d2ce43de0a8d4c548c503726a81e2b932000000001000000dc030000308203d8308202c0021100d01e408b0000027c0000000200000001300d06092a864886f70d01010505003081a9310b3009060355040613027573310d300b0603550408130455746168311730150603550407130e53616c74204c616b65204369747931243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e3111300f060355040b13084453544341205831311630140603550403130d44535420526f6f7443412058313121301f06092a864886f70d010901161263614064696773696774727573742e636f6d301e170d3938313230313138313835355a170d3038313132383138313835355a3081a9310b3009060355040613027573310d300b0603550408130455746168311730150603550407130e53616c74204c616b65204369747931243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e3111300f060355040b13084453544341205831311630140603550403130d44535420526f6f7443412058313121301f06092a864886f70d010901161263614064696773696774727573742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d2c626b6e7a53dc1c468d5506f53c56f491309b8af2c488d146aa3175f5af9d32e752fd82862d1932ffc4dd4ab87e508c799e7923f75bdeb25b415c19b193dd2448dd774206d37028f69935b8ac4199df4b20efc166cb9b1059283d1852c60943e4555a0d9ab0821e660e83b74f299505168d0032db180bea3d852b044cd434a708e588595e14e2cd62d416fd684e7c89844ca47db2c24a56926cf6bb82762c3f4c97a9223ed136782ae452e45e57e723f859d946210e63c91a1ad7700e015ecf38480727a8e6e6097c724591034835be1a5a469b657351c7859c6d32f3a7367ee94ca04130562067023b3f47cee45d9640b5b49aaa443ce26c444126cb8dd790203010001300d06092a864886f70d01010505000382010100a237b23f69fbd7867954493195332bf3d1091449626086a5b011e250c21d06573e2de83364be9baaad5f1b4dd49995a28b9ac96272b569ead958ab35ed15a243d6b6bc07796564737dd779ca7bd55a51c6e15304968d38cfa317ac39716b01c38b533c63e9ee79c0e4be9232647ab31f979462bdeab2201595fb97f2782f63364038e3460f1dddac95cae74b907bb14ba9d4c5eb9adaaad5a39414468d2d1ff33ad6933af63e79fce8e6b075edee3dc970c75daa814b46251cc76c15e3954e0faa3237940a172492138458d2636f2bf7e65b620b1317b00d524cfefe6f5ce2916e1dfda462d768fa8e7a4fd208da93dcf092117ad0dc72930c7393628568d0f4	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DA40188B9189A3EDEEAEDA97FE2F9DF5B7D18A41	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\ACED5F6553FD25CE015F1F7A483B6A749F6178C6\Blob = 030000000100000014000000aced5f6553fd25ce015f1f7a483b6a749f6178c609000000010000004a000000304806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030706082b06010505070306060a2b0601040182370a030406082b060105050703080b000000010000005c0000004e00650074004c006f0063006b0020004b006f007a006a006500670079007a006f0069002000280043006c006100730073002000410029002000540061006e007500730069007400760061006e0079006b006900610064006f0000002000000001000000810600003082067d30820565a00302010202020103300d06092a864886f70d01010405003081af310b30090603550406130248553110300e0603550408130748756e676172793111300f06035504071308427564617065737431273025060355040a131e4e65744c6f636b2048616c6f7a617462697a746f6e73616769204b66742e311a3018060355040b131154616e7573697476616e796b6961646f6b313630340603550403132d4e65744c6f636b204b6f7a6a6567797a6f692028436c6173732041292054616e7573697476616e796b6961646f301e170d3939303232343233313434375a170d3139303231393233313434375a3081af310b30090603550406130248553110300e0603550408130748756e676172793111300f06035504071308427564617065737431273025060355040a131e4e65744c6f636b2048616c6f7a617462697a746f6e73616769204b66742e311a3018060355040b131154616e7573697476616e796b6961646f6b313630340603550403132d4e65744c6f636b204b6f7a6a6567797a6f692028436c6173732041292054616e7573697476616e796b6961646f30820122300d06092a864886f70d01010105000382010f003082010a0282010100bc748c0fbb4cf4371ea90582d8e6e16c70ea78b56ed138440da883ce5dd2d6d581c5d44be75b947026db3b9d6a4c62f771f364d6613b3deb73a337d9cfea8c923bcdf707dc667497f44522ddf45ce0bf6df3be6533e4153abfdb98905538c4eda655630bb07804f4e36ec13f8efc51781f929e83c2fed9b0a9c9bc5a00ffa9a89874fbf62c3e15390db60455a80e982042b3b125ad7e9a6f5d53b1ab0cfcebe0f37ab3a8b3ff46f663a2d83a987bb6ac85ffb0254f7463e71307a50a8f05f7c0646f7ea7278096ded42e8660c76b2b5e737b17e7913f640cd84b22342b9b32f2481f9fa10a847ae2c2ad973d8ed5c1f956a350e9c6b4fa98a2ee95e62a038cdf0203010001a382029f3082029b300e0603551d0f0101ff04040302000630120603551d130101ff040830060101ff020104301106096086480186f84201010404030200073