Analysis
-
max time kernel
33s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-12-2024 19:26
Static task
static1
Behavioral task
behavioral1
Sample
avira_spotlight_setup.exe
Resource
win7-20240903-en
General
-
Target
avira_spotlight_setup.exe
-
Size
34.2MB
-
MD5
972eb9126d92fea2626690bef903aad6
-
SHA1
9def5004dc267f77f5cfb7070e85d330b8e33638
-
SHA256
858c355a5723e866dd9379765f2672976b4a097d836e8b5a2cd865f9819492a2
-
SHA512
2283f4ab903c98ccfb0a79154d5ad32b4af1ac4e8e7d71d583bbdbbd0ca866449e6c7658a8ac6b1e6061c448fa34e3b0a84b84efc023e5b2c80ca71c6aeb048a
-
SSDEEP
786432:CxgDPaSv7Kbd46LHeyvLXGx5ncGmGGxqe6PqiDViD:JKbd46bC5ncz/xy7DVo
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral1/memory/2364-819-0x0000000004760000-0x00000000047E6000-memory.dmp family_redline -
Redline family
-
Creates new service(s) 2 TTPs
-
Checks for any installed AV software in registry 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Ncp\NotificationLimits avira_spotlight_setup.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\LogFileLevel Avira.Spotlight.Service.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\UploadAllErrorReports Avira.Spotlight.Service.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\SOFTWARE\Avira\Security Avira.Spotlight.Systray.Application.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security Avira.Spotlight.UI.Application.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\GeneralSettings\DatabaseCheck = "\"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAVxuOryZ8sUOVNB5GZ1TdEQQAAAACAAAAAAAQZgAAAAEAACAAAAB7Gn1f0bFW/gY+VSp9eoTDwnbnyN1YdR/BAAPG5wcO5AAAAAAOgAAAAAIAACAAAAC6aa/WQY+zLxDVZL/xi+fLGYPIfRN8EviIuLR/nukAIBAAAAA/apki9JV8XcLx/aaImIbVQAAAAPAaDs4tL4XJEDbKFBxiGvh4Gzv1gYpq0JU5A4o9JrSH9X19+aMUWSSgntH+FYi/ezcFIDBamxc4cGB50edkdXs=\"" Avira.Spotlight.Service.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Resources\Cache.IdentityAssistant Avira.Spotlight.Service.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Resources\Cache.Device Avira.Spotlight.Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Features\CascadingIpms = "false" avira_spotlight_setup.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\UserInterface\UiLanguage Avira.Spotlight.UI.Application.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Scheduler Avira.Spotlight.Service.exe Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\SOFTWARE\Avira\Security\UserInterface Avira.Spotlight.Systray.Application.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Avira\Security Avira.Spotlight.Systray.Application.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\GeneralSettings Avira.Spotlight.Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\GeneralSettings\DatabaseCheck = "\"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAVxuOryZ8sUOVNB5GZ1TdEQQAAAACAAAAAAAQZgAAAAEAACAAAADhNokBy60M22BBo9mQpG49yBcqlCy1wSpq2k8jvWd8+gAAAAAOgAAAAAIAACAAAAD+MsT7FQ7aFfO3K18alYswxrEs7YqV0pwcXh9eFDNo+hAAAACktLi+PKil0mdNFEAXc/WfQAAAAH9FIMpT6Trz64dk3zMzZZ3jWrdsY4BTUuA8Q0zOCFx0/eQHfaJxnyvSViokZDuR/n4MaYG5ka2patj6iujrIJ4=\"" Avira.Spotlight.Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\GeneralSettings\DatabaseCheck = "\"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAVxuOryZ8sUOVNB5GZ1TdEQQAAAACAAAAAAAQZgAAAAEAACAAAACuA5+dtlrXmHNuN/5RT1NM8y2Kn7CEN/XY0AMp7rVESQAAAAAOgAAAAAIAACAAAAAMl3JzRotDjG0Fbceq5GCDq5/qo2wO1lLXDZBuaY6HjhAAAADtcfcheqqsEGozp5JEGYryQAAAANQLRfFSk40gOQUKeAiNpiiL0bskQS3DQ7HbPe6paD+X1Lnkj5yGAMm6+wjT/mQaVoy66PrusA5wtdLsQubITuU=\"" Avira.Spotlight.Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\GeneralSettings\DatabaseCheck = "\"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAVxuOryZ8sUOVNB5GZ1TdEQQAAAACAAAAAAAQZgAAAAEAACAAAADCdqMgJnH2THALLGnWVi6h/N+/HRZQLdWhYXJQjHRY5AAAAAAOgAAAAAIAACAAAACZ1gjVFp4xanvwdQhSn7wIzqpNWOrozt/IXlQNbvRTBhAAAABGO5VEew2nv7/YXQLX+EUZQAAAAOS4flTORNvuB1JtyTAljHY2nBk5MP925rh7uxvjV6Lm/HvbnNYUcGzmExGO3yoJOkVCUNlCBXqpgO98NTPmRXs=\"" Avira.Spotlight.Service.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Antivirus Avira.Spotlight.Service.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\UserInterface\UiLanguage Avira.Spotlight.Service.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Features\SchedulerImporterEnabled Avira.Spotlight.Service.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Features\NcpSmartScanEventBasedMessagingEnabled avira_spotlight_setup.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Features\IntegratedVpn Avira.Spotlight.Service.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Ncp\NcpSmartScanEventName Avira.Spotlight.Service.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Avira Avira.Spotlight.Systray.Application.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Scheduler\MigrationPerformed = "True" Avira.Spotlight.Service.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Scheduler Avira.Spotlight.Service.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\GeneralSettings\Cache.License.Version Avira.Spotlight.Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\GeneralSettings\DatabaseCheck = "\"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAVxuOryZ8sUOVNB5GZ1TdEQQAAAACAAAAAAAQZgAAAAEAACAAAAASGekbxPqqKaF0Lt00aLOXKcvMQZgF/ZJ6WGHOXYUlfQAAAAAOgAAAAAIAACAAAAA6Vlnlb4ADiskHEgvzRy92ZYQySVm+O+B2w7DDwDJ1rxAAAACDmX1d+zcztyINAWso37YyQAAAAM7jnNLBMFU41nSjMpN16yED8V3CqvHaG5atkbuA0/KSIQlzaqQ69KvaylpBEpfsd5IYVBouC/dFIsi03ceXen4=\"" Avira.Spotlight.Service.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Cache Avira.Spotlight.Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Cache\Cache.Licenses = "{\"Value\":{\"Mappings\":[{\"ProfileMailAddress\":null,\"License\":{\"days_left\":0,\"app\":{\"id\":\"sptl1\",\"app_type\":0,\"display_text\":\"Free Security Suite\",\"icon\":null,\"order\":0,\"upgradeable\":true,\"upgrade_text\":null,\"license_type\":\"free\",\"prototype\":\"spotlight\"},\"is_valid\":true,\"LicenseId\":\"0-0\",\"key\":null,\"creation_date\":null,\"modify_date\":null,\"expiration_date\":null,\"type\":0,\"subscription_type\":null,\"subscription\":0,\"expired\":false,\"devices_limit\":1,\"runtime\":0,\"runtime_unit\":null,\"is_beta_otc\":false,\"renewal_link\":\"\",\"cmp\":null},\"ServiceIds\":[\"spotlight\"]},{\"ProfileMailAddress\":null,\"License\":{\"days_left\":0,\"app\":{\"id\":\"swu\",\"app_type\":0,\"display_text\":\"Software Updater\",\"icon\":null,\"order\":0,\"upgradeable\":true,\"upgrade_text\":\"Upgrade to Pro for automatic software updates\",\"license_type\":\"free\",\"prototype\":\"updater\"},\"is_valid\":true,\"LicenseId\":\"0-0\",\"key\":null,\"creation_date\":null,\"modify_date\":null,\"expiration_date\":null,\"type\":0,\"subscription_type\":null,\"subscription\":0,\"expired\":false,\"devices_limit\":1,\"runtime\":0,\"runtime_unit\":null,\"is_beta_otc\":false,\"renewal_link\":\"\",\"cmp\":null},\"ServiceIds\":[\"updater\"]}],\"ExpiresIn\":\"7.00:00:00\"},\"CreatedDate\":\"2024-12-04T19:26:56.1834Z\",\"ExpirationTimeout\":\"7.00:00:00\"}" Avira.Spotlight.Service.exe Key value queried \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Avira\Security\UserInterface\WelcomePageShown Avira.Spotlight.Service.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Avira\Security\UserInterface\WelcomePageLastShown = "2024-12-04T19:26:57" Avira.Spotlight.UI.Application.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security Avira.Spotlight.Service.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Avira\Security\UserInterface\WelcomePageShownCount = "1" Avira.Spotlight.UI.Application.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Ncp avira_spotlight_setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Cache\Cache.Licenses = "{\"Value\":{\"Mappings\":[{\"ProfileMailAddress\":null,\"License\":{\"days_left\":0,\"app\":{\"id\":\"sptl1\",\"app_type\":0,\"display_text\":\"Free Security Suite\",\"icon\":null,\"order\":0,\"upgradeable\":true,\"upgrade_text\":null,\"license_type\":\"free\",\"prototype\":\"spotlight\"},\"is_valid\":true,\"LicenseId\":\"0-0\",\"key\":null,\"creation_date\":null,\"modify_date\":null,\"expiration_date\":null,\"type\":0,\"subscription_type\":null,\"subscription\":0,\"expired\":false,\"devices_limit\":1,\"runtime\":0,\"runtime_unit\":null,\"is_beta_otc\":false,\"renewal_link\":\"\",\"cmp\":null},\"ServiceIds\":[\"spotlight\"]},{\"ProfileMailAddress\":null,\"License\":{\"days_left\":0,\"app\":{\"id\":\"swu\",\"app_type\":0,\"display_text\":\"Software Updater\",\"icon\":null,\"order\":0,\"upgradeable\":true,\"upgrade_text\":\"Upgrade to Pro for automatic software updates\",\"license_type\":\"free\",\"prototype\":\"updater\"},\"is_valid\":true,\"LicenseId\":\"0-0\",\"key\":null,\"creation_date\":null,\"modify_date\":null,\"expiration_date\":null,\"type\":0,\"subscription_type\":null,\"subscription\":0,\"expired\":false,\"devices_limit\":1,\"runtime\":0,\"runtime_unit\":null,\"is_beta_otc\":false,\"renewal_link\":\"\",\"cmp\":null},\"ServiceIds\":[\"updater\"]}],\"ExpiresIn\":\"-10675199.02:48:05.4775808\"},\"CreatedDate\":\"2024-12-04T19:26:54.9554Z\",\"ExpirationTimeout\":\"-10675199.02:48:05.4775808\"}" Avira.Spotlight.Service.exe Key value queried \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Avira\Security\TestStartPage Avira.Spotlight.UI.Application.exe Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\SOFTWARE\Avira\Security\SmartScan Avira.Spotlight.Service.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\SentryProject Avira.Spotlight.Service.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\ConnectServices Avira.Spotlight.Service.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\UserInterface Avira.Spotlight.UI.Application.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Ncp\NcpVpnTrafficLimitEventName Avira.Spotlight.Service.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Crypto\Supported Avira.Spotlight.Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Cache\Cache.Licenses = "{\"Value\":{\"Mappings\":[{\"ProfileMailAddress\":null,\"License\":{\"days_left\":0,\"app\":{\"id\":\"sptl1\",\"app_type\":0,\"display_text\":\"Free Security Suite\",\"icon\":null,\"order\":0,\"upgradeable\":true,\"upgrade_text\":null,\"license_type\":\"free\",\"prototype\":\"spotlight\"},\"is_valid\":true,\"LicenseId\":\"0-0\",\"key\":null,\"creation_date\":null,\"modify_date\":null,\"expiration_date\":null,\"type\":0,\"subscription_type\":null,\"subscription\":0,\"expired\":false,\"devices_limit\":1,\"runtime\":0,\"runtime_unit\":null,\"is_beta_otc\":false,\"renewal_link\":\"\",\"cmp\":null},\"ServiceIds\":[\"spotlight\"]},{\"ProfileMailAddress\":null,\"License\":{\"days_left\":0,\"app\":{\"id\":\"swu\",\"app_type\":0,\"display_text\":\"Software Updater\",\"icon\":null,\"order\":0,\"upgradeable\":true,\"upgrade_text\":\"Upgrade to Pro for automatic software updates\",\"license_type\":\"free\",\"prototype\":\"updater\"},\"is_valid\":true,\"LicenseId\":\"0-0\",\"key\":null,\"creation_date\":null,\"modify_date\":null,\"expiration_date\":null,\"type\":0,\"subscription_type\":null,\"subscription\":0,\"expired\":false,\"devices_limit\":1,\"runtime\":0,\"runtime_unit\":null,\"is_beta_otc\":false,\"renewal_link\":\"\",\"cmp\":null},\"ServiceIds\":[\"updater\"]}],\"ExpiresIn\":\"7.00:00:00\"},\"CreatedDate\":\"2024-12-04T19:26:54.9344Z\",\"ExpirationTimeout\":\"7.00:00:00\"}" Avira.Spotlight.Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Features\IntegratedIntruderProtection = "true" avira_spotlight_setup.tmp Key queried \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Avira Avira.Spotlight.Systray.Application.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Ncp\NcpDeviceStartupEventName Avira.Spotlight.Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Crypto\Supported = "False" Avira.Spotlight.Service.exe Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\SOFTWARE\Avira\Security\UserInterface Avira.Spotlight.Service.exe Set key security \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Resources Avira.Spotlight.Service.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Features\IntegratedDuplicateFileFinder Avira.Spotlight.Service.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security Avira.Spotlight.Systray.Application.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\DownloadSource Avira.Spotlight.Service.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\BackgroundScan Avira.Spotlight.Service.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Cache\Cache.Licenses Avira.Spotlight.Service.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Features\IntegratedFileShredder Avira.Spotlight.Service.exe Key value queried \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Avira\Security\UserInterface\WelcomePageShownCount Avira.Spotlight.UI.Application.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\GeneralSettings avira_spotlight_setup.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\LogFileLevel Avira.Spotlight.Systray.Application.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Resources\Cache.Profile Avira.Spotlight.Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Cache\Cache.Licenses = "{\"Value\":{\"Mappings\":[{\"ProfileMailAddress\":null,\"License\":{\"days_left\":0,\"app\":{\"id\":\"sptl1\",\"app_type\":0,\"display_text\":\"Free Security Suite\",\"icon\":null,\"order\":0,\"upgradeable\":true,\"upgrade_text\":null,\"license_type\":\"free\",\"prototype\":\"spotlight\"},\"is_valid\":true,\"LicenseId\":\"0-0\",\"key\":null,\"creation_date\":null,\"modify_date\":null,\"expiration_date\":null,\"type\":0,\"subscription_type\":null,\"subscription\":0,\"expired\":false,\"devices_limit\":1,\"runtime\":0,\"runtime_unit\":null,\"is_beta_otc\":false,\"renewal_link\":\"\",\"cmp\":null},\"ServiceIds\":[\"spotlight\"]},{\"ProfileMailAddress\":null,\"License\":{\"days_left\":0,\"app\":{\"id\":\"swu\",\"app_type\":0,\"display_text\":\"Software Updater\",\"icon\":null,\"order\":0,\"upgradeable\":true,\"upgrade_text\":\"Upgrade to Pro for automatic software updates\",\"license_type\":\"free\",\"prototype\":\"updater\"},\"is_valid\":true,\"LicenseId\":\"0-0\",\"key\":null,\"creation_date\":null,\"modify_date\":null,\"expiration_date\":null,\"type\":0,\"subscription_type\":null,\"subscription\":0,\"expired\":false,\"devices_limit\":1,\"runtime\":0,\"runtime_unit\":null,\"is_beta_otc\":false,\"renewal_link\":\"\",\"cmp\":null},\"ServiceIds\":[\"updater\"]}],\"ExpiresIn\":\"7.00:00:00\"},\"CreatedDate\":\"2024-12-04T19:26:54.9594Z\",\"ExpirationTimeout\":\"7.00:00:00\"}" Avira.Spotlight.Service.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Migration Avira.Spotlight.UI.Application.exe Key value queried \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Avira\Security\UserInterface\LightModeNotificationChecked Avira.Spotlight.UI.Application.exe Key value queried \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Avira\Security\UserInterface\WelcomePageShownCount Avira.Spotlight.Service.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 Avira.Spotlight.Service.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416 Avira.Spotlight.Service.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416 Avira.Spotlight.Service.exe File opened for modification C:\Windows\SysWOW64\statReporter\statsreporter.db Avira.Spotlight.Service.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 Avira.Spotlight.Service.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Avira\Security\is-84MV3.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-36SNE.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-NCNHF.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\zh-CN\is-666TF.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-4P8NE.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-KMCUS.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-DH4L6.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-28IH0.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\fr-FR\is-9DOJA.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\ja-JP\is-BM00M.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\Update\is-C4M1T.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-KC4L7.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-V730T.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-5NTR8.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-I1I57.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-USJNB.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-7TNH9.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-5IA3A.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\Swu\is-3H3PE.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\it-IT\is-APCMI.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-LAH3U.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-V11SM.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-O6HH0.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-M4C6R.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-P4QCN.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-MGIHH.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-M0SU4.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-DJDOT.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-QAJ7D.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-FPPEH.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-KSHGA.tmp avira_spotlight_setup.tmp File opened for modification C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\ru-RU\Antivirus.ContextMenu.resources.dll Avira.Spotlight.Service.exe File opened for modification C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\zh-CN\Antivirus.ContextMenu.resources.dll Avira.Spotlight.Service.exe File created C:\Program Files (x86)\Avira\Security\is-SV1M8.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-3Q6MU.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-M4VED.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\ru-RU\is-D7U9E.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\es-ES\is-3S5GL.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\de-DE\is-2RH9G.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\zh-TW\is-A69PJ.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-OPCVT.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-VNP40.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-GSFK3.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-01FIH.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-UP6BN.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-RE8TF.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-F2JE7.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-VLA5S.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\tr-TR\is-UBBCN.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\Html\is-NQAH8.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\is-DPV1E.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-9VMS7.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-455AM.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\en-US\is-1MHVL.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\pt-BR\is-F72TQ.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\ru-RU\is-UF1GQ.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-14U27.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-N626G.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-1Q1EO.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\de-DE\is-FHRI0.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\Swu\is-USIC9.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\Update\ru-RU\is-MBCL2.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-MV6G9.tmp avira_spotlight_setup.tmp File created C:\Program Files (x86)\Avira\Security\is-AOIFL.tmp avira_spotlight_setup.tmp -
Executes dropped EXE 5 IoCs
pid Process 680 avira_spotlight_setup.tmp 1912 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 840 Avira.Spotlight.Systray.Application.exe 2636 Avira.Spotlight.UI.Application.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1292 sc.exe 1888 sc.exe -
Loads dropped DLL 64 IoCs
pid Process 1928 avira_spotlight_setup.exe 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 26 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language certutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language certutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language certutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language certutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira.Spotlight.Service.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language certutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language certutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language certutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language certutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira.Spotlight.Systray.Application.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira.Spotlight.UI.Application.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avira_spotlight_setup.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language certutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language certutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language certutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira.Spotlight.Service.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avira_spotlight_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language certutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language certutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION Avira.Spotlight.UI.Application.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Avira.Spotlight.UI.Application.exe = "11001" Avira.Spotlight.UI.Application.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL Avira.Spotlight.UI.Application.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\avira.com\NumberOfSubdomains = "1" Avira.Spotlight.UI.Application.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main Avira.Spotlight.UI.Application.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Avira.Spotlight.UI.Application.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL\Avira.Spotlight.UI.Application.exe = "1" Avira.Spotlight.UI.Application.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\spotlight.my.avira.com Avira.Spotlight.UI.Application.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\spotlight.my.avira.com\ = "16" Avira.Spotlight.UI.Application.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION Avira.Spotlight.UI.Application.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage Avira.Spotlight.UI.Application.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "16" Avira.Spotlight.UI.Application.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\avira.com Avira.Spotlight.UI.Application.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total Avira.Spotlight.UI.Application.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\avira.com\Total = "16" Avira.Spotlight.UI.Application.exe -