082026006096086480186f842010d048202511682024d46494759454c454d2120457a656e2074616e7573697476616e792061204e65744c6f636b204b66742e20416c74616c616e6f7320537a6f6c67616c7461746173692046656c746574656c656962656e206c6569727420656c6a617261736f6b20616c61706a616e206b65737a756c742e204120686974656c65736974657320666f6c79616d617461742061204e65744c6f636b204b66742e207465726d656b66656c656c6f737365672d62697a746f73697461736120766564692e2041206469676974616c697320616c616972617320656c666f6761646173616e616b2066656c746574656c6520617a20656c6f69727420656c6c656e6f727a65736920656c6a61726173206d6567746574656c652e20417a20656c6a61726173206c656972617361206d656774616c616c6861746f2061204e65744c6f636b204b66742e20496e7465726e657420686f6e6c61706a616e20612068747470733a2f2f7777772e6e65746c6f636b2e6e65742f646f63732063696d656e2076616779206b65726865746f20617a20656c6c656e6f727a6573406e65746c6f636b2e6e657420652d6d61696c2063696d656e2e20494d504f5254414e5421205468652069737375616e636520616e642074686520757365206f662074686973206365727469666963617465206973207375626a65637420746f20746865204e65744c6f636b2043505320617661696c61626c652061742068747470733a2f2f7777772e6e65746c6f636b2e6e65742f646f6373206f7220627920652d6d61696c20617420637073406e65746c6f636b2e6e65742e300d06092a864886f70d01010405000382010100482446f7ba566ffac82803404ee531396b266b537fdbdfdff3713d26c0140ec6677b23a80c73dd01bbc6ca6e373955d5c78c56200e280a0ed22aa4b04952c63807febe0a098cd198cfcada1431a14fd239fc0f112c43c3ddab93c7553e477c181a00dcf37bd8f27f526c20f40b5f6952f4eef8b22960ebe34931210dd6b51041e241096ce21a9a564b7702f6a09b9a2787e8552971c2909f45781ae115643dd00ed8a0769faec5d02eead60f56ec647f5a9b145801277e1350c76b2ae6683cbf5ca00a1be10e7ae9e280c3e9e9f6fd6c119ed0e528272b543242148275e64af02b6675638ca2fb043e830e9b36f018e42620c38cf02807ad3c176688b5fdb688	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8025EFF46E70C8D472246584FE403B8A8D6ADBF5	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CFE4313DBA05B8A7C30063995A9EB7C247AD8FD5\Blob = 0b00000001000000200000006900700073004300410020004d00610069006e00200052006f006f0074000000090000000100000040000000303e06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a0304030000000100000014000000cfe4313dba05b8a7c30063995a9eb7c247ad8fd52000000001000000f2050000308205ee308204d6a003020102020100300d06092a864886f70d01010505003081ae310b3009060355040613024553310f300d060355040813064d6164726964310f300d060355040713064d6164726964312f302d060355040a13264950532043657274696669636174696f6e20417574686f7269747920732e6c2e206970734341310e300c060355040b13056970734341311b3019060355040313126970734341204d61696e20434120526f6f74311f301d06092a864886f70d01090116106d61696e30314069707363612e636f6d301e170d3039303930373134353433365a170d3239313232353134353433365a3081ae310b3009060355040613024553310f300d060355040813064d6164726964310f300d060355040713064d6164726964312f302d060355040a13264950532043657274696669636174696f6e20417574686f7269747920732e6c2e206970734341310e300c060355040b13056970734341311b3019060355040313126970734341204d61696e20434120526f6f74311f301d06092a864886f70d01090116106d61696e30314069707363612e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100953025b27d224cda3f16c267df65cceb459247659eac76cf6c6ac9ce03cda3c33872e36da56ba55287e662a5fb017def6744cbb641ef0b607d4afd22eda1e3f49db24260ce360d295979ee62077ab9134dc4633597b6a6f5068ced19653f8c26347feee829968bab7c768014c427519c63bf2a9486188f909e85fd1ad97470d07fec1da42c7a51c58114ab55b36295830f83486886b7ef3f068b8ea568c2a359a699504b0dbc5c7215e0b2458b1e59c92a4f5bd6a2bfc17fbda8a6a27d7c2904e11bba42c16cced9bbba54303d2787c19cb80fb2db5f44809a6a434d16d3dcc470a88e98681ce232c3b147208b0b6a8a9fff55c18fbd76792e789b3008702e6f0203010001a38202133082020f301d0603551d0e0416041461ed398d6b3ce136c6cfdb41fc1b435157cb4d6b3081db0603551d230481d33081d0801461ed398d6b3ce136c6cfdb41fc1b435157cb4d6ba181b4a481b13081ae310b3009060355040613024553310f300d060355040813064d6164726964310f300d060355040713064d6164726964312f302d060355040a13264950532043657274696669636174696f6e20417574686f7269747920732e6c2e206970734341310e300c060355040b13056970734341311b3019060355040313126970734341204d61696e20434120526f6f74311f301d06092a864886f70d01090116106d61696e30314069707363612e636f6d820100300c0603551d13040530030101ff300b0603551d0f04040302010630470603551d250440303e06082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070308060a2b0601040182370a0304301b0603551d110414301281106d61696e30314069707363612e636f6d301b0603551d120414301281106d61696e30314069707363612e636f6d303a0603551d1f04333031302fa02da02b8629687474703a2f2f63726c6d61696e30312e69707363612e636f6d2f63726c2f6d61696e30312e63726c303606082b06010505070101042a3028302606082b06010505073001861a687474703a2f2f63726c6d61696e30312e69707363612e636f6d300d06092a864886f70d01010505000382010100469c0f62b6da3d1c693ebe22c1e97e20efc9eefac6109e655d4fb844b3d42169564f727e62de9b49879de3c860ad6fb006371d40e17d3ad013d697e28776f71f4dd3832d0ab98859d221cfe6c0768fb5496bf93ccd5e2ba9e9a42913cf0afa9d932ddb38e1722a0d3b2f7097bdd9b304b1a26efa6f84cf60713b9ae385d87fb80d321ba0fa05641668243b9bf8cc2a00117fc02adc3de929947102a3186e2c0c3005ce98964d1af65163a146f42f8f511f3dae8752fdc03b93c88c72d171c899ea7da40c8c9f31877af7db95f0bf6f45cfac85dfd1465e6542934a1017741805025a4c9237e1e22d430aba9aaa444c87cdc494dc6f1b6ac7129264b700f8254d	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F99AA93FB2BD13726A1994ACE7FF005F2935D1E\Blob = 0300000001000000140000004f99aa93fb2bd13726a1994ace7ff005f2935d1e090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070b000000010000007e0000004300680069006e006100200049006e007400650072006e006500740020004e006500740077006f0072006b00200049006e0066006f0072006d006100740069006f006e002000430065006e007400650072002000450056002000430065007200740069006600690063006100740065007300200052006f006f007400000053000000010000002400000030223020060a2b0601040181e90c010a30123010060a2b0601040182373c0101030200c02000000001000000fb030000308203f7308202dfa0030201020204489f0001300d06092a864886f70d010105050030818a310b300906035504061302434e31323030060355040a0c294368696e6120496e7465726e6574204e6574776f726b20496e666f726d6174696f6e2043656e7465723147304506035504030c3e4368696e6120496e7465726e6574204e6574776f726b20496e666f726d6174696f6e2043656e7465722045562043657274696669636174657320526f6f74301e170d3130303833313037313132355a170d3330303833313037313132355a30818a310b300906035504061302434e31323030060355040a0c294368696e6120496e7465726e6574204e6574776f726b20496e666f726d6174696f6e2043656e7465723147304506035504030c3e4368696e6120496e7465726e6574204e6574776f726b20496e666f726d6174696f6e2043656e7465722045562043657274696669636174657320526f6f7430820122300d06092a864886f70d01010105000382010f003082010a02820101009b7e73eebd3b78aa644341f550df94f22eb28d4a8e4654d22112c839324206e983d59f52ede567033b54c18c9999cce9c00fff0dd98411b2b8d1cb5bdc1ef9683164e19bfa74eb68b92095f7c60f8d47ac5a06dd61abe2ecd89f172d9cca3c35975571cd4385b14716f52c538076cfd30064bd4099ddccd8dbc49fd6135f41838bf90d879256346c1a100b17d55a1c9758843c841a2e5c91346e195f7f1769c565ef6b21c6d5503abf61b9058def6f343ab26f1463bf163b9ba92afdb72b386606c52ce2aa671e45a78d046642f68f2bef8820698f328c1473da2b869163229af2a7dbce898bab5dc714c15b306a1fb1b79e2e810102edcf965e63dba8e638b70203010001a3633061301f0603551d230418301680147c724b39c7c0db62a54f9baa183492a2ca838259300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c724b39c7c0db62a54f9baa183492a2ca838259300d06092a864886f70d010105050003820101002ac3c743378fddada4b20ceedc146d8f28a49849cb0c80eaf3ed2366757dc5d3216779d173c5b503b758ac0c542fc656130f31da06e7653b1d6f36dbc81df9fd8006caa33d6616a89d4c167dc09546b551e4e21fd7ea064d638d968cefe73357423aeb8cc179c84d767ddef6b1b781e0a0f9a17846171a5698f04e3dab1cedec39dc0748f763fe06aec2a45c6a5b3288c5c73385ac664247c2582499e1e53ee5752c8e43d65d3c781ea895822950d1d116baefc1be7ad9b4d8cc1e4c46e177b131abbd2ac8ce8f6ea15d7f037534e4ad8945545ebeae28a5bb3f7879eb73b30a0dfdbec9f756acf6b7ed2f9b2129c738b695c404f2c32dfd142a9099b907cc9f	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0446C8BB9A6983C95C8A2E5464687C1115AAB74A	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AB48F333DB04ABB9C072DA5B0CC1D057F0369B46	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4054DA6F1C3F4074ACED0FECCDDB79D153FB901D\Blob = 