Modifies data under HKEY_USERS 49 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs Avira.Spotlight.Service.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" regasm.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates Avira.Spotlight.Service.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs Avira.Spotlight.Service.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs Avira.Spotlight.Service.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ regasm.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root Avira.Spotlight.Service.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" regasm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs Avira.Spotlight.Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates Avira.Spotlight.Service.exe -
Modifies registry class 40 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avira.Security avira_spotlight_setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avira.Security\shell\open\command\ = "\"C:\\Program Files (x86)\\Avira\\Security\\Avira.Spotlight.UI.Application.exe\" %1" avira_spotlight_setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Antivirus.ContextMenu.ContextMenu\ = "Antivirus.ContextMenu.ContextMenu" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Antivirus.ContextMenu.ContextMenu\CLSID regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE10D625-CC60-30A4-B3DF-4B349785BE6B}\InprocServer32\ThreadingModel = "Both" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE10D625-CC60-30A4-B3DF-4B349785BE6B}\InprocServer32\1.0.0.0 regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\ShellEx\ContextMenuHandlers\ContextMenu regasm.exe Key created \REGISTRY\MACHINE\Software\Classes\{80b8c23c-16e0-4cd8-bbc3-cecec9a78b79} Avira.Spotlight.Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Avira.Spotlight.UI.Application.Messaging.exe Avira.Spotlight.Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE10D625-CC60-30A4-B3DF-4B349785BE6B}\InprocServer32\RuntimeVersion = "v4.0.30319" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avira.Security\URL Protocol avira_spotlight_setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avira.Security\DefaultIcon avira_spotlight_setup.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Avira.Spotlight.UI.Application.Messaging.exe\NoStartPage = "0" Avira.Spotlight.Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE10D625-CC60-30A4-B3DF-4B349785BE6B} regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE10D625-CC60-30A4-B3DF-4B349785BE6B}\InprocServer32\Assembly = "Antivirus.ContextMenu, Version=1.0.0.0, Culture=neutral, PublicKeyToken=ed9daef625a6a98e" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE10D625-CC60-30A4-B3DF-4B349785BE6B}\ProgId regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avira.Security\shell\open\command avira_spotlight_setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Antivirus.ContextMenu.ContextMenu regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE10D625-CC60-30A4-B3DF-4B349785BE6B}\InprocServer32\ = "mscoree.dll" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE10D625-CC60-30A4-B3DF-4B349785BE6B}\InprocServer32\1.0.0.0\Class = "Antivirus.ContextMenu.ContextMenu" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE10D625-CC60-30A4-B3DF-4B349785BE6B}\Implemented Categories regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE10D625-CC60-30A4-B3DF-4B349785BE6B}\InprocServer32 regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE10D625-CC60-30A4-B3DF-4B349785BE6B}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/Avira/Security/Antivirus.ContextMenu/Antivirus.ContextMenu.DLL" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AllFileSystemObjects\ShellEx\ContextMenuHandlers\ContextMenu regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avira.Security\ = "URL:Avira Security" avira_spotlight_setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avira.Security\DefaultIcon\ = "Avira.Spotlight.UI.Application.exe,1" avira_spotlight_setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avira.Security\shell avira_spotlight_setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{80b8c23c-16e0-4cd8-bbc3-cecec9a78b79}\machine = "db0f067955fd49e0bf752d63ab743966a3ce683f" Avira.Spotlight.Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE10D625-CC60-30A4-B3DF-4B349785BE6B}\ = "Antivirus.ContextMenu.ContextMenu" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE10D625-CC60-30A4-B3DF-4B349785BE6B}\InprocServer32\Class = "Antivirus.ContextMenu.ContextMenu" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE10D625-CC60-30A4-B3DF-4B349785BE6B}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ContextMenu\ = "{ee10d625-cc60-30a4-b3df-4b349785be6b}" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\ContextMenu\ = "{ee10d625-cc60-30a4-b3df-4b349785be6b}" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avira.Security\shell\open avira_spotlight_setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{80b8c23c-16e0-4cd8-bbc3-cecec9a78b79}\sentry = "9b698e8f213e4c0c9a5a9a567a774ddbc0242a40" Avira.Spotlight.Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Antivirus.ContextMenu.ContextMenu\CLSID\ = "{EE10D625-CC60-30A4-B3DF-4B349785BE6B}" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE10D625-CC60-30A4-B3DF-4B349785BE6B}\InprocServer32\1.0.0.0\RuntimeVersion = "v4.0.30319" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE10D625-CC60-30A4-B3DF-4B349785BE6B}\ProgId\ = "Antivirus.ContextMenu.ContextMenu" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE10D625-CC60-30A4-B3DF-4B349785BE6B}\InprocServer32\1.0.0.0\Assembly = "Antivirus.ContextMenu, Version=1.0.0.0, Culture=neutral, PublicKeyToken=ed9daef625a6a98e" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE10D625-CC60-30A4-B3DF-4B349785BE6B}\InprocServer32\1.0.0.0\CodeBase = "file:///C:/Program Files (x86)/Avira/Security/Antivirus.ContextMenu/Antivirus.ContextMenu.DLL" regasm.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5\Blob = 040000000100000010000000a266bb7dcc38a562631361bbf61dd11b140000000100000014000000d5f656cb8fe8a25c6268d13d94905bd7ce9a18c40300000001000000140000003b1efd3a66ea28b16697394703a72ca340a05bd50f000000010000002000000008fba831c08544208f5208686b991ca1b2cfc510e7301784ddf1eb5bf03932391900000001000000100000003c70faea25600ce3b2cc5f0b222ed6292000000001000000f1050000308205ed308203d5a003020102021028cc3a25bfba44ac449a9b586b4339aa300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3130303632333231353732345a170d3335303632333232303430315a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313030820222300d06092a864886f70d01010105000382020f003082020a0282020100b9089e28e4e4ec064e5068b341c57bebaeb68eaf81ba22441f6534694cbe704017f2167be279fd86ed0d39f41ba8ad92901ecb3d768f5ad9b591102e3c058d8a6d2454e71fed56ad83b4509c15a51774885920fc08c58476d368d46f2878ce5cb8f3509044ffe3635fbea19a2c961504d607fe1e8421e0423111c4283694cf50a4629ec9d6ab7100b25b0ce696d40a2496f5ffc6d5b71bd7cbb72162af12dca15d37e31afb1a4698c09bc0e7631f2a0893027e1e6a8ef29f1889e42285a2b1845740fff50ed86f9cede2453101cd17e97fb08145e3aa214026a172aaa74f3c01057eee8358b15e06639962917882b70d930c246ab41bdb27ec5f95043f934a30f59718b3a7f919a793331d01c8db22525cd725c946f9a2fb875943be9b62b18d2d86441a46ac78617e3009faae89c4412a2266039139459cc78b0ca8ca0d2ffb52ea0cf76333239dfeb01fad67d6a75003c6047063b52cb1865a43b7fbaef96e296e21214126068cc9c3eeb0c28593a1b985d9e6326c4b4c3fd65da3e5b59d77c39cc055b77400e3b838ab839750e19a42241dc6c0a330d11a5ac85234f773f1c7181f33ad7aeccb4160f3239420c24845ac5c51c62e80c2e27715bd8587ed369d9691ee00b5a370ec9fe38d80688376baaf5d70522216e266fbbab3c5c2f73e2f77a6cadec1a6c6484cc3375123d327d7b84e7096f0a14476af78cf9ae166130203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414d5f656cb8fe8a25c6268d13d94905bd7ce9a18c4301006092b06010401823715010403020100300d06092a864886f70d01010b05000382020100aca5968cbfbbaea6f6d7718743315688fd1c32715b35b7d4f091f2af37e214f1f30226053e16147f14bab84ffb89b2b2e7d409cc6db95b3b64657066b7f2b15adf1a02f3f551b8676d79f3bf567be484b92b1e9b409c2634f947189869d81cd7b6d1bf8f61c267c4b5ef60438e101b3649e420caada7c1b1276509f8cdf55b2ad08433f3ef1ff2f59c0b589337a075a0de72de6c752a6622f58c0630569f40b930aa40771582d78becc0d3b2bd83c5770c1eaeaf1953a04d79719f0faf30ce67f9d62ccc22417a07f2974218ce59791055de6f10e4b8da836640160968235b972e269a02bb578cc5b8ba69623280899ea1fdc0927c7b2b3319842a63c5006862fa9f478d997a453aa7e9edee6942b5f3819b4756107bfc7036841873eaeff9974d9e3323dd260bba2ab73f44dc8327ffbd61592b11b7ca4fdbc58b0c1c31ae32f8f8b942f77fdc619a76b15a04e1113d6645b71871bec92485d6f3d4ba41345d122d25b98da613486d4bb0077d99930961817457268aab69e3e4d9c788cc24d8ec52245c1ebc9114e296deeb0ada9edd5fb35bdbd482ecc620508725403afbc7eecdfe33e56ec3840955032539c0e9355d6531a8f6bfa009cd29c7b336322edc95f383c15acf8b8df6eab321f8a4ed1e310eb64c11ab600ba412232217a3366482910412e0ab6f1ecb500561b440ff598671d1d533697ca9738a38d7640cf169 Avira.Spotlight.Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5\Blob = 140000000100000014000000d5f656cb8fe8a25c6268d13d94905bd7ce9a18c40300000001000000140000003b1efd3a66ea28b16697394703a72ca340a05bd50f000000010000002000000008fba831c08544208f5208686b991ca1b2cfc510e7301784ddf1eb5bf03932392000000001000000f1050000308205ed308203d5a003020102021028cc3a25bfba44ac449a9b586b4339aa300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3130303632333231353732345a170d3335303632333232303430315a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313030820222300d06092a864886f70d01010105000382020f003082020a0282020100b9089e28e4e4ec064e5068b341c57bebaeb68eaf81ba22441f6534694cbe704017f2167be279fd86ed0d39f41ba8ad92901ecb3d768f5ad9b591102e3c058d8a6d2454e71fed56ad83b4509c15a51774885920fc08c58476d368d46f2878ce5cb8f3509044ffe3635fbea19a2c961504d607fe1e8421e0423111c4283694cf50a4629ec9d6ab7100b25b0ce696d40a2496f5ffc6d5b71bd7cbb72162af12dca15d37e31afb1a4698c09bc0e7631f2a0893027e1e6a8ef29f1889e42285a2b1845740fff50ed86f9cede2453101cd17e97fb08145e3aa214026a172aaa74f3c01057eee8358b15e06639962917882b70d930c246ab41bdb27ec5f95043f934a30f59718b3a7f919a793331d01c8db22525cd725c946f9a2fb875943be9b62b18d2d86441a46ac78617e3009faae89c4412a2266039139459cc78b0ca8ca0d2ffb52ea0cf76333239dfeb01fad67d6a75003c6047063b52cb1865a43b7fbaef96e296e21214126068cc9c3eeb0c28593a1b985d9e6326c4b4c3fd65da3e5b59d77c39cc055b77400e3b838ab839750e19a42241dc6c0a330d11a5ac85234f773f1c7181f33ad7aeccb4160f3239420c24845ac5c51c62e80c2e27715bd8587ed369d9691ee00b5a370ec9fe38d80688376baaf5d70522216e266fbbab3c5c2f73e2f77a6cadec1a6c6484cc3375123d327d7b84e7096f0a14476af78cf9ae166130203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414d5f656cb8fe8a25c6268d13d94905bd7ce9a18c4301006092b06010401823715010403020100300d06092a864886f70d01010b05000382020100aca5968cbfbbaea6f6d7718743315688fd1c32715b35b7d4f091f2af37e214f1f30226053e16147f14bab84ffb89b2b2e7d409cc6db95b3b64657066b7f2b15adf1a02f3f551b8676d79f3bf567be484b92b1e9b409c2634f947189869d81cd7b6d1bf8f61c267c4b5ef60438e101b3649e420caada7c1b1276509f8cdf55b2ad08433f3ef1ff2f59c0b589337a075a0de72de6c752a6622f58c0630569f40b930aa40771582d78becc0d3b2bd83c5770c1eaeaf1953a04d79719f0faf30ce67f9d62ccc22417a07f2974218ce59791055de6f10e4b8da836640160968235b972e269a02bb578cc5b8ba69623280899ea1fdc0927c7b2b3319842a63c5006862fa9f478d997a453aa7e9edee6942b5f3819b4756107bfc7036841873eaeff9974d9e3323dd260bba2ab73f44dc8327ffbd61592b11b7ca4fdbc58b0c1c31ae32f8f8b942f77fdc619a76b15a04e1113d6645b71871bec92485d6f3d4ba41345d122d25b98da613486d4bb0077d99930961817457268aab69e3e4d9c788cc24d8ec52245c1ebc9114e296deeb0ada9edd5fb35bdbd482ecc620508725403afbc7eecdfe33e56ec3840955032539c0e9355d6531a8f6bfa009cd29c7b336322edc95f383c15acf8b8df6eab321f8a4ed1e310eb64c11ab600ba412232217a3366482910412e0ab6f1ecb500561b440ff598671d1d533697ca9738a38d7640cf169 Avira.Spotlight.Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 Avira.Spotlight.Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a03000000010000001400000002faf3e291435468607857694df5e45b688518680f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f2000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e Avira.Spotlight.Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 14000000010000001400000055e481d11180bed889b908a331f9a1240916b970030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d34310f0000000100000014000000327fc447408de9bf596f83d4b2fa4b8e3e7097d820000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551 Avira.Spotlight.Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff10300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 19000000010000001000000091fad483f14848a8a69b18b805cdbb3a0f0000000100000014000000327fc447408de9bf596f83d4b2fa4b8e3e7097d8030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d343114000000010000001400000055e481d11180bed889b908a331f9a1240916b97020000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 0f0000000100000014000000327fc447408de9bf596f83d4b2fa4b8e3e7097d8030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d343120000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 Avira.Spotlight.UI.Application.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 Avira.Spotlight.UI.Application.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 0f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 Avira.Spotlight.Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54\Blob = 0f000000010000002000000017fe16f394ec70a5bb0c6784cab40b1e61025ae9d50ecaa0531d6b4d997bbc590300000001000000140000003679ca35668772304d30a5fb873b0fa77bb70d542000000001000000bd040000308204b9308203a1a0030201020210401ac46421b31321030ebbe4121ac51d300d06092a864886f70d01010b05003081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f72697479301e170d3038303430323030303030305a170d3337313230313233353935395a3081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c761375eb10134db62d7159bff585a8c2323d6608e91d79098837ae65819388cc5f6e56485b4a271fbedbdb9dacd4d00b4c82d73a5c76971951f393cb244079ce80efa4d4ac421df29618f32226182c5871f6e8c7c5f16205144d1704f57eae31ce3cc79ee58d80ec2b34593c02ce79a172b7b00377a413378e133e2f3101a7f872cbef6f5f742e2e5bf8762895f004bdfc5dde4754432413a1e716e69cb0b754608d1cad22b95d0cffbb9406b648c574dfc13117984ed5e54f6349f0801f3102506174adaf11d7a666b986066a4d9efd22e82f1f0ef09ea44c9156ae2036e33d3ac9f5500c7f6086a94b95fdce033f18460f95b2711b4fc16f2bb566a80258d0203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e04160414b677fa6948479f5312d5c2ea07327607d1970719300d06092a864886f70d01010b050003820101004af8f8b003e62c677be4947763cc6e4cf97d0e0ddcc8b935b9704f63fa24fa6c838c479d3b63f39af976329591b177bcac9abeb1e43121c68195565a0eb1c2d4b1a659acf163cbb84c1d59904aef9016281f5aae10fb8150380c6cccf13dc3f563e3b3e321c92439e9fd156646f41b11d04d73a37d46f93deda85f62d4f13ff8e074572b189d81b4c428da9497a570ebac1dbe0711f0d5dbdde58cf0d532b083e657e28fbfbea1aabf3d1db5d438ead7b05c3a4f6a3f8fc0666c63aae9d9a416f481d195140e7dcd9534d9d28f7073817b9c7ebd9861d845879890c5eb8630c635bff0ffc35588834bef05920671f2b89893b7eccd8261f138e64f97982a5a8d Avira.Spotlight.Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E Avira.Spotlight.Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd Avira.Spotlight.Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Avira.Spotlight.Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5\Blob = 0f000000010000002000000008fba831c08544208f5208686b991ca1b2cfc510e7301784ddf1eb5bf03932390300000001000000140000003b1efd3a66ea28b16697394703a72ca340a05bd52000000001000000f1050000308205ed308203d5a003020102021028cc3a25bfba44ac449a9b586b4339aa300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3130303632333231353732345a170d3335303632333232303430315a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313030820222300d06092a864886f70d01010105000382020f003082020a0282020100b9089e28e4e4ec064e5068b341c57bebaeb68eaf81ba22441f6534694cbe704017f2167be279fd86ed0d39f41ba8ad92901ecb3d768f5ad9b591102e3c058d8a6d2454e71fed56ad83b4509c15a51774885920fc08c58476d368d46f2878ce5cb8f3509044ffe3635fbea19a2c961504d607fe1e8421e0423111c4283694cf50a4629ec9d6ab7100b25b0ce696d40a2496f5ffc6d5b71bd7cbb72162af12dca15d37e31afb1a4698c09bc0e7631f2a0893027e1e6a8ef29f1889e42285a2b1845740fff50ed86f9cede2453101cd17e97fb08145e3aa214026a172aaa74f3c01057eee8358b15e06639962917882b70d930c246ab41bdb27ec5f95043f934a30f59718b3a7f919a793331d01c8db22525cd725c946f9a2fb875943be9b62b18d2d86441a46ac78617e3009faae89c4412a2266039139459cc78b0ca8ca0d2ffb52ea0cf76333239dfeb01fad67d6a75003c6047063b52cb1865a43b7fbaef96e296e21214126068cc9c3eeb0c28593a1b985d9e6326c4b4c3fd65da3e5b59d77c39cc055b77400e3b838ab839750e19a42241dc6c0a330d11a5ac85234f773f1c7181f33ad7aeccb4160f3239420c24845ac5c51c62e80c2e27715bd8587ed369d9691ee00b5a370ec9fe38d80688376baaf5d70522216e266fbbab3c5c2f73e2f77a6cadec1a6c6484cc3375123d327d7b84e7096f0a14476af78cf9ae166130203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414d5f656cb8fe8a25c6268d13d94905bd7ce9a18c4301006092b06010401823715010403020100300d06092a864886f70d01010b05000382020100aca5968cbfbbaea6f6d7718743315688fd1c32715b35b7d4f091f2af37e214f1f30226053e16147f14bab84ffb89b2b2e7d409cc6db95b3b64657066b7f2b15adf1a02f3f551b8676d79f3bf567be484b92b1e9b409c2634f947189869d81cd7b6d1bf8f61c267c4b5ef60438e101b3649e420caada7c1b1276509f8cdf55b2ad08433f3ef1ff2f59c0b589337a075a0de72de6c752a6622f58c0630569f40b930aa40771582d78becc0d3b2bd83c5770c1eaeaf1953a04d79719f0faf30ce67f9d62ccc22417a07f2974218ce59791055de6f10e4b8da836640160968235b972e269a02bb578cc5b8ba69623280899ea1fdc0927c7b2b3319842a63c5006862fa9f478d997a453aa7e9edee6942b5f3819b4756107bfc7036841873eaeff9974d9e3323dd260bba2ab73f44dc8327ffbd61592b11b7ca4fdbc58b0c1c31ae32f8f8b942f77fdc619a76b15a04e1113d6645b71871bec92485d6f3d4ba41345d122d25b98da613486d4bb0077d99930961817457268aab69e3e4d9c788cc24d8ec52245c1ebc9114e296deeb0ada9edd5fb35bdbd482ecc620508725403afbc7eecdfe33e56ec3840955032539c0e9355d6531a8f6bfa009cd29c7b336322edc95f383c15acf8b8df6eab321f8a4ed1e310eb64c11ab600ba412232217a3366482910412e0ab6f1ecb500561b440ff598671d1d533697ca9738a38d7640cf169 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff10300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54\Blob = 190000000100000010000000ad6d6ff31b24013151f279e26a8c33240f000000010000002000000017fe16f394ec70a5bb0c6784cab40b1e61025ae9d50ecaa0531d6b4d997bbc590300000001000000140000003679ca35668772304d30a5fb873b0fa77bb70d54140000000100000014000000b677fa6948479f5312d5c2ea07327607d19707192000000001000000bd040000308204b9308203a1a0030201020210401ac46421b31321030ebbe4121ac51d300d06092a864886f70d01010b05003081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f72697479301e170d3038303430323030303030305a170d3337313230313233353935395a3081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c761375eb10134db62d7159bff585a8c2323d6608e91d79098837ae65819388cc5f6e56485b4a271fbedbdb9dacd4d00b4c82d73a5c76971951f393cb244079ce80efa4d4ac421df29618f32226182c5871f6e8c7c5f16205144d1704f57eae31ce3cc79ee58d80ec2b34593c02ce79a172b7b00377a413378e133e2f3101a7f872cbef6f5f742e2e5bf8762895f004bdfc5dde4754432413a1e716e69cb0b754608d1cad22b95d0cffbb9406b648c574dfc13117984ed5e54f6349f0801f3102506174adaf11d7a666b986066a4d9efd22e82f1f0ef09ea44c9156ae2036e33d3ac9f5500c7f6086a94b95fdce033f18460f95b2711b4fc16f2bb566a80258d0203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e04160414b677fa6948479f5312d5c2ea07327607d1970719300d06092a864886f70d01010b050003820101004af8f8b003e62c677be4947763cc6e4cf97d0e0ddcc8b935b9704f63fa24fa6c838c479d3b63f39af976329591b177bcac9abeb1e43121c68195565a0eb1c2d4b1a659acf163cbb84c1d59904aef9016281f5aae10fb8150380c6cccf13dc3f563e3b3e321c92439e9fd156646f41b11d04d73a37d46f93deda85f62d4f13ff8e074572b189d81b4c428da9497a570ebac1dbe0711f0d5dbdde58cf0d532b083e657e28fbfbea1aabf3d1db5d438ead7b05c3a4f6a3f8fc0666c63aae9d9a416f481d195140e7dcd9534d9d28f7073817b9c7ebd9861d845879890c5eb8630c635bff0ffc35588834bef05920671f2b89893b7eccd8261f138e64f97982a5a8d Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a8937214000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d430f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Avira.Spotlight.Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 Avira.Spotlight.UI.Application.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e40f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5\Blob = 1900000001000000100000003c70faea25600ce3b2cc5f0b222ed6290f000000010000002000000008fba831c08544208f5208686b991ca1b2cfc510e7301784ddf1eb5bf03932390300000001000000140000003b1efd3a66ea28b16697394703a72ca340a05bd5140000000100000014000000d5f656cb8fe8a25c6268d13d94905bd7ce9a18c42000000001000000f1050000308205ed308203d5a003020102021028cc3a25bfba44ac449a9b586b4339aa300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3130303632333231353732345a170d3335303632333232303430315a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313030820222300d06092a864886f70d01010105000382020f003082020a0282020100b9089e28e4e4ec064e5068b341c57bebaeb68eaf81ba22441f6534694cbe704017f2167be279fd86ed0d39f41ba8ad92901ecb3d768f5ad9b591102e3c058d8a6d2454e71fed56ad83b4509c15a51774885920fc08c58476d368d46f2878ce5cb8f3509044ffe3635fbea19a2c961504d607fe1e8421e0423111c4283694cf50a4629ec9d6ab7100b25b0ce696d40a2496f5ffc6d5b71bd7cbb72162af12dca15d37e31afb1a4698c09bc0e7631f2a0893027e1e6a8ef29f1889e42285a2b1845740fff50ed86f9cede2453101cd17e97fb08145e3aa214026a172aaa74f3c01057eee8358b15e06639962917882b70d930c246ab41bdb27ec5f95043f934a30f59718b3a7f919a793331d01c8db22525cd725c946f9a2fb875943be9b62b18d2d86441a46ac78617e3009faae89c4412a2266039139459cc78b0ca8ca0d2ffb52ea0cf76333239dfeb01fad67d6a75003c6047063b52cb1865a43b7fbaef96e296e21214126068cc9c3eeb0c28593a1b985d9e6326c4b4c3fd65da3e5b59d77c39cc055b77400e3b838ab839750e19a42241dc6c0a330d11a5ac85234f773f1c7181f33ad7aeccb4160f3239420c24845ac5c51c62e80c2e27715bd8587ed369d9691ee00b5a370ec9fe38d80688376baaf5d70522216e266fbbab3c5c2f73e2f77a6cadec1a6c6484cc3375123d327d7b84e7096f0a14476af78cf9ae166130203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414d5f656cb8fe8a25c6268d13d94905bd7ce9a18c4301006092b06010401823715010403020100300d06092a864886f70d01010b05000382020100aca5968cbfbbaea6f6d7718743315688fd1c32715b35b7d4f091f2af37e214f1f30226053e16147f14bab84ffb89b2b2e7d409cc6db95b3b64657066b7f2b15adf1a02f3f551b8676d79f3bf567be484b92b1e9b409c2634f947189869d81cd7b6d1bf8f61c267c4b5ef60438e101b3649e420caada7c1b1276509f8cdf55b2ad08433f3ef1ff2f59c0b589337a075a0de72de6c752a6622f58c0630569f40b930aa40771582d78becc0d3b2bd83c5770c1eaeaf1953a04d79719f0faf30ce67f9d62ccc22417a07f2974218ce59791055de6f10e4b8da836640160968235b972e269a02bb578cc5b8ba69623280899ea1fdc0927c7b2b3319842a63c5006862fa9f478d997a453aa7e9edee6942b5f3819b4756107bfc7036841873eaeff9974d9e3323dd260bba2ab73f44dc8327ffbd61592b11b7ca4fdbc58b0c1c31ae32f8f8b942f77fdc619a76b15a04e1113d6645b71871bec92485d6f3d4ba41345d122d25b98da613486d4bb0077d99930961817457268aab69e3e4d9c788cc24d8ec52245c1ebc9114e296deeb0ada9edd5fb35bdbd482ecc620508725403afbc7eecdfe33e56ec3840955032539c0e9355d6531a8f6bfa009cd29c7b336322edc95f383c15acf8b8df6eab321f8a4ed1e310eb64c11ab600ba412232217a3366482910412e0ab6f1ecb500561b440ff598671d1d533697ca9738a38d7640cf169 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e40f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b03000000010000001400000002faf3e291435468607857694df5e45b68851868140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 1900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 1900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c543614000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1552000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Avira.Spotlight.Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54\Blob = 140000000100000014000000b677fa6948479f5312d5c2ea07327607d19707190300000001000000140000003679ca35668772304d30a5fb873b0fa77bb70d540f000000010000002000000017fe16f394ec70a5bb0c6784cab40b1e61025ae9d50ecaa0531d6b4d997bbc592000000001000000bd040000308204b9308203a1a0030201020210401ac46421b31321030ebbe4121ac51d300d06092a864886f70d01010b05003081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f72697479301e170d3038303430323030303030305a170d3337313230313233353935395a3081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c761375eb10134db62d7159bff585a8c2323d6608e91d79098837ae65819388cc5f6e56485b4a271fbedbdb9dacd4d00b4c82d73a5c76971951f393cb244079ce80efa4d4ac421df29618f32226182c5871f6e8c7c5f16205144d1704f57eae31ce3cc79ee58d80ec2b34593c02ce79a172b7b00377a413378e133e2f3101a7f872cbef6f5f742e2e5bf8762895f004bdfc5dde4754432413a1e716e69cb0b754608d1cad22b95d0cffbb9406b648c574dfc13117984ed5e54f6349f0801f3102506174adaf11d7a666b986066a4d9efd22e82f1f0ef09ea44c9156ae2036e33d3ac9f5500c7f6086a94b95fdce033f18460f95b2711b4fc16f2bb566a80258d0203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e04160414b677fa6948479f5312d5c2ea07327607d1970719300d06092a864886f70d01010b050003820101004af8f8b003e62c677be4947763cc6e4cf97d0e0ddcc8b935b9704f63fa24fa6c838c479d3b63f39af976329591b177bcac9abeb1e43121c68195565a0eb1c2d4b1a659acf163cbb84c1d59904aef9016281f5aae10fb8150380c6cccf13dc3f563e3b3e321c92439e9fd156646f41b11d04d73a37d46f93deda85f62d4f13ff8e074572b189d81b4c428da9497a570ebac1dbe0711f0d5dbdde58cf0d532b083e657e28fbfbea1aabf3d1db5d438ead7b05c3a4f6a3f8fc0666c63aae9d9a416f481d195140e7dcd9534d9d28f7073817b9c7ebd9861d845879890c5eb8630c635bff0ffc35588834bef05920671f2b89893b7eccd8261f138e64f97982a5a8d Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa60300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4314000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f2000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa60300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b03000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e14000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd155030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54360f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b1900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Avira.Spotlight.Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Avira.Spotlight.Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5 Avira.Spotlight.Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D69B561148F01C77C54578C10926DF5B856976AD Avira.Spotlight.Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa20f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e2000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d430f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Avira.Spotlight.Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 14000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd155030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54360f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a00300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd10f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 040000000100000010000000ee2931bc327e9ae6e8b5f751b434719014000000010000001400000055e481d11180bed889b908a331f9a1240916b970030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d34310f0000000100000014000000327fc447408de9bf596f83d4b2fa4b8e3e7097d819000000010000001000000091fad483f14848a8a69b18b805cdbb3a20000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551 Avira.Spotlight.Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd Avira.Spotlight.Service.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 564 schtasks.exe 1604 schtasks.exe 828 schtasks.exe 820 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 1912 Avira.Spotlight.Service.exe 680 avira_spotlight_setup.tmp 680 avira_spotlight_setup.tmp 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2364 Avira.Spotlight.Service.exe 2636 Avira.Spotlight.UI.Application.exe 2636 Avira.Spotlight.UI.Application.exe 2636 Avira.Spotlight.UI.Application.exe 2636 Avira.Spotlight.UI.Application.exe 2636 Avira.Spotlight.UI.Application.exe 2636 Avira.Spotlight.UI.Application.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1912 Avira.Spotlight.Service.exe Token: SeDebugPrivilege 2364 Avira.Spotlight.Service.exe Token: SeDebugPrivilege 2636 Avira.Spotlight.UI.Application.exe Token: SeDebugPrivilege 2884 regasm.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 680 avira_spotlight_setup.tmp 840 Avira.Spotlight.Systray.Application.exe 840 Avira.Spotlight.Systray.Application.exe 840 Avira.Spotlight.Systray.Application.exe 840 Avira.Spotlight.Systray.Application.exe 840 Avira.Spotlight.Systray.Application.exe 840 Avira.Spotlight.Systray.Application.exe 840 Avira.Spotlight.Systray.Application.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 840 Avira.Spotlight.Systray.Application.exe 840 Avira.Spotlight.Systray.Application.exe 840 Avira.Spotlight.Systray.Application.exe 840 Avira.Spotlight.Systray.Application.exe 840 Avira.Spotlight.Systray.Application.exe 840 Avira.Spotlight.Systray.Application.exe 840 Avira.Spotlight.Systray.Application.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2636 Avira.Spotlight.UI.Application.exe 2636 Avira.Spotlight.UI.Application.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1928 wrote to memory of 680 1928 avira_spotlight_setup.exe 31 PID 1928 wrote to memory of 680 1928 avira_spotlight_setup.exe 31 PID 1928 wrote to memory of 680 1928 avira_spotlight_setup.exe 31 PID 1928 wrote to memory of 680 1928 avira_spotlight_setup.exe 31 PID 1928 wrote to memory of 680 1928 avira_spotlight_setup.exe 31 PID 1928 wrote to memory of 680 1928 avira_spotlight_setup.exe 31 PID 1928 wrote to memory of 680 1928 avira_spotlight_setup.exe 31 PID 680 wrote to memory of 1740 680 avira_spotlight_setup.tmp 32 PID 680 wrote to memory of 1740 680 avira_spotlight_setup.tmp 32 PID 680 wrote to memory of 1740 680 avira_spotlight_setup.tmp 32 PID 680 wrote to memory of 1740 680 avira_spotlight_setup.tmp 32 PID 680 wrote to memory of 2820 680 avira_spotlight_setup.tmp 34 PID 680 wrote to memory of 2820 680 avira_spotlight_setup.tmp 34 PID 680 wrote to memory of 2820 680 avira_spotlight_setup.tmp 34 PID 680 wrote to memory of 2820 680 avira_spotlight_setup.tmp 34 PID 680 wrote to memory of 2740 680 avira_spotlight_setup.tmp 36 PID 680 wrote to memory of 2740 680 avira_spotlight_setup.tmp 36 PID 680 wrote to memory of 2740 680 avira_spotlight_setup.tmp 36 PID 680 wrote to memory of 2740 680 avira_spotlight_setup.tmp 36 PID 680 wrote to memory of 1108 680 avira_spotlight_setup.tmp 38 PID 680 wrote to memory of 1108 680 avira_spotlight_setup.tmp 38 PID 680 wrote to memory of 1108 680 avira_spotlight_setup.tmp 38 PID 680 wrote to memory of 1108 680 avira_spotlight_setup.tmp 38 PID 680 wrote to memory of 2800 680 avira_spotlight_setup.tmp 40 PID 680 wrote to memory of 2800 680 avira_spotlight_setup.tmp 40 PID 680 wrote to memory of 2800 680 avira_spotlight_setup.tmp 40 PID 680 wrote to memory of 2800 680 avira_spotlight_setup.tmp 40 PID 680 wrote to memory of 2096 680 avira_spotlight_setup.tmp 42 PID 680 wrote to memory of 2096 680 avira_spotlight_setup.tmp 42 PID 680 wrote to memory of 2096 680 avira_spotlight_setup.tmp 42 PID 680 wrote to memory of 2096 680 avira_spotlight_setup.tmp 42 PID 680 wrote to memory of 1564 680 avira_spotlight_setup.tmp 44 PID 680 wrote to memory of 1564 680 avira_spotlight_setup.tmp 44 PID 680 wrote to memory of 1564 680 avira_spotlight_setup.tmp 44 PID 680 wrote to memory of 1564 680 avira_spotlight_setup.tmp 44 PID 680 wrote to memory of 2616 680 avira_spotlight_setup.tmp 46 PID 680 wrote to memory of 2616 680 avira_spotlight_setup.tmp 46 PID 680 wrote to memory of 2616 680 avira_spotlight_setup.tmp 46 PID 680 wrote to memory of 2616 680 avira_spotlight_setup.tmp 46 PID 680 wrote to memory of 2208 680 avira_spotlight_setup.tmp 48 PID 680 wrote to memory of 2208 680 avira_spotlight_setup.tmp 48 PID 680 wrote to memory of 2208 680 avira_spotlight_setup.tmp 48 PID 680 wrote to memory of 2208 680 avira_spotlight_setup.tmp 48 PID 680 wrote to memory of 2628 680 avira_spotlight_setup.tmp 50 PID 680 wrote to memory of 2628 680 avira_spotlight_setup.tmp 50 PID 680 wrote to memory of 2628 680 avira_spotlight_setup.tmp 50 PID 680 wrote to memory of 2628 680 avira_spotlight_setup.tmp 50 PID 680 wrote to memory of 2932 680 avira_spotlight_setup.tmp 52 PID 680 wrote to memory of 2932 680 avira_spotlight_setup.tmp 52 PID 680 wrote to memory of 2932 680 avira_spotlight_setup.tmp 52 PID 680 wrote to memory of 2932 680 avira_spotlight_setup.tmp 52 PID 680 wrote to memory of 1864 680 avira_spotlight_setup.tmp 54 PID 680 wrote to memory of 1864 680 avira_spotlight_setup.tmp 54 PID 680 wrote to memory of 1864 680 avira_spotlight_setup.tmp 54 PID 680 wrote to memory of 1864 680 avira_spotlight_setup.tmp 54 PID 680 wrote to memory of 1640 680 avira_spotlight_setup.tmp 56 PID 680 wrote to memory of 1640 680 avira_spotlight_setup.tmp 56 PID 680 wrote to memory of 1640 680 avira_spotlight_setup.tmp 56 PID 680 wrote to memory of 1640 680 avira_spotlight_setup.tmp 56 PID 680 wrote to memory of 1912 680 avira_spotlight_setup.tmp 58 PID 680 wrote to memory of 1912 680 avira_spotlight_setup.tmp 58 PID 680 wrote to memory of 1912 680 avira_spotlight_setup.tmp 58 PID 680 wrote to memory of 1912 680 avira_spotlight_setup.tmp 58 PID 680 wrote to memory of 1292 680 avira_spotlight_setup.tmp 61
Processes
-
C:\Users\Admin\AppData\Local\Temp\avira_spotlight_setup.exe"C:\Users\Admin\AppData\Local\Temp\avira_spotlight_setup.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\is-28H1D.tmp\avira_spotlight_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-28H1D.tmp\avira_spotlight_setup.tmp" /SL5="$301CC,34912022,924672,C:\Users\Admin\AppData\Local\Temp\avira_spotlight_setup.exe"2⤵
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\SysWOW64\certutil.exe"C:\Windows\system32\certutil.exe" -addstore "AuthRoot" "C:\Users\Admin\AppData\Local\Temp\is-PM8K0.tmp\AddTrust_External_CA_Root_2000.cer"3⤵
- System Location Discovery: System Language Discovery
PID:1740
-
-