0b000000010000001e000000440053005400200041004300450053002000430041002000580036000000090000000100000016000000301406082b0601050507030406082b060105050703010300000001000000140000004054da6f1c3f4074aced0feccddb79d153fb901d20000000010000000d04000030820409308202f1a00302010202100d5e990ad69db778ecd807563b8615d9300d06092a864886f70d0101050500305b310b30090603550406130255533120301e060355040a13174469676974616c205369676e61747572652054727573743111300f060355040b13084453542041434553311730150603550403130e4453542041434553204341205836301e170d3033313132303231313935385a170d3137313132303231313935385a305b310b30090603550406130255533120301e060355040a13174469676974616c205369676e61747572652054727573743111300f060355040b13084453542041434553311730150603550403130e445354204143455320434120583630820122300d06092a864886f70d01010105000382010f003082010a0282010100b93df52cc994dc758a955d63e884777666b959915c46dd923e9ff90e03b43d6192bd2326b563ee92d29ed63cc80d905f6481b1a8080d4cd8f9d3052852b40125c5951c0c7e3e108475cfc1199163cfe8a89188b94352bb80b155898b31fad0b776be413d309aa422251773e81ee2d3ac2abd5b3821d52a4bd7557de33a55bdd76d6b02576be6477c08c882badea7873da16db83056c2b302815f2df5e29a301828b866d3cb01966fea8a4555d6e09dff672b1702a64e1a6a110b7eb77be798d68c766fc13bdb50937ee5d08e1f37b8bdbac69f6ce97c33f2323c2647fa272402c97e1d5b8842136a357c7d35e92e66917293d53226c474f553a3b35d9af609cb0203010001a381c83081c5300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201c6301f0603551d11041830168114706b692d6f70734074727573746473742e636f6d30620603551d20045b30593057060a608648016503020101013049304706082b06010505070201163b687474703a2f2f7777772e74727573746473742e636f6d2f6365727469666963617465732f706f6c6963792f414345532d696e6465782e68746d6c301d0603551d0e041604140972064e18430fe5d6ccc36a8b317b788fa883b8300d06092a864886f70d01010505000382010100a3d88ed6b2dbce05e732cd01d30403e576e4562b9c9990e808306cdf7d3deee5bfb524408449e1d128aec4c23a533088f1f5776e51cafaff99af245f1ba0fdf2ac84cadfa9f05f042ead16bf219710813de3ff878d32dc94e5478a5e6a13c994953dd2eec83495d080d4ad320880543ce0bd5253d7527cb2693f7f7acf6a74cafa042a9c4c5a06a5e920ad45660f69f1ddbfe9e3328bfae0c1864d723c2ed893780a2af8d8d2273d19895f5a7b8a3bcc0cda51aec70bf72bb03705ecbc5723e238d29b68f35612884f427cb831c4b5dbe4c82134e9481135eefac79257c59f34e4c7f6f70e0b4c9c68787b7131c7eb1ee06741f3b7a0a7cde57a33366afa9a2b	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5F43E5B1BFF8788CAC1CC7CA4A9AC6222BCC34C6\Blob = 53000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b000000010000002e0000004300790062006500720074007200750073007400200047006c006f00620061006c00200052006f006f0074000000090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030806082b060105050703040300000001000000140000005f43e5b1bff8788cac1cc7ca4a9ac6222bcc34c62000000001000000a5030000308203a130820289a003020102020b0400000000010f85aa2d48300d06092a864886f70d0101050500303b31183016060355040a130f437962657274727573742c20496e63311f301d060355040313164379626572747275737420476c6f62616c20526f6f74301e170d3036313231353038303030305a170d3231313231353038303030305a303b31183016060355040a130f437962657274727573742c20496e63311f301d060355040313164379626572747275737420476c6f62616c20526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100f8c8bcbd14506613fff0d379ec23f2b71ac78e85f11273a619aa10db9ca265745a773e517d56f6dc23b6d4ed5f58b1374dd5490e6ef56a87d6d28cd227c6e2ff369f9865a0134ec62a649bd59012cf1406f43be3d428bee80ef8ab4e48946d8e9531105ceda22dbdd53a6db21cbb60c0464b01f549ae7e468ad0748da10c02ceeefce78fb86b66f37f4400bf6625142bdd10301d07963f4df66bb88fb77b0ca538ebde47dbd55d39fc88a7f3d72a74f1e85aa23b9f50baa68c4535c2506595dc6382efddbf774d9c62c9637316d0290f49a948f0b3aab76cc5a73039405daec4e25d2653f0ce1c230861a89419ba046240ec1f387077120671a730185d2527a50203010001a381a53081a2300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414b6087b0d7accac204c8656325ecfab6e852d7057303f0603551d1f043830363034a032a030862e687474703a2f2f777777322e7075626c69632d74727573742e636f6d2f63726c2f63742f6374726f6f742e63726c301f0603551d23041830168014b6087b0d7accac204c8656325ecfab6e852d7057300d06092a864886f70d0101050500038201010056ef0a23a0544e9597c9f889da45c1d4a30025f41f13abb7a3855869c230add8158a2de3c9cd815af873235aa77c05f3fd223b0ed106c4db364c73048ee5b022e4c5f32ea5d923e3b84e4a20a76e02249f2260677b8b1d7209c5315ce9799f80473dada10b07143d47ff03691a0c0b44e76325a77fb2c9b87684ed23f67d07ab457ed3dfb3bfe98ab6cda8a2672b52d5b765f0394c63a0917993520f54dd83bb9fd18fa75373c3cbff30ec7c04b8d8441f935f710922b76e3eea1c034e9d1a2061fb8137ec5efc0a45abd7e71755d0a0ea609ba6f6e38c5b29c20660149d2d974ca993159d61c4015f48d658bd5631124e11c821e0b3119165dbb4a68838ce55	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\61573A11DF0ED87ED5926522EAD056D744B32371\Blob = 5300000001000000220000003020301e0608608442011a01030330123010060a2b0601040182373c0101030200c00b000000010000002a0000004200750079007000610073007300200043006c0061007300730020003300200043004100200031000000090000000100000020000000301e06082b0601050507030106082b0601050507030206082b0601050507030403000000010000001400000061573a11df0ed87ed5926522ead056d744b32371200000000100000057030000308203533082023ba003020102020102300d06092a864886f70d0101050500304b310b3009060355040613024e4f311d301b060355040a0c14427579706173732041532d393833313633333237311d301b06035504030c144275797061737320436c61737320332043412031301e170d3035303530393134313330335a170d3135303530393134313330335a304b310b3009060355040613024e4f311d301b060355040a0c14427579706173732041532d393833313633333237311d301b06035504030c144275797061737320436c6173732033204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100a48ed774d92964de5f1f878091ea4e39e619c6440b80d50baf53078b12bde667f002b189f6608ac45bb042d1c021a8cbe19bef6451b6a7cf15f57480680490a058a2e674a653535548633f9256dd244e8ef8ba2bfff3348a9e28d7349fac2fd60ff1a42fbd52b249856d3935f04430934624f3b6e753fbbc61afa9a314fbc21717846ce07c88f8c91c572cf03d7e94bc259384e89a009a4505425780f44eced9ae39f6c853100c653a477b60c2d6fa91c9c6716cbd91873c918649abf30fa06c26765e1cac9b71e58dbc9b211e9cd6387e248015318296b149d362375b880c0a6234fea7487e99b1308b9037951ca81fa52c8df455c8dbdd590ac2ad78a0f48b0203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604143814e6c8f0a9a403f44e3e22a35bf2d6e0ad4074300e0603551d0f0101ff040403020106300d06092a864886f70d010105050003820101000167a38cc9253d13635d166feca13e095c91152a2ad980214f05dcbba589ab13332a9e38b78c6f027263c773771e0906ba3b287ba447c9616b080820fc8a058a1fbcbac6c2fecf6eec133371672e69faa92c3f66c012594d0b54029284bbdb12ef83707078c853fadfc6c6ffdc882f07c0499d325760d3f2f699295fe7aa01ccac33a81c0abb91c403a06fb634f986d3b3765498f44a81b3539d4d40ece5771345af5baa1fd82f4c827bfe2ac458bb4ffc9efd03651a2a0ec3a52016946b79a6a212b4bb1aa4237a5ff0ae8424e4f32bfb8a24a3279865da307576fc1991e8dbeb9b3f32bf40970726baccf394854a7a2793cf9042d4b85b16a6e7cb4003dd79	updroots.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\61573A11DF0ED87ED5926522EAD056D744B32371	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B865130BEDCA38D27F69929420770BED86EFBC10	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 0b00000001000000140000005500530045005200540072007500730074000000090000000100000022000000302006082b0601050507030306082b06010505070308060a2b0601040182370a0304030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4620000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D2EDF88B41B6FE01461D6E2834EC7C8F6C77721E\Blob = 0b0000000100000038000000430065007200740050006c0075007300200043006c006100730073002000330020005000720069006d006100720079002000430041000000090000000100000016000000301406082b0601050507030406082b06010505070301030000000100000014000000d2edf88b41b6fe01461d6e2834ec7c8f6c77721e2000000001000000950300003082039130820279a003020102021059dfac7e8a661511e58824ceefa9bca9300d06092a864886f70d0101050500303d310b30090603550406130246523111300f060355040a130843657274706c7573311b301906035504031312436c6173732033205072696d617279204341301e170d3939303730373137303830305a170d3139303730363233353935395a303d310b30090603550406130246523111300f060355040a130843657274706c7573311b301906035504031312436c6173732033205072696d61727920434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b794306ed04cd97e5e60e56fbb26ca526f6b6c8599a50bef001a6f1b4d58b51807fadd7bf8cb2c52ddfc9cb88d52e9b9b20b7cf58f5b99480958decd4895862589053427300b57b60c776329cb6caa3eb99951120d987076474cf949962208f96beaaa0036a315a71c1e9f8cca5a797b21da891f637e799250090428adcee36d04494a99b13f4509785820ef8dfe80c804ed292ca0588d840225973fa013d77b8b23e39fb8c7b84240381b924abd4a9455c756150d8177cc9fa237892b5b850d8b77f8c48bfb10cb94c7e91a5612976614c4bbd77d6d021bbf71622618e9498afaa3dee184ad80ca4ae2228c6a086183b222c7098838565dd131abf0099