C:\Windows\SysWOW64\certutil.exe"C:\Windows\system32\certutil.exe" -addstore "Root" "C:\Users\Admin\AppData\Local\Temp\is-PM8K0.tmp\DigiCert_Assured_ID_Root_CA_2006.cer"3⤵
- System Location Discovery: System Language Discovery
PID:2820
-
-
C:\Windows\SysWOW64\certutil.exe"C:\Windows\system32\certutil.exe" -addstore "Root" "C:\Users\Admin\AppData\Local\Temp\is-PM8K0.tmp\DigiCert_Global_Root_CA_2006.cer"3⤵
- System Location Discovery: System Language Discovery
PID:2740
-
-
C:\Windows\SysWOW64\certutil.exe"C:\Windows\system32\certutil.exe" -addstore "Root" "C:\Users\Admin\AppData\Local\Temp\is-PM8K0.tmp\DigiCert_Trusted_Root_G4_2013.cer"3⤵
- System Location Discovery: System Language Discovery
PID:1108
-
-
C:\Windows\SysWOW64\certutil.exe"C:\Windows\system32\certutil.exe" -addstore "AuthRoot" "C:\Users\Admin\AppData\Local\Temp\is-PM8K0.tmp\Entrust.net_Certification_Authority_(2048)_1999.cer"3⤵
- System Location Discovery: System Language Discovery
PID:2800
-
-
C:\Windows\SysWOW64\certutil.exe"C:\Windows\system32\certutil.exe" -addstore "Root" "C:\Users\Admin\AppData\Local\Temp\is-PM8K0.tmp\GlobalSign_2009.cer"3⤵
- System Location Discovery: System Language Discovery
PID:2096
-
-
C:\Windows\SysWOW64\certutil.exe"C:\Windows\system32\certutil.exe" -addstore "Root" "C:\Users\Admin\AppData\Local\Temp\is-PM8K0.tmp\GlobalSign_2014.cer"3⤵
- System Location Discovery: System Language Discovery
PID:1564
-
-
C:\Windows\SysWOW64\certutil.exe"C:\Windows\system32\certutil.exe" -addstore "Root" "C:\Users\Admin\AppData\Local\Temp\is-PM8K0.tmp\Microsoft_Identity_Verification_Root_Certificate_Authority_2020.cer"3⤵
- System Location Discovery: System Language Discovery
PID:2616
-
-
C:\Windows\SysWOW64\certutil.exe"C:\Windows\system32\certutil.exe" -addstore "Root" "C:\Users\Admin\AppData\Local\Temp\is-PM8K0.tmp\Microsoft_Root_Certificate_Authority_2001.cer"3⤵
- System Location Discovery: System Language Discovery
PID:2208
-
-
C:\Windows\SysWOW64\certutil.exe"C:\Windows\system32\certutil.exe" -addstore "Root" "C:\Users\Admin\AppData\Local\Temp\is-PM8K0.tmp\Microsoft_Root_Certificate_Authority_2010.cer"3⤵
- System Location Discovery: System Language Discovery
PID:2628
-
-
C:\Windows\SysWOW64\certutil.exe"C:\Windows\system32\certutil.exe" -addstore "Root" "C:\Users\Admin\AppData\Local\Temp\is-PM8K0.tmp\Microsoft_Root_Certificate_Authority_2011.cer"3⤵
- System Location Discovery: System Language Discovery
PID:2932
-
-
C:\Windows\SysWOW64\certutil.exe"C:\Windows\system32\certutil.exe" -addstore "AuthRoot" "C:\Users\Admin\AppData\Local\Temp\is-PM8K0.tmp\USERTrust_RSA_Certification_Authority_2010.cer"3⤵
- System Location Discovery: System Language Discovery
PID:1864
-
-
C:\Windows\SysWOW64\certutil.exe"C:\Windows\system32\certutil.exe" -addstore "Root" "C:\Users\Admin\AppData\Local\Temp\is-PM8K0.tmp\VeriSign_Universal_Root_Certification_Authority_2008.cer"3⤵
- System Location Discovery: System Language Discovery
PID:1640
-
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.exe" /install3⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" create AviraSecurityUpdater DisplayName= "Avira Security Updater" binPath= "\"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Common.Updater.exe\"" start= delayed-auto3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1292
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" description AviraSecurityUpdater "Avira Security Updater"3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1888
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Update /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-PM8K0.tmp\UpdateFallbackTask.xml"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1604
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Service_SCM_Watchdog /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-PM8K0.tmp\WatchdogServiceControlManagerTimeout.xml"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:828
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Systray /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-PM8K0.tmp\SystrayAutostart.xml"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:820
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Maintenance /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-PM8K0.tmp\MaintenanceTask.xml"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:564
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Run /TN Avira_Security_Systray3⤵
- System Location Discovery: System Language Discovery
PID:2248
-
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.UI.Application.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.UI.Application.exe"3⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2636
-
-
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.exe"1⤵
- Checks for any installed AV software in registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2364 -
C:\Windows\Microsoft.Net\Framework64\v4.0.30319\regasm.exe"C:\Windows\Microsoft.Net\Framework64\v4.0.30319\regasm.exe" /codebase "C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\Antivirus.ContextMenu.dll"2⤵
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {B117E3DC-47D8-4E77-869F-7A995DDBCB96} S-1-5-21-1846800975-3917212583-2893086201-1000:ZQABOPWE\Admin:Interactive:[1]1⤵PID:2168
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Systray.Application.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Systray.Application.exe"2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:840
-
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169KB
MD5b9d53f6dd5b806ba580115242a8562f5
SHA1921905c004ae4dc038fd00d867c1784dfed2c115
SHA2564f0bf6c14e4abd50a3ddaf078063c8168c529e6fb26b258f3dfa05a1722e10be
SHA51272e53484c5405d812ad94aa90a508c2a342894a484af24ed5935683844fad1b1576f8271310128db613ac0a63035dda9653d130a59f034740d24b4a1e188a1f5
-
Filesize
451KB
MD512f5d0daf6da438c9165729cfa3b5504
SHA10b6758c687ebbab02b8793af906d18545dc3d907
SHA256da513b45066186f3771394c37958eccf6decc4a6893ea200b87333a77e1d76d8
SHA512bb91caea8ebd536054b7d8e78eefc656c21368d07c1f57cfe7b90986052479e369405f34c57e18070e33b1091f66ae3a6cfb920823456b10f0dc9b32fa7f3035
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\System.Runtime.CompilerServices.Unsafe.dll
Filesize18KB
MD56cff1bc1824d5a17330e019b4e8052eb
SHA13319a7b426c3290e71d9e662511be220cc24b3ca
SHA2566619727ed1e81f53e2f4fb3ea31c4d73ce5e3174e67d346d5c55aa4438b25bcc
SHA51273b622007810b8a3ee9c517bf6d47186ccc4731ddcabfab92d48c137b61305c0c8505f5c3995f409e65fed97cfcac096497b5653d4f59bebff24a652818b5def
-
Filesize
27KB
MD5e9614fcfdadf7d98b6b478c1001c408f
SHA1d96abdfa11e890e6aac6d6235439b299f4e5ca92
SHA2567a6b76825981010a4943e04f78dd15b4724579b58a1dbce08e1dcf532751c4f0
SHA51241b1749e66d2bb87c08b03333ed61b784174c4deab81b1200e833a6b805c002547ae906e9502554e16a0c59bdc418537438fc54c3e9384ff7953b3f0ec01f289
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\de-DE\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD565f5d9db2cb9447d7c202d20d35745ff
SHA1e09975f532877fae556a3df95d31e42be3a3209e
SHA2564129857c1ebc44fe2520c7e18c8d8cd2675cd1b9fd871f3010a863309c149df0
SHA51246d6970973ee467892c08777e724c80a32484850d74b7fcd4eaaa00114ca8f8c610c64547f04c8141dd797f18ab46c76904ee6b4a91131fd8b241fff0fd242ba
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\en-US\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD5c9a23c592c13b1fb7a1d3ab6ed46aec5
SHA1de1563cc959b4a1ada4fbf305c7c38d0a531bc68
SHA256a2af3c49043a5cac31389a00e4783dfddece29bbb853a7c1033195bf066ef114
SHA5120289a023214d5d57eeb7e1f3e98ebbc713ab051f87d698b56237c8c49cf20b741cd0c40bfa5cbff056344cd4f4f3acd4302a9befd1edd46ecf670a9230c97c96
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\es-ES\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD5fe3af7525146c83aac42f8106af08edb
SHA17e6a4b2497e60e76cf4298f1fad0c24627882f6c
SHA256d13c2f82060e37117bc2811b940654aa4f6d5fe7614cb3eec4441fbf2fede607
SHA5120adeb8afd6132006be77c19d946f01f8c7aec413a0512803813202de51de9980efbba3df02070bf56350aa02aacd527a9a0ad9f340181b2ba9241dd7ae9fd606
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\fr-FR\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD5650acbb7c5c30701ff5d6f8041ada45b
SHA1f285470b217abd8f4f355976133be1287f7b2ca7
SHA25666d0da7c1558c17dc98ade5c6165977775ba862d61395de5e78523467e2aced8
SHA512a758464383402f8cdb386f2de4e0ca6c239ae39d7cde90817003a7ebd543ffd592851f2c1f27494b9e15ba2c449a0c365d6b6597267b6297d59c7a515f64e7b7
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\it-IT\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD56feba78b1d4c91e93632a8a0cfdc4d89
SHA1fb0b03c29e9e741f8b3a97133a506df9c8ce81fe
SHA256d3206cc46451bc7e9b22e99f8f63def0b688cd817ddd30b0d2ab4be8f663c587
SHA5127531d43bf95f2a050b3ac6d660dda6478d447e8e394d15563612321bd31d18d066a580744ee75f67ea2e7a2a4bdb359668f54aaf91b68b6a161237691b929dde
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\ja-JP\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD5040cea3307599765a48b5c72387329fe
SHA1bccb9b1d9f4a33e5ba727a72bcddbca324c6a4e2
SHA2564565dd3dabcd3311fb36736e8fb7ae9c19638cd83502ece53377986afaef3851
SHA5127cd24225cc7720189556072e37aae16b5c2e1dc73206c28000e68748bb14e74165e507bd45a0012d0f6c153558c965f9ce8d8b32fca90ed7ad83c5611a7a6510
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\nl-NL\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD5122701eac2d49ce91a6f10ca83404f54
SHA15d870d3182a11c8b62c6bc53f4bf09df40a1448a
SHA25642c72ff30cc9e5af0dc40d11ac246024fa50befede452e28bd3d088dd365b20b
SHA5125c5a3b2e942f2efc270c3d15cf7ea7f6507ee741c4b5a00e416cd83ddbc54043059ac63614bd23f10c4ea40367c56438d358bcb7f343d8375311a45cb4bfd70f
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\pt-BR\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD55df9d9ee5fbe6b683eefb8b6591b9a38
SHA10056ccfa1b199594f318474229c44fc03aa1ee13
SHA25621532af9e30ce98dcb5fbab874123b237f8966e37dce867e3701e806e4d745bc
SHA5120db3cf25848ecd1d626b6f88837c87ed6091848d09eb67e3abb8ffab5ead7d020bc0b74cfc422cb960935b5d727b0b8f20de18319600d75a04002fc1881ccac0
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\ru-RU\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD5fcc375995550d6fe68b197ad8d84e90b
SHA13ea8aee1b0b1cabb08f2e8f3a010ffae819e4b2e
SHA256b46c6744c6d25a790afde591c6b19508c6ece4b55c90964041f3ea42798ab401
SHA512072222fb0fc8acdcad21a4945aba19369386490f90de47395cae1c29f62022d232069238d2c869c33342eaf9494176f696e4a10874c8531f0ae60406f7a34164
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\tr-TR\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD5b57782918785c0ae12410ec92d495190
SHA1f6371456a8eb810577e2fa180dde57131d8ea364
SHA256911265025feb1f2d02ff5f7f8b7af0d76e541a417278ebde637005ad75cbd732
SHA512d133cafce2e416b3e76774342e6bfa78eb5f9e0126ec8a6652450388ac7dacf9c183abae2ee72b0f4f585e84b1ac8f4b59d5d7dc1754dc50ba8fdbe76a40823d
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\zh-CN\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD5fc3f161ae40282b60c41582331143854
SHA1d6981b1e1e42c38ab9d55eb0454db686672b26e0
SHA25627fd20b141e962fe8054144bbc5759742554033d1fe319a874b831131b1438a3
SHA512d764d489e643715f288ea13ebd20144f0a64eedbd17ebceba4d543e23c78b18a95dc88538b193202b610a16615fb0b18672205ecf0cab52da5def58e35812c16
-
C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\zh-TW\Antivirus.ContextMenu.resources.dll
Filesize15KB
MD56ddfd6064f172197b362087e15fe05e4
SHA1be604c28cd49b673a31d06a75af8c70d53db7e78