f13590203010001a3818c308189300f0603551d13040830060101ff02010a300b0603551d0f040403020106301d0603551d0e041604146a643676509c4ef4f74f15f50ded332560eccb20301106096086480186f842010104040302010630370603551d1f0430302e302ca02aa0288626687474703a2f2f7777772e63657274706c75732e636f6d2f43524c2f636c617373332e63726c300d06092a864886f70d010105050003820101009aa13e38aee152d2450dd1e98363ad8c80f493c3b8c23a229727b251863ed2f297de7cbbd7964053ca52aa8a6c63ccba718ae2f0f0108a17b04f8fc6ef0e31305a8dad04c7ab8c5f1a08cf9a179946be8e6b4a6a7f0147692518f84e3c4a042b06f210003dff3ea5e80ecf703886bbc58e0cd6e24b4b66f3735f80b53bf11229ea73bc689e1c60f7f3aa42d816c868de730b3f40c17777541d94572901935b98c36b04fa7c298dac47f0fe55154baf7123f5c3ce0167932680acf4828ac41b404adcc6390a6e63b6644d7ace90aa99bd36fd59fc2ffc45bede8e3359fa8a0b0f30364de35bb5d69650d7bffe85dcdab4822bcc1b083ff19a4eb5e18f08612416	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\43F9B110D5BAFD48225231B0D0082B372FEF9A54\Blob = 03000000010000001400000043f9b110d5bafd48225231b0d0082b372fef9a54090000000100000016000000301406082b0601050507030406082b060105050703010b0000000100000048000000460061006200720069006300610020004e006100630069006f006e0061006c0020006400650020004d006f006e00650064006100200079002000540069006d0062007200650000002000000001000000fd020000308202f930820262a003020102020436f11b19300d06092a864886f70d01010505003036310b3009060355040613024553310d300b060355040a1304464e4d5431183016060355040b130f464e4d5420436c6173652032204341301e170d3939303331383134353631395a170d3139303331383135323631395a3036310b3009060355040613024553310d300b060355040a1304464e4d5431183016060355040b130f464e4d5420436c617365203220434130819d300d06092a864886f70d010101050003818b0030818702818100983fad1936933d3efe764214fd356ff1faad227a58e346d05dc65af9622d8f315efeb430fe5074acd69d1de062c649dd14127d710bac06c13fd70687e09089d6e5e303b2f227b19f33c8aa6b364aa3c43f79419d89462f2b3e63d4385691aa1db10d42754df3874ee30f4dccb46cbf621387ead09b8eb6e2ff19f49409d59661020103a382011430820110301106096086480186f842010104040302000730580603551d1f0451304f304da04ba049a4473045310b3009060355040613024553310d300b060355040a1304464e4d5431183016060355040b130f464e4d5420436c6173652032204341310d300b0603550403130443524c31302b0603551d1004243022800f31393939303331383134353631395a810f32303139303331383134353631395a300b0603551d0f040403020106301f0603551d23041830168014409a7644977407c4ac14cb1e8d4f3a457c30d761301d0603551d0e04160414409a7644977407c4ac14cb1e8d4f3a457c30d761300c0603551d13040530030101ff301906092a864886f67d074100040c300a1b0456342e3003020490300d06092a864886f70d010105050003818100614ca07c59635b66f8ee6513ce438047b9b235c9c884c76b736045e49d379df58e25b9f9aaaacae3f8439c2fa08905b14532942a1e038d5da6decf5795dadf26605fcbdf951eb8ce08d8f88ac94fa9687593e32f054c646002a2421e6f866865550ed8436ff291313ea3473c2805af45b69d224c267b4b7d5b15f91946df085d	updroots.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B12E13634586A46F1AB2606837582DC4ACFD9497\Blob = 0b00000001000000120000004300650072007400690067006e006100000009000000010000005c000000305a06082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b0601050507030906082b0601050507030606082b0601050507030706082b06010505080202030000000100000014000000b12e13634586a46f1ab2606837582dc4acfd94972000000001000000ac030000308203a830820290a003020102020900fedce3010fc948ff300d06092a864886f70d01010505003034310b300906035504061302465231123010060355040a0c094468696d796f7469733111300f06035504030c084365727469676e61301e170d3037303632393135313330355a170d3237303632393135313330355a3034310b300906035504061302465231123010060355040a0c094468696d796f7469733111300f06035504030c084365727469676e6130820122300d06092a864886f70d01010105000382010f003082010a0282010100c868f1c9d6d6b3347526821eecb4beea5ce126ed114761e1a27c16784021e4609e5ac863e1c4b19692ff186d6923e12b62f7dde2362f9107b948cf0eec79b62ce7344b700825a33c871b19f281070f389019d311fe86b4f2d15e1e1e96cd806cce3b3193b6f2a0d0a995127da59acc6bc884568a33a9e722155316f0cc17ec575fe9a20a9809dee35f9c6fdc48e3850b155aa6ba9fac48e309b2f7f432de5e34be1c785d425bce0e228f4d90d77d3218b30b2c6abf8e3f141189200e7714b53d940887f7251ed5b26000ec6f2a28256e2a3e186317253f3e442016f626c825ae054ab4e7632cf38c16537e5cfb111a08c146629f22b8f1c28d69dcfa3a5806df0203010001