SHA2569d10d3acad469f0ed9db4462fed1a523900e703e4a219e42dc6394f8a4e95896
SHA5122002aacde72f31051048bcbb087e05e5fe00766a4911bcf3cd5bcde5d9f3a1125723711ccad0e772c90c49fc6a60435158258d27eb383732b96065da1c48b81f
-
Filesize
14KB
MD5271d473a99869a462e0200e1776b093c
SHA1050bd3a95fc3c1a66a9fa11a7649afe95b48e5ca
SHA256793dc8d33fd8190c6d87c39a860ae4d67c6f02a19b573087831b18202f8e413e
SHA5128df6120445f10fd3a62b72a33f86b1969a42eae85d97154d5f030bebf68d579263be50ba4e0a9758bd9a8698e9680277d1491bebc1b2c91722d0ebab04275510
-
Filesize
54KB
MD5318f261f2875d1b6ad27afd9aebce1da
SHA16230901e4b145e7ea66160e9726951931a00b7de
SHA256839942ba4c0e36ad27355f65acf6520bbd6fa0967bfd3d9d6ddec520ca4fc3c9
SHA512379c89f2d165a1551c459984f3aeec556499c2cc7346f4a346d5b651f5a729c44b0f84c68b48f120f8c5ddaba0bfa2895421acb7261f266dd5743ce8fa6a6c80
-
Filesize
151KB
MD593b9f3f908fd317f6400044ace1426b8
SHA128a81a9e705837007143c1933a436941bc0e3e73
SHA2564c20af4eb824f54308a3d0fcb1e0c02705e36f4066a96d3187ff61cbd324bfbf
SHA5126b32af4a9e63320ca20daea161c655ad58a4bcaffa8c0ecbe40cf2f41599a09bdc3306916e87777259ade6b120e2eb193e79ca4345268a49786159779d2aead1
-
Filesize
22KB
MD512d0daa2e690a67a441bd7c0c212e23e
SHA1549df37123bcccf86520ef06b705469eec5aecfa
SHA256db87ec95353e8ab3ca79a532d132aa8d58baa4608289b18e409a11bd7211b67b
SHA512e8c47a35f102862a4719a6e02b3ab69f4d72e4750d6bc94aa9c78bd20a967729645223d9356e7c3b51d61f66d3af19b23b5d7986be89696922f8f2678f0f1c99
-
Filesize
16KB
MD515911ad5c825d1c776e5ffd004694819
SHA16d11acc842ba943d168f8e4fafc0af7d1264b3b2
SHA256aaee755f5e4c0850b58f7cd429297556355dc5a6918ba9708b380f4198469fc6
SHA512fb2fdd6ffcfa6301d03d54279df11a961b0b69cb270a4d9fd067c9e045000e8366a94528404d345afa790c108394a0d5309febc8b9c528dab1e05ac3b0f7c97f
-
Filesize
26KB
MD543ec4b3c8c31d48c1e460948cdc726fd
SHA1a0e254741a96d60505eac3d6c097fe1c3289e5a2
SHA2561594b4f94c986cfd2198ce79f9db38772a545d8c1434c5b4b80c35eef585622b
SHA512029d77a51bf64a8ebd693f87bfa48edc048ea6ffae631e5fb4a191c36a044c2317d4ef6c43e5bf52e2115ef0167464b5772cc80e935ba17130c3a29bd19b7b50
-
Filesize
68KB
MD549d77cb6839e09ac1372ee9cdc3e1647
SHA148a658d959baeae511005a4b29691f278c6e8e28
SHA2562a0bb25673b65cb24eb46c2c9fbf8f1fe50e1738067bceef3241e6715444b184
SHA51200e349539caea86bb24a602a6b0b84bfe45110467a10ad7d4132079028382858b8255a4cb053fd2307a76693e4abbbfae8eb8cce086fa89e0d7dcf5f46a77e29
-
Filesize
17KB
MD50177f91ee5a61ef55168f513fe4c6ae8
SHA12b60c4c0894389ac0177085be89dff6f4041f32f
SHA256f1785075db3f0f1246d52426dd9a14be4dc6e92cbb32afe30d48a53f605642f6
SHA512eff66a28255b4441a50171fffd9612b5da67556b8ff4d23dc0781da2eb335f3e3a71710b46a15c22a7488ccef521c1dc9f8787c98e09c2e3b0ee2c71f232d08e
-
Filesize
16KB
MD56717c0eafc0d2e1a8f76161c51ac2f0e
SHA18fc0047ce7061f4e65ca78ad61914abf22c2de28
SHA2561f4f0d5a115e212b50a1217ebbc4c0529c8ca9ce27085f87d590157749e6f29e
SHA512871232d9e7e9792cd698e792f7958d014bcbdf0d96a8299ac9cabe7ab5cfd0c00d4566e393795030b498cf927093a3c8c2983e9f3b6002e609e15e117e2564ce
-
Filesize
29KB
MD59960a601ceb7c6320c532e4f58e4ee8c
SHA19f81591720bfa1866d0bc41fc34959a3dadbd49f
SHA25614066fe46ebfa62d05bcd587cd3686c6ff7325523108202bf49a068fbf7456b6
SHA512decc53e3d6b1a293c4599e6dd2880e5e0ddb0a7fc49391982bec25d6d72e45e35fcdee1331a32ef14edec63bae1a3eb8ce2afa93e1b59b0f3cb579610afeeb82
-
Filesize
46KB
MD5b93e65daab99851b6a74217ae40d7dc1
SHA1d6bdc4cfd7273484da5554252b479d88b098ad60
SHA25657a47479f84447e3b1c5eb55089e873f141eb568ffdb1b1b1e284389a03caae3
SHA512513ade7ccf9fc9222bc1f39a7db65b0acc67c6d26f12275280fc59eece0077156e052bce9e9495ba24389446db01c6270cf22fb29557864ed62d50051fbd925d
-
Filesize
29KB
MD5832cd343d1dea861cd025aaefa45175c
SHA1cb91664df00e3d3fb24aedafcbef6e7af8f9c6d9
SHA256b71dba0c68caca82d0ca202c7edfd182f2c802e7b2dcc18b805ef5a5f87768d7
SHA512350e270be4ffcf6b78d96155fe2c2d1d8c2f78f9877ca6ca2a9ebef415eebc83725522885898870fd0fa28b06571d013ec55dbc343a31677bc6f0869acc3a4a8
-
Filesize
20KB
MD54c18be066a5aad3f3d80307f03d288c7
SHA1b81a40ab9266645191f465816f4336f69ebf0fa2
SHA25610f8e63f4401db71007d628b4b75d0c089ac2ecd9640835ea1a7c931c5340eea
SHA5120eb5e8060b3ce7f2b87fb05e7894dc3d3c8e8d1a7312afe607174a29311fdfc5f61dee8605d9a3a8fa82ead27f02f0a96a75309a971841ff821ac046b9773267
-
Filesize
36KB
MD585b96fe3e4136da196554d8af57692f9
SHA1f8935ab1debd688ed9cff03d4344c959d154fb72
SHA256e614f718123c9a9c69b0a990c976b8ecc584e06f5ea451eda887bb53430f120a
SHA51291c3b8405badc3e51b17b140c24c626b9fed807d6a85138f65a6ca5e03f139750f32ca336698fbf8fc73045d39ed9e2bf4b4e3332601beebb0ea27c3d12fbe3a
-
Filesize
244KB
MD5969685661f3912c42f0a04cb45f6f909
SHA13ac19a75e9120fab368f1734f3776399a9052080
SHA256e3b90532a4d0d51de15e3972d0b3392f5a754adc76f56c6ab45af1d23abbc939
SHA512adb7b59d54f731f8a463d436efa95269bb8bad647eb2271dba01f57001d7856c2e4219418ca027039e81a8c3b2b3abd41232c0b0d89c963936a0edb46e2fefae
-
Filesize
29KB
MD53ac611d74f34152f657a5029f4fe8e50
SHA1d7aaef731820e4fcc24412e29a60120a9206af41
SHA25683a48763360b865e80bce96bbf7249605be78f5400886299b5c4f72c50461aad
SHA5127da6c62d5e809697c23ee1a1fdaa461c86e47896151cecbb49fe90a276e432665c8279817c2472a4b0ec57c9cf4c404fa9160d7c78e831fe152c32c70fdfd1c5
-
Filesize
32KB
MD56f4c016b3a5a887c52791fdf902d14e6
SHA1f87b09259b9824970b8f86f7e8a00843d2d3c51c
SHA2567482e7dc3ef778080f722ff1035a3fe705c3b5f0a60f29047514e79cbdb92ad4
SHA51226c97f558d11e4ae76c1da21e286408cee3be56b4b1afc195ed4baae453fe3d37ddf627710c36fe3a3fb667a9afacab5d6ba57a2cc6d7ce5c3f583b8ee150c1a
-
Filesize
20KB
MD57892c806b458b906ceaf5c4a5a1f3aa9
SHA1ad740a85501e6ab13ebe9a27714ead200f1c9207
SHA2561a09ddec40bff7d17729cdf6a20bc2358a281ff99cadf0ad156060abc65ba5ef
SHA5124f92dec9b5b181ebb21bf5381aec5a93bf9e4bfde9a86b71d4a42245ee5d38123ea09d9275066a5a1943768e89e39daddc428b94291b1edba0ce96bc0ad835ef
-
Filesize
54KB
MD58c1861ba129e692b4f20e673d17832e4
SHA178775c9f0d920057c1d2d06442972a3d1e098198
SHA2565c9b7c2a6435bdaee06cd92bee5b9c8b91bbe7d2430c194df6c9fccda427ef0d
SHA5125f03543efc1181143eb489fcf7dd0c096cf459dc9d6a1a6fbb2e9247521dc2307dbe9a60aeddda21a1a920026992637da9b84972f8f4b29d5d56def5ad67c048
-
Filesize
23KB
MD5fc9ad607786f1ad0027ae7eb9eef41b7
SHA19b053d27f1344fb396b20b04f92293373ea964e9
SHA2569995300fb68ab2fbff394c9fbf997132596203c8a3ad204b446240ffe9a8d49e
SHA512976b2ba14af114aa66ee9913d9b4f9a90b154ef6205ad7ad06f6fce0d1b0253de7c03db39f67d586d8bd1fc208df02c86ab89151c1e01843686118cf51341af2
-
Filesize
98KB
MD5d9560fa8fb28431f7146a281fd770a6b
SHA130b960d3c1c4220979ce96091181f393fc6dc6e6
SHA2566d0a01d37e8f912da66b23d1380806a83d77b585d3cef8605eff94a5eadab11f
SHA5123eadcbbb9910b25b7bf3503ba74d4f4101f21e67af254084de49dc795b829f331f796798eb3df8bd3eeb051f0eb180d187ccfd717abb86bfd814052ecea1b321
-
Filesize
199KB
MD57fc8e2eb6bb52f04f700dacbaa208d1d
SHA1b156d614377662534f7e00123456915383ae1d8b
SHA2563b4ac3184a00b5fa9192f3cf24e974bb80522356a155745f77947bf58554ca35
SHA512cba43d01d771accca66c37518d9947b1cdf13ae08f94f5e2be2837bf48ef07de0806348b1f14f22b78f332af06d81abe5be668ba63c27f335d41681f733a052c
-
Filesize
16KB
MD5521e7b64723470ff76443f0bba15c7e7
SHA11c7b71ef21d3bb352fcddb2279a098835a7ac9c5
SHA25611ec3e88359901c9f58e6c0c364e77cc89a75202ac1c7fa00b192e3561cc3ff6
SHA5124917518f40bedb06f1b0114fe402d104cfe6f24d8a251ed1856154ca9766602c9560911d2636b14c792d409bc9d3783d17bd8d8a7c4ddef896203d3b92a49e00
-
Filesize
45KB
MD5790eb156629d79db386677f624b71938
SHA14b44361b30e3c8c9e54f5b5f76c4094c67fe96c5
SHA256873242da1ca94f5bae022a2d313cb69816c80b7ae993718d11cf5c3dd41f78f3
SHA512ae18c557562f02db35715b02bc5e1d9856b08cd13a383d3dd9b5fba05384828597625b6474bd69a6fc56fae3f343f88243f613d2b449e1d2f6edeea8b3bb5b3b
-
Filesize
29KB
MD54c13ef3a01da3d0cf3dadea86f51e197
SHA1638a54a81ca96ad8e872281389834d6f05012de9
SHA25660ce8c72a04cb47be1208c4d67eb5b2a73b39c4417f9d21a47c76b383eea9bf8
SHA5129017601b2037083c1515becb7a1ae333fdad16113261461d4efe59037f19db7d64accdf5e23f3ba6207443017f93afe04461c532a51b1940da64772602ea1355
-
Filesize
439KB
MD5e0c4877c4dea4d2178d9d9cec6a1f77e
SHA1c84bb8fd0e4d9929a723f3c93aa71bbc36601d1a
SHA25664f6e8c4b5e9a2ec5fbb89aa6b6f45c75621214bae78c97bd75746a8b301402a
SHA512bcb99f2023402d6c7092837f871fc8941090e60160882ae0e1267a5d4b798b483bd46b0702af11fbcae8a159fc589879d25d23619dee75924949d18a504e6d1d
-
Filesize
122KB
MD560352e739dd03a17736ca07b087a13f6
SHA1e7d72040ab92ce6305062dc31b71b791a0f18184
SHA25617d4d2e8bd8da9e1aa1c426fefdb6e0fa6750441eedf0cc20a099a5fb6de2fa3
SHA51279840674b3690328f10d7856f9260aaa03966cfe58d7ed7c26eed80f8c7b8fe1a49d61c0e16095358b2730ecafd8a313c68a202cd165f6833972bfac2520e0de
-
Filesize
52KB
MD54ad614da4f0b0dc113b551cba2c84044
SHA14cd8a333a8721ed0a5b76694e341e5e910ff2a55
SHA256e78a917fc64d4619a35baaf34e8e4477e0e9543ef68384442c42e63f8b00b660
SHA512dcfae2683155c0afa52b87539e4bf9bea359c8eee6177b3879c3965f039c83fe7520dfdf3ca2f607554d24d27c8e446f0f5456608276ee3e6367b89627908584
-
Filesize
118KB
MD5c37c364701bb4a540b239a8de7c69cd8
SHA18f1cf1e2ed1b8ae081d360c1a1f556e4cc465efd
SHA256b8f1d7f37250b40d915dafa0f42c7c49a0d2a0d507f92a73abf24e6a41f446a8
SHA512d0e098260555f57d754c1222cb43b691c9c1491c00d10ccf63dc415ccb6ea26149ab5766196d16bb07d5dc5f7380173ea83bbbec5cd63299c7cef9cf54a8cfb2
-
Filesize
73KB
MD50f0f0b374a7f067aa1a8694a7df1dc47
SHA1329757c2275985574814c46730519cf05a518191
SHA2567a8ccf7de754070b0da6b914dbf77d0c17da4d019f363e44b856241c0bab340b
SHA51278ceefd5188d681d88c3960ec566d3006793019c3ab79ab635babd71e88bd7b18bba85b0d0d914cc200ef81c8d9e982a46b97b679d49c49543f9ef3753200fc8
-
Filesize
736KB
MD5b9c63cff858c2238c22d7665d28d3006
SHA11730050402e7cd9425a353aba9460ece437beb74
SHA256a1d75a3b301f6a57ebb760929b81624795731bca775e8ff381d1df030387adee
SHA5125539201ac8cc956123150e2915192155222dac4d7162e3af65ca5840bda7828fc7ac8ea9c2d56dcf3d53ac43ad6c82f9119a405d15e482d2f2f09c627a7ab4de
-
Filesize
31KB
MD5ed36d9326419383ca184637f315f1225
SHA1171a5100dedf6438917a2c4a977a720e5f92491c
SHA2562134ee796c25dc57a20a6fdb8acfe980e65b24b2f983994a6bcce1010d965640
SHA512e34cf5697017b5993be8d38d77bbd901ef2be2a994e888b9fe0e21173527f9dbec7c79e5b22fae0d29a4623da6a8688205d0dbe5a822e85f653e819ce6043ce1
-
Filesize
730KB
MD504770aea43497ce781e81306b6995cbf
SHA1fbd0e570e009d1d5ff6fe574c0812981bc2d4e9b
SHA2562ce632f0c94bab555e7c9f80cc667fa82639b3ed71738135fc3533959d4cbb63
SHA5120aacc20c052620bb2ad47ece32f5a1fae2cfc300bcc2c3addcba53980ec1248c3d8c0f8f453d8f88545f8fc77b31e50d1c347fd0b93b369d83fab2f27f7ea2be
-
Filesize
84KB
MD53af143569c11926f8234512961f146aa
SHA1896fca1611a8b2d319f6ea204bb7eb1f9e15a109
SHA25629aaaf1426a2e1c64b5f678e457d012970eb51fc961142039f02d7c2ffb64e92
SHA512f9e70a7c2e01b80f458c23402f5cefe17cc48840a2a4f307667b16419385fc188fa17e457a540f1ac1c439bf99313dedb51c7c2b01bd445ae3b46df2c696d838
-
Filesize
94KB
MD551ff720fd8b167ba5032ca5e1b459782
SHA1689abb1986e022b6a64fb7e8443da0677cbd16c2
SHA2567f33b541ee8bb1527e6126aa3bb1f9d825dd1af99da60bdc06e9a0a8c8ce98fe
SHA512de361fca9a180f96b574fe3ae8fc5399fbb7a05a70d5a7e00e3011a6f9f34c4fdf5779726a6909fed98011c9b37d3101366358ad31235eb34c7b150afd7d44d5
-
Filesize
218KB
MD56343d39899bd5751268f150784d81714
SHA1f25298db3413b44ba45f45192d5dc15b3f36dce8
SHA256bd52f306b38c3cd684b9f27c7d48335a3e94c3a94cf4db7df4a4ee9abc365ed4
SHA512ca2912ecf071fb3d8b2847e3aa2ac398fecbefc21d93dc9394a160dff2be49bee5e08ca8fbe92d2a4a5b45bae331c66f42095eb137be173d69b56993330e4c14
-
Filesize
352KB
MD5c372a9074bcd21c763f7d4e2d45301b8
SHA1007758036f473c7ffb8ba34ff9b271615d5074fc
SHA25633045d9d66544edfeccc53079114f44da9038aa3ca9459e57c42b3bfa5f5035f
SHA51278222b83a5d1baa9e84ca377367ec3efd74563c9a98ac65cbd1dc6ef2d9dbbee0258aa2700285823d25b1f9d3fef037e0243f656077c0ccec599ffe020889695
-
Filesize
404KB
MD55f4f8bc96b220903fbf5a97f77430657
SHA15bd21c1889473d927b7942f2f9fb3720a5bac7a4
SHA25634795272a59c14ea35dbe6089825b52d6551d0f9c2c4f0906e9726e195dd86f2
SHA51209d1dce470e81544a4c1e1211aa8e18d4079b83312c1897b13f0b43044b1088418e66f5f2012d4be6a0b2a0023633ad883f0d170624222821e7e7b6621287779
-
Filesize
488KB
MD57d6f8411fb2d606d0ce7e83273ba8e23
SHA1c92f9d1cb5494383300157be2a44083d85e4544a
SHA256cd275b71ea561b3f4288fc519f28dba7df7637d559facda590cb4ee4c881c709
SHA512e1dbf2e1c9c62236ea9eaa3a895b70f91d6ef2368c7ea2bb6c88ca59da6da8a7a26ce33af1e41a63dbc78e82c30d12eb23dd99e0fee9107b16ea933f45dccd9a
-
Filesize
45KB
MD51c7397dd806372d5cbe15b8bcb264064
SHA12ad1cb714f57b288d218081f2f9da6d7b00dba51
SHA256dbfceb23336b8f5e988c9d01b78aa4e232a28448b8744ddde64c01f2c2da7ba9
SHA512b934cbb00e24ca1e1eb628fc2371ff19f1e294040e459d70314694efd6d2f43693d4fa3a88b0c9dbb77ff13b638128df8e2b5b989b0006c68ffd3c05e183813d
-
Filesize
22KB
MD553ef5480c2d4954d02a71d3fae89c074
SHA105de881bed02284b648fd01dbbe08bcb23a119d5
SHA2563c2128c823fbb1d03dddac36748d51c1b072c43b7d0aa550c546080221567372
SHA512988b08b9d6b11904c99ebf1c8653f0fd1f2d4c3a6d88744756cb5136c049fecf73cd4c271dd1c3aa9d8f6c04396e5d8e4e8e2fafd7eaa9e16d9cd93fdad75326
-
Filesize
74KB
MD55c97a856978e7d5c24f4446da3731c37
SHA1c69fae8fb206fa623f953ad89547df83f61cc52f
SHA25635cb0c84c98d70427c1b268da17f2c17ae3ce17ac68cc76d0594d6ba1f04313c
SHA512ceb40ffbaf117c6e03a6b67298bf13849721b58bc6955ab25a1a6d232265b18863933521ef933a0f3c1432b1d031afc62464eb0f25820ee44c0437cd9dc5b66c
-
Filesize
2.9MB
MD5d76b7a7cf1321277f4d97e4951bf15fe
SHA15c5681c3047d5e56907d669a95c260dc621d9ca2
SHA2567bca8757e1bab2fb2ca111ee68e95f6735f7f4f332f9d8b9d5423494f46bde1d
SHA5120d81ca3ea7ab2838f4d1b39d539c87301995765eb3d5836772e38fd072e7ded8db4285b59d6bcec7252c2f15e7f372e72845a8b47570b812e04e7963451fec77
-
Filesize
55KB
MD5902ca6c64ad4f7782bec84b9c4dfd729
SHA10b3eead09a4a5044571dcd10a17668d7cb204cd2
SHA256669c00fddf717dc5207af1ed2284f30e2c3e7419959c7b738ead4d707e13acd3
SHA512be8aef38eeae1899deed24818d71f88b087aadd0034c880af3b443f33aec94d6f2e56678c64d05ea824be8d88af0c2530d7377b888fba66caf52bf0b63ec837e
-
C:\ProgramData\Avira\Security\Logs\Elevated\Sentry\Avira.Spotlight.UI.Application\Sentry\104358A6DC134E47715BA87A769BBF11E2563EAB\__processing\1733340408_-4338__6044116.envelope
Filesize366B
MD5200a7c27bf6cef98e0753ee6f3441393
SHA16ebaf74d39c26e6970bcc686c9cd870c110227e5
SHA256897b15b367ea60e4ae77144dd794d807e94ae3b3b70fc496f877ad941eb29e2a
SHA512bb27bf317e58e97dc14b01e205f5c6715f63a38a6ce51adc7c38d6932edbb2811f6c733e2c4cacf9940f8c76d5f842e6a88cfa2b9d133da70a4b8bddcbeaa762
-
Filesize
64KB
MD5fa9bf8231bb4bd11338d511b2cd72d22
SHA19f63385c05bab64111a828238dca98a90ce619ea
SHA2562be473fbdc6a58d03429b2b067fb1ad106126d5262bc1b2380c21172c5a02ff2
SHA512ae17738f3dddf8ab93e929b6e149911e976a6157c65008ba58ed9df2957a76a5d50567a2fca86f374acc67d9c036e12dae1376f0b84e7def96557da5b3126aac
-
Filesize
64KB
MD5faf1902b972c07e0fa4b95bfc51224d9
SHA113b422a3487a0121e19df17011a0f25d9de87db0
SHA256fa70650c5b39b0bf6d5cdfb5e053ea1e404a953a7da5006bd4f3ffdfa40e656a
SHA5129a674e7f58c666f10956abb91519000d9e15e0f6f7f89de42a0e531111bcf1e71aec308e70277776dc25a1a0b28f8500d8d0bed74f377772013665ceaf4c792a
-
Filesize
64KB
MD59e3080542f9c7f7f2a9b71f879f3746d
SHA1e1bf506d6c7987b851ab63e4226a2c0206f1081c
SHA256f44e38cfac6084c660bf9c6eb3d9f70cafd60f4a6b68e4ee55efb36f66c03a62
SHA51243d4768e5ef42cfdcc5ca089f8460e0c4a234ccfabab1daa9348c3c5e79bbcbd2a0827a9329a3c2aa8e1b2bb086785e839580cbe94945f9474812bdffe6e22e6
-
Filesize
56KB
MD5663ef5b94eb40fb61d8dfb98d6050d5b
SHA13e4c8d36eb3106e566f738d188fcaa6d4f516c33
SHA2561bb779ccbb2de287fb238945e9344991cdc8ced98d690c6ec2418bc931589917
SHA512aecb269344d7fe6aee41dd47e499e72a2572901d2c8ac94847655a7f1dd24abed82dea569e8f307aa1ef306e4fd3863bb7685468e34f34609b5ef4a2bb34da12
-
Filesize
1KB
MD51d3554048578b03f42424dbf20730a3f
SHA102faf3e291435468607857694df5e45b68851868
SHA256687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2
SHA51249dd7cce6f711ec3adff4608bad3afce9a85f7279e3fe1b5d8a87c6534a79090bd3cc897b57fd310cd7aef902b260d585fea1d3901526c874f935a3b990bf0dc
-
Filesize
955B
MD587ce0b7b2a0e4900e158719b37a89372
SHA10563b8630d62d75abbc8ab1e4bdfb5a899b24d43
SHA2563e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c
SHA512552cbdfbe33421b682ab9e42cafe274e9d6f55eb971d18d0ab9e68d1e6fb715b0580efecf84198a61a458d9f7656f4e485f2b2643d575f17269d613b95063407
-
Filesize
947B
MD579e4a9840d7d3a96d7c04fe2434c892e
SHA1a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c5436
SHA2564348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c70161
SHA51253b444e565183201a61eeb461209b2dc30895eeca487238d15a026735f229a819e5b19cbd7e2fa2768ab2a64f6ebcd9d1e721341c9ed5dd09fc0d5e43d68bca7
-
Filesize
1KB
MD578f2fcaa601f2fb4ebc937ba532e7549
SHA1ddfb16cd4931c973a2037d3fc83a4d7d775d05e4
SHA256552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988
SHA512bcad73a7a5afb7120549dd54ba1f15c551ae24c7181f008392065d1ed006e6fa4fa5a60538d52461b15a12f5292049e929cffde15cc400dec9cdfca0b36a68dd
-
Filesize
1KB
MD5ee2931bc327e9ae6e8b5f751b4347190
SHA1503006091d97d4f5ae39f7cbe7927d7d652d3431
SHA2566dc47172e01cbcb0bf62580d895fe2b8ac9ad4f873801e0c10b9c837d21eb177
SHA512ef7d8771b6c847a73556d612ad23e019c8bbabd5c9887884940b9a6a4532532c32eec9b56c1bbf44cb97a96a9d780b54b54801d1f5690a6fd528caa99dc49f54
-
Filesize
867B
MD5c5dfb849ca051355ee2dba1ac33eb028
SHA1d69b561148f01c77c54578c10926df5b856976ad
SHA256cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b
SHA51288289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da
-
Filesize
1KB
MD54fdd07e4d42264391e0c3742ead1c6ae
SHA18094640eb5a7a1ca119c1fddd59f810263a7fbd1
SHA2562cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf69
SHA512626261dcc0001d3bf73f9bd041067c78cbd19337c9dfcb2fb0854f24015efa662a7441dc5389de7c1ca4f464b44bf99b6df710661a9a8902ad907ee231dba74a
-
C:\Users\Admin\AppData\Local\Temp\is-PM8K0.tmp\Microsoft_Identity_Verification_Root_Certificate_Authority_2020.cer
Filesize1KB
MD5be954f16012122448ca8bc279602acf5
SHA1f40042e2e5f7e8ef8189fed15519aece42c3bfa2
SHA2565367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270
SHA512b617f4c211c33da258561c99812252fc9fa0446294680e3cd39689b1b4ba522b5bd3c03925582cb119fc4dff7cf0ed863832dc325d640bee759fea3da2118e09
-
Filesize
1KB
MD5e1c07ea0aabbd4b77b84c228117808a7
SHA1cdd4eeae6000ac7f40c3802c171e30148030c072
SHA256885de64c340e3ea70658f01e1145f957fcda27aabeea1ab9faa9fdb0102d4077
SHA512acb2da72502053e097f23bfe3af150018a57dab0ff286c36ed6216d21a4de1f81572c40cc1c2673370bbb102321d37276b033bddc191e607e91fe80df3f5e08e
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
Filesize
1KB
MD5ce0490d5e56c34a5ae0be98be581185d
SHA18f43288ad272f3103b6fb1428485ea3014c0bcfe
SHA256847df6a78497943f27fc72eb93f9a637320a02b561d0a91b09e87a7807ed7c61
SHA5122ebfc4c17e241a665f558bccb038a5fb10a73e05db552a31e3f0eae48a93c9617d2a4968f79da677dcbcdb1d7a140be9848aaba26161948d7db44b4eabbb0763
-
Filesize
1KB
MD51bfe69d191b71933a372a80fe155e5b5
SHA12b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e
SHA256e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd2
SHA51257e318d9ab26720f02ec18ba09cb640ace23554d2fe146d285bcc43c4d9601127fbe3dd9171cdafec70e075cf9412e8d1ac63ae0f982cf8825528659952a47bd
-
C:\Users\Admin\AppData\Local\Temp\is-PM8K0.tmp\VeriSign_Universal_Root_Certification_Authority_2008.cer
Filesize1KB
MD58eadb501aa4d81e48c1dd1e114009519
SHA13679ca35668772304d30a5fb873b0fa77bb70d54
SHA2562399561127a57125de8cefea610ddf2fa078b5c8067f4e828290bfb860e84b3c
SHA5127d53c0f0c95cb9126592201f67c66c987c3fa3d6e7dca5038f6eeb766aede597af975eb734853ec38ef1052dae1fea06bc3e9d8a03cacc0e46bb70614b475d91
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a54349f409082aca8afb58c9cb0a4310
SHA12924c6fd4423e27d8fe2a3dc86c4c90eced913b1
SHA256afdedc131a588095a8b4c23d640af4d8efa217a33b7f03b8bc1747c29ad6f5fc
SHA5124d1306432b10c8b1396b344f71ea0fb6833fd2060d3ae4e9af71f4cb8be16f8c5be71f9973d3a1642638005d0295c98b32344184bf8ceda128eeb26b3ee40c77
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d7b81b91c6b9e9514176f788c4fdea3
SHA1c262a6dbd0b97ad319c9cff160f3b5089ef6e425
SHA256bfd643a491a85b7abb6c57bd85e44071756bc50ec9c8569fba79c78978832169
SHA5123221cd8f1f5a1105f45b5795e9524125b9d9844814757d2788a35806adcba46bca5605849e38094e3f33ae34ac01ae1031d1cc1be2d00a63731ad724f8e76609
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a2a64401f653b990013ae00f592ffd9
SHA10d3cecda9aa7c1fe324798e5a7bff2cf2734325d
SHA256ff8c983186d3146f54406960a5ed91f530dddc05daa5d81668c3ed193367b3b9
SHA5128cebe14e5116e919d16145fbcc1f804ba8a6db8e710f0946d4739cc8c23302ecd1069930d6aa802e2b35522350f938009379a5c84b146335e48f589b07de9426
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da987a3f154066d7f994b1cd03b2c6ba
SHA187200effe5a83aa0c068633fe40689c7b0b1f3e2
SHA25630db00477c3a175b4c04d00f1635df57bb71324adbdb29f98db8955169865562
SHA512db55b2ea90ee39280a70c468e3752a17650b0e04d01144d4b20f6e3c2198960032e65eb5af6bf792cf60438bbb86273de075ae1abd880d1f30d211522a49683b
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5843f3c8d8d421a0125fc5b957ebeba54
SHA1d7ee7839b0980c6a85bf36850584beda40cce087
SHA256e406714b0d1612b746c8699f8f2fee8c5660182f8a7c83a07b77353c4bdda173
SHA5128adb07ff5aa4ec064105ae908ae10d9970f30d3a860b8a5579f21f0d5f8bcf12fd8534e7d007cf3d6b7967afdc5624373a30d0ff2aa3eaf8cba1934ecb78dc8c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535db7e07a7f55b05f4c7de91c5b6080e
SHA1d0a0ee78c0125278b1e14d224fef58dc5b33b0ea
SHA256d2dc0eba6438915ee5a4f57c206d5212f2524f704236a8332e06b5980be5ef3d
SHA512997bebc0cea6f280ef55316794908efc1946db45632f2096bc9cf6499c626e8c1d052dfc19e1798ccd4b1d34d1eda5e01a47bb79ecc8d7fd014f4d39be4abdfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad32686c9b3d935f3d4da168462cd83c
SHA16cd9374c9f8795a7048939ee6bd23a139f5f3e03
SHA25640053864508eafdbb793c6d68cdd3df3d51a41a0acc45b42a5bdb07fb51949dd
SHA5127dd3dbb5270768b33bf2227ae17b797d25d7919995d378c17d3e39f4ea7c13690fbc4ffd8dc7ae215d6287ff4ea6c778c3c6df8bf6e376391ed4a3d114ba9811
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ddc3bcce30ebebc7b7e1d042cd47bdcf
SHA1f42ead5a5faf202fd17fe07b4e1ce2427c10f722
SHA2568db3fb4c11c9147d311d8a43544e18d03e775937b677e1da1c978e7e2d0239dd
SHA5121d9e73a43c2be881d372971224a70830587030b91df4b71ae88c0aaea94a644f0d72b34eaf4ecd57b20b70596065cd4fad34d676ab5fe351f7ffe81597e80c46
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
259KB
MD5d18562371918ccf53bbec4734b3ff676
SHA1e194f235bd35253541613feb5238a6b1496dc431
SHA256670fd7c69b6d2e4cbdbb4bc14f2a1ce65851647a3a6b09232a594c8ea483d89a
SHA512071cbc8e23c429588401a4bac9733684e3433315dc05b3506f7cb5fe3135452d497c4dbe0bc8c570a3c285ff725e40a3fd5b1c8e4f7d196b5a28d507fd8354ac
-
Filesize
223KB
MD555eea39b5da63cb85fbcaaa06a17370a
SHA1a4cb7909bde40d0b88c4d7bca0472cf5a3a1c2ec
SHA256938f5c8e5059c6b55f3e45621e96d677fa4d5012b80b75b37a00ac487f71171d
SHA5122b20e6d964a04b30f7756428ca19dd09dd7442fc3288275123986d0ad3d842b1ee584aa5131ecf8a335d8d7ab6deb1a9f86f05bf6419664a6915b4a7092c2d71
-
Filesize
3.1MB
MD5b8ef696560b62698f63bfbadd5ad6346
SHA194fda69817c7ac2611ba33a0e835d27cc7c70e60
SHA25669cc05a881222d4a89e9f89daa97637ff6514a12da05dbc060e9e8afc1fac3d7
SHA51255529647368dbd34cd0e29989c89c5647004c9f883111a364de3144ca158ff1382acb2460bfbe2d73f519c8bd5536a85da1182e4f60a851bff718ca0747d2815