a381bc3081b9300f0603551d130101ff040530030101ff301d0603551d0e041604141aedfe413990b42459be01f252d545f65a39dc1130640603551d23045d305b80141aedfe413990b42459be01f252d545f65a39dc11a138a4363034310b300906035504061302465231123010060355040a0c094468696d796f7469733111300f06035504030c084365727469676e61820900fedce3010fc948ff300e0603551d0f0101ff040403020106301106096086480186f8420101040403020007300d06092a864886f70d0101050500038201010085031e9271f642afe1a3619eebf3c00ff2a5d4da95e6d6be68363d7e6e1f4c8aefd10f216d5ea55263ce12f8ef2ada6feb37fe1302c7cb3b3e226bda612e7fd4723ddd30e11e4c40198c0fd79cd183307b9859dc7dc6b90c294ca133a2eb673a6584d396e2ed7645708fb52bdef923d6496e3c14b5c69f351e50d0c18f6a70440262cbae1d6841a7aa57e853aa07d206f6d514060b9103752c6c72b561959a0d8bb90de7f5df54cddee6d8d609089763e5c12eb0b74426c026c0af55309e3bd5362a1904f45c1effcf2cb7ffd0fd874011d51123bb48c021a9a4282dfd15f8b04e2bf4305b21fc119134be41ef7b9d9775ff9795c096582feabb46d7bbe4d92e	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C4674DDC6CE2967FF9C92E072EF8E8A7FBD6A131	updroots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A9628F4B98A91B4835BAD2C1463286BB66646A8C	updroots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob = 0300000001000000140000006252dc40f71143a22fde9ef7348e064251b1811809000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090b000000010000000e000000430065007200740075006d0000002000000001000000100300003082030c308201f4a0030201020203010020300d06092a864886f70d0101050500303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d204341301e170d3032303631313130343633395a170d3237303631313130343633395a303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ceb1c12ed34f7ccd25ce183e4fc48c6f806a73c85b51f89bd2dcbb005cb1a0fc7503ee81f088ee2352e9e615338dac2d09c576f92b398089e4974b90a5a878f873437ba461b0d858cce16c667e9cf3095e556384d5a8eff3b12e3068b3c43cd8ac6e8d995a904e34dc369a8f818850b76d964209f3d795830d414bb06a6bf8fc0f7e629f67c4ed265f10260f084ff0a45728ce8fb8ed45f66eee255daa6e39bee4932fd947a072ebfaa65bafca533fe20ec69656116ef7e966a926d87f9553ed0a8588ba4f29a5428c5eb6fc852000aa680ba11a85019cc446638288b622b1eefeaa46597ecf352cd5b6da5df748331454b6ebd96fcecd88d6ab1bda963b1d590203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100b88dceefe714bacfeeb044926cb4393ea2846eadb82177d2d4778287e6204181eee2f811b763d11737be1976241c041a4ceb3daa676f2dd4cdfe653170c51ba6020aba607b6d58c29a49fe63320b6be33ac0acab3bb0e8d309518c1083c634e0c52be01ab66014276c32778cbcb27298cfcdcc3fb9c8244214d657fce62643a91de58090ce0354283ef73fd3f84ded6a0a3a93139b3b142313639c3fd1872779e54c51e301ad855d1a3bb1d57310a4d3f2bc6e64f55a5690a8c70e4c740f2e713bf7c847f4696f15f2115e831e9c7c52aefd02da12a8596718dbbc70dd9bb169ed80ce8940486a0e35ca29661521942ce8602a9b854a40f36b8a24ec06162c73	updroots.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 400	824	2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe	85
PID 824 wrote to memory of 400	824	2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe	85
PID 824 wrote to memory of 400	824	2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe	85
PID 400 wrote to memory of 648	400	KB931125.exe	87
PID 400 wrote to memory of 648	400	KB931125.exe	87
PID 400 wrote to memory of 648	400	KB931125.exe	87
PID 400 wrote to memory of 4172	400	KB931125.exe	88
PID 400 wrote to memory of 4172	400	KB931125.exe	88
PID 400 wrote to memory of 4172	400	KB931125.exe	88
PID 400 wrote to memory of 5056	400	KB931125.exe	89
PID 400 wrote to memory of 5056	400	KB931125.exe	89
PID 400 wrote to memory of 5056	400	KB931125.exe	89
PID 400 wrote to memory of 2860	400	KB931125.exe	90
PID 400 wrote to memory of 2860	400	KB931125.exe	90
PID 400 wrote to memory of 2860	400	KB931125.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:824
- C:\Users\Admin\AppData\Local\Temp\{9A70E771-2C7F-44ae-8BCF-17A165961603}-TemporaryCache\KB931125.exe
  "C:\Users\Admin\AppData\Local\Temp\{9A70E771-2C7F-44ae-8BCF-17A165961603}-TemporaryCache\KB931125.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    PID:648
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    PID:4172
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    PID:5056
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL

Filesize
89KB

MD5
a64e4b204d44548eeb5c3d86eca2ad70

SHA1
e3245bf6dbb2e56d71a9cbad2697aa4fa0df6bbe

SHA256
985a5603ebf94539ac11549999f83b5e6dc008180994898c5daa6fd31ae1e9dc

SHA512
dca4099318954bab5f1204645be0d0e8fea0c2e97ee95496fa884fbed627e376358623fa94c39bf0abe97d07d46a7e6c5e1081496cdd1987e07e595995a46cd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\authroots.sst

Filesize
73KB

MD5
bb49ccc10926cdb601eba81afef749a2

SHA1
a4766c9aea8d211e9632148fd4b625cece195be9

SHA256
f013ee3b7fede9a95844e83e83ee298d38cba6efce5a5cafcd8b95255c32f86c

SHA512
94c2809727039d1ed07a3742a4b2f9300e865ea7c49bc1fcf547a30238eeecc88d8dd06a2d4f3112317f948908b9af082b50f412a41a2bcb48d5e30d6d8ecbba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\delroots.sst

Filesize
9KB

MD5
7b32871e409608ff887b6cf4d87debb0

SHA1
191f9ea1298ee52dbd6f977b3584109a064f57b9

SHA256
3f01268547364d2d60a0f65b46757cccfd9225fc39d581846a8fbffdb5756ff2

SHA512
534a384f7946db4083e639b8e02d83ac97293c60630b8811a84c85e0330e9c293f05f5cf71e0f3580551e7923bc5a3bfb7f0406432ca3cdb7efeb4a950ac5e8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\roots.sst

Filesize
7KB

MD5
9e5de0fd1f90486a66dee4bfe89a78d7

SHA1
90e3188ef63495aaa71c85d4ff0f23253c834b40

SHA256
8b95ff56d61586582864d05563762615c8705779578dca3c98a303c3b1f4122e

SHA512
60006fa6f57e4d280642d51055f85f8d27b913ce71373de5b928c515c77647295030ab73ab4a55024de4a40c18f200909f49ffb52c26cf554835fc3d4cc348f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rootsupd.inf

Filesize
1KB

MD5
421e60325404f5f29ac04c9b9d59096b

SHA1
aace2fd74d799e8af5c8d5b2646361bb67a1620c

SHA256
571a8da5298aacc37700c747ee5d72b5a7797835140e7a4d4f895e9604574d77

SHA512
86693975b1b187ee65b0a23b1f3f8e05d1a3f61e7e47b060f938fe1602bbad96021847b709e64c2d5a295b72f10f4db587a11a1e7ca0a0b64c3bed7fa683b1d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

Filesize
5KB

MD5
9c18ae971cbffb096952177f6804ea31

SHA1
bb255dd1bd9bb39cdbb8671af66054432c686828

SHA256
2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

SHA512
21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.sst

Filesize
320KB

MD5
2d9b4498c847715418160bfd7e7c8a2d

SHA1
e0873091d476d2566aa6fc988cb364247c95dc97

SHA256
c49c05b701c390c679e5e3226ec621f22a08155b1065fcfc37b509f648f03b41

SHA512
dcf3208cdd1e4353f82823f796d735c1209f149f183eea827a90753ec55509a1c460a16c120e07c12a5eacf0e67d2661c25638491ecf4403e25d6508983e519b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{879FB27C-623C-4ab8-8E2E-422249693E52}-TemporaryCache\7z.dll

Filesize
1.1MB

MD5
f0fef6362d4886e85a186a5e3766650a

SHA1
65843b7052a4d1b84762479d79445c46834e18b5

SHA256
15b9fe7d408cbf2204039087526e7df947df57b42ea479e303b682e956638816

SHA512
3f6dfd701cf62b77219f8825a2257c4bd7d44ebafc5654b06abaf906ced2571f4eeb04fe22ae6136c14bddebddb12555aa6efd322e779443d57bb122ea786043

Download Submit
C:\Users\Admin\AppData\Local\Temp\{9A70E771-2C7F-44ae-8BCF-17A165961603}-TemporaryCache\KB931125.exe

Filesize
349KB

MD5
4a4d72d34f9da1fc5019e0748fcde2f5

SHA1
f54752ec63369522f37e545325519ee434cdf439

SHA256
83b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca

SHA512
95986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads