File name:

rootsupd.exe

Full analysis: https://app.any.run/tasks/45c5e85f-a65a-4f8e-80a9-394853cf5685
Verdict: Malicious activity
Analysis date: September 17, 2019, 11:23:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, MS CAB-Installer self-extracting archive
MD5:

22A4AC3835595D84FE5B155C1E146481

SHA1:

9232833004CF02135DBA887D2037C4487FADD42D

SHA256:

D7A732A4234DA5A1F703B013E90B9531EFEB60C05B6AD0ADF98C9F87D2087F5A

SSDEEP:

6144:7Vq4HkfCtlgiSRLofDHISkGUNSxZso0zza61deVuXrWBL5UweI0rAF3moD:BkfWqiRiNs0n9deVvBlU3AF3m

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • updroots.exe (PID: 3692)
      • updroots.exe (PID: 2700)
      • updroots.exe (PID: 3756)
      • updroots.exe (PID: 2728)

    • Loads dropped or rewritten executable

      • rootsupd.exe (PID: 2288)

    • Changes the autorun value in the registry

      • rootsupd.exe (PID: 2288)

    • Changes settings of System certificates

      • updroots.exe (PID: 3756)
      • updroots.exe (PID: 3692)
      • updroots.exe (PID: 2700)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • rootsupd.exe (PID: 2288)

    • Adds / modifies Windows certificates

      • updroots.exe (PID: 3692)
      • updroots.exe (PID: 2700)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 MS Cabinet Self-Extractor (WExtract stub) (80.4)
.exe | Win32 Executable MS Visual C++ (generic) (8.2)
.exe | Win64 Executable (generic) (7.3)
.dll | Win32 Dynamic Link Library (generic) (1.7)
.exe | Win32 Executable (generic) (1.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2006:11:02 09:49:24+01:00
PEType: PE32
LinkerVersion: 8
CodeSize: 43520
InitializedDataSize: 370176
UninitializedDataSize: -
EntryPoint: 0x6b24
OSVersion: 6
ImageVersion: 6
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 6.0.6000.16386
ProductVersionNumber: 6.0.6000.16386
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 6.0.6000.16386 (vista_rtm.061101-2205)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.0.6000.16386

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 02-Nov-2006 08:49:24
Detected languages:
  • English - United States
Debug artifacts:
  • wextract.pdb
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 6.0.6000.16386 (vista_rtm.061101-2205)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: WEXTRACT.EXE
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.0.6000.16386

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 02-Nov-2006 08:49:24
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0000A9A0
0x0000AA00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.5151
.data
0x0000C000
0x00002260
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
6.59775
.rsrc
0x0000F000
0x0005A000
0x00059200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.86618
.reloc
0x00069000
0x00000C48
0x00000E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
4.8336

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.44031
1072
Latin 1 / Western European
English - United States
RT_VERSION
63
2.48958
140
Latin 1 / Western European
English - United States
RT_STRING
76
3.2674
1312
Latin 1 / Western European
English - United States
RT_STRING
77
3.29977
1484
Latin 1 / Western European
English - United States
RT_STRING
80
3.27174
1200
Latin 1 / Western European
English - United States
RT_STRING
83
3.2912
1098
Latin 1 / Western European
English - United States
RT_STRING
85
3.13591
974
Latin 1 / Western European
English - United States
RT_STRING
2001
3.25575
754
Latin 1 / Western European
English - United States
RT_DIALOG
2002
3.16025
432
Latin 1 / Western European
English - United States
RT_DIALOG
2003
2.99713
358
Latin 1 / Western European
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
USER32.dll
VERSION.dll
msvcrt.dll
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start start rootsupd.exe updroots.exe no specs updroots.exe no specs updroots.exe no specs updroots.exe no specs rootsupd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2288"C:\Users\admin\AppData\Local\Temp\rootsupd.exe" C:\Users\admin\AppData\Local\Temp\rootsupd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
6.0.6000.16386 (vista_rtm.061101-2205)
Modules
Images
c:\users\admin\appdata\local\temp\rootsupd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2700C:\Users\admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sstC:\Users\admin\AppData\Local\Temp\IXP000.TMP\updroots.exe—rootsupd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
UPDROOTS
Exit code:
0
Version:
5.1.2484.0 (main.010529-2005)
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\updroots.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2728C:\Users\admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sstC:\Users\admin\AppData\Local\Temp\IXP000.TMP\updroots.exe—rootsupd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\updroots.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3692C:\Users\admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sstC:\Users\admin\AppData\Local\Temp\IXP000.TMP\updroots.exe—rootsupd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
UPDROOTS
Exit code:
0
Version:
5.1.2484.0 (main.010529-2005)
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\updroots.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3756C:\Users\admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sstC:\Users\admin\AppData\Local\Temp\IXP000.TMP\updroots.exe—rootsupd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
UPDROOTS
Exit code:
0
Version:
5.1.2484.0 (main.010529-2005)
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\updroots.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3800"C:\Users\admin\AppData\Local\Temp\rootsupd.exe" C:\Users\admin\AppData\Local\Temp\rootsupd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
3221226540
Version:
6.0.6000.16386 (vista_rtm.061101-2205)
Modules
Images
c:\users\admin\appdata\local\temp\rootsupd.exe
c:\systemroot\system32\ntdll.dll
Total events
382
Read events
0
Write events
361
Delete events
21

Modification events

(PID) Process:(3692) updroots.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\879F4BEE05DF98583BE360D633E70D3FFE9871AF
Operation:writeName:Blob
Value:
0B00000001000000540000004E00650074004C006F0063006B00200055007A006C006500740069002000280043006C006100730073002000420029002000540061006E007500730069007400760061006E0079006B006900610064006F00000009000000010000004A000000304806082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030706082B06010505070306060A2B0601040182370A030406082B06010505070308030000000100000014000000879F4BEE05DF98583BE360D633E70D3FFE9871AF20000000010000004F0500003082054B308204B4A003020102020169300D06092A864886F70D0101040500308199310B30090603550406130248553111300F06035504071308427564617065737431273025060355040A131E4E65744C6F636B2048616C6F7A617462697A746F6E73616769204B66742E311A3018060355040B131154616E7573697476616E796B6961646F6B31323030060355040313294E65744C6F636B20557A6C6574692028436C6173732042292054616E7573697476616E796B6961646F301E170D3939303232353134313032325A170D3139303232303134313032325A308199310B30090603550406130248553111300F06035504071308427564617065737431273025060355040A131E4E65744C6F636B2048616C6F7A617462697A746F6E73616769204B66742E311A3018060355040B131154616E7573697476616E796B6961646F6B31323030060355040313294E65744C6F636B20557A6C6574692028436C6173732042292054616E7573697476616E796B6961646F30819F300D06092A864886F70D010101050003818D0030818902818100B1EA04EC20A023C28F3860CFC746B3D51BFEFBB9999E04DC1C7F8C4A8198EEA4D4CA8A17B9227F830A754C9BC069D86439A3ED92A3FD5B5C741AC047CA3A69769ABAE24417FC4CA3D5FEB89788AF8803891FA4F2043EC8070BE6F9B32F7A6214094614CA64F58B80B562A8D86BD671932DB3BF095458ED06EBA87BDC43B1A1690203010001A382029F3082029B30120603551D130101FF040830060101FF020104300E0603551D0F0101FF040403020006301106096086480186F84201010404030200073082026006096086480186F842010D048202511682024D46494759454C454D2120457A656E2074616E7573697476616E792061204E65744C6F636B204B66742E20416C74616C616E6F7320537A6F6C67616C7461746173692046656C746574656C656962656E206C6569727420656C6A617261736F6B20616C61706A616E206B65737A756C742E204120686974656C65736974657320666F6C79616D617461742061204E65744C6F636B204B66742E207465726D656B66656C656C6F737365672D62697A746F73697461736120766564692E2041206469676974616C697320616C616972617320656C666F6761646173616E616B2066656C746574656C6520617A20656C6F69727420656C6C656E6F727A65736920656C6A61726173206D6567746574656C652E20417A20656C6A61726173206C656972617361206D656774616C616C6861746F2061204E65744C6F636B204B66742E20496E7465726E657420686F6E6C61706A616E20612068747470733A2F2F7777772E6E65746C6F636B2E6E65742F646F63732063696D656E2076616779206B65726865746F20617A20656C6C656E6F727A6573406E65746C6F636B2E6E657420652D6D61696C2063696D656E2E20494D504F5254414E5421205468652069737375616E636520616E642074686520757365206F662074686973206365727469666963617465206973207375626A65637420746F20746865204E65744C6F636B2043505320617661696C61626C652061742068747470733A2F2F7777772E6E65746C6F636B2E6E65742F646F6373206F7220627920652D6D61696C20617420637073406E65746C6F636B2E6E65742E300D06092A864886F70D01010405000381810004DBAE8C17AFF80E90314ECD3E09C06D3AB0F8334C474CE375881097ACB0381591C62996CC21C06D3CA574CFD882A539C365E34270BB2290E37DDB3576E1A0B5DA9F706E931A30391D30DB2EE37CB291B2D13729FAB9D6175C474FE31D38EB9FD57B95A8289E154AD1D1D02B0097A0E292362B63AC58016B3329508683F10148
(PID) Process:(3692) updroots.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46
Operation:writeName:Blob
Value:
0B00000001000000140000005500530045005200540072007500730074000000090000000100000022000000302006082B0601050507030306082B06010505070308060A2B0601040182370A0304030000000100000014000000E12DFB4B41D7D9C32B30514BAC1D81D8385E2D4620000000010000006A040000308204663082034EA003020102021044BE0C8B500024B411D3362DE0B35F1B300D06092A864886F70D0101050500308195310B3009060355040613025553310B3009060355040813025554311730150603550407130E53616C74204C616B652043697479311E301C060355040A131554686520555345525452555354204E6574776F726B3121301F060355040B1318687474703A2F2F7777772E7573657274727573742E636F6D311D301B0603550403131455544E2D5553455246697273742D4F626A656374301E170D3939303730393138333132305A170D3139303730393138343033365A308195310B3009060355040613025553310B3009060355040813025554311730150603550407130E53616C74204C616B652043697479311E301C060355040A131554686520555345525452555354204E6574776F726B3121301F060355040B1318687474703A2F2F7777772E7573657274727573742E636F6D311D301B0603550403131455544E2D5553455246697273742D4F626A65637430820122300D06092A864886F70D01010105000382010F003082010A0282010100CEAA813FA3A36178AA31005595119E270F1F1CDF3A9B826830C04A611DF12F0EFABE79F7A523EF55519684CDDBE3B96E3E31D80A2067C7F4D9BF94EB47043E02CE2AA25D870409F6309D188A97B2AA1CFC41D2A136CBFB3D91BAE7D97035FAE4E790C39BA39BD33CF5129977B1B709E068E61CB8F39463886A6AFE0B76C9BEF422E467B9AB1A5E77C18507DD0D6CBFEE06C7776A419EA70FD7FBEE9417B7FC85BEA4ABC41C31DDD7B6D1E4F0EFDF168FB25293D7A1D489A1072EBFE10112421E1AE1D89534DB647928FFBA2E11C2E5E85B9248FB470BC26CDAAD328341F3A5E54170FD65906DFAFA51C4F9BD962B19042CD36DA7DCF07F6F8365E26AAB8786750203010001A381AF3081AC300B0603551D0F0404030201C6300F0603551D130101FF040530030101FF301D0603551D0E04160414DAED6474149C143CABDD99A9BD5B284D8B3CC9D830420603551D1F043B30393037A035A0338631687474703A2F2F63726C2E7573657274727573742E636F6D2F55544E2D5553455246697273742D4F626A6563742E63726C30290603551D250422302006082B0601050507030306082B06010505070308060A2B0601040182370A0304300D06092A864886F70D01010505000382010100081F52B1374478DBFDCEB9DA959698AA556480B55A40DD21A5C5C1F35F2C4CC8475A69EAE8F03535F4D025F3C8A6A4874ABD1BB17308BDD4C3CAB635BB59867731CDA78014AE13EFFCB148F96B25252D51B62C6D45C198C88A565D3EEE434E3E6B278ED03A4B850B5FD3ED6AA775CBD15A872F3975135A72B002819FBEF00F845420626C69D4E14DC60D9943010D12968C789DBF50A2B144AA6ACF177ACF6F0FD4F824555FF0341649663E5046C96371383162B862B9F353AD6CB52BA212AA194F09DA5EE793C68E1408FEF0308018A086854DC87DD78B03FE6ED5F79D16AC922CA023E59C91521F94DF179473C3B3C1C17105200078BD13521DA83ECD001FC8
(PID) Process:(3692) updroots.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0483ED3399AC3608058722EDBC5E4600E3BEF9D7
Operation:writeName:Blob
Value:
53000000010000002600000030243022060C2B06010401B231010201050130123010060A2B0601040182373C0101030200C00B00000001000000140000005500530045005200540072007500730074000000090000000100000020000000301E06082B0601050507030106082B0601050507030706082B060105050703060300000001000000140000000483ED3399AC3608058722EDBC5E4600E3BEF9D7200000000100000078040000308204743082035CA003020102021044BE0C8B500024B411D3362AFE650AFD300D06092A864886F70D0101050500308197310B3009060355040613025553310B3009060355040813025554311730150603550407130E53616C74204C616B652043697479311E301C060355040A131554686520555345525452555354204E6574776F726B3121301F060355040B1318687474703A2F2F7777772E7573657274727573742E636F6D311F301D0603550403131655544E2D5553455246697273742D4861726477617265301E170D3939303730393138313034325A170D3139303730393138313932325A308197310B3009060355040613025553310B3009060355040813025554311730150603550407130E53616C74204C616B652043697479311E301C060355040A131554686520555345525452555354204E6574776F726B3121301F060355040B1318687474703A2F2F7777772E7573657274727573742E636F6D311F301D0603550403131655544E2D5553455246697273742D486172647761726530820122300D06092A864886F70D01010105000382010F003082010A0282010100B1F7C3383FB4A87FCF39825167D06D9FD2FF58F3E79F2BEC0D895499B9389916F7E0217948C2BB617412961D3C6A72D53C10673A39ED2B13CD66EB950933A46C97B1E8C6ECC175799C465E8DABD06AFDB92A55171054B319F09AF6F1B15DB6A76DFBE071176BA288FB00DFFE1A31770C9A017AB132E32B0107386EC3A55E23BC459B7B50C1C9308FDBE52B7AD35BFB33401EA0D59817BC8B87C389D35DA08EB2AAAAF68E698806C5FA8921F3089D692E09339B290D460F8CCC4934B06951BDF906CD68AD664CBC3EAC61BD0A880EC8DF3DEE7C044C9D0A5E6B91D6EEC7ED288DAB4D878973D06EA4D01E168B14E17644037F63ACE4CD499CC592F4AB32A1485B0203010001A381B93081B6300B0603551D0F0404030201C6300F0603551D130101FF040530030101FF301D0603551D0E04160414A1725F261B289843955D0737D585969D4BD2C34530440603551D1F043D303B3039A037A0358633687474703A2F2F63726C2E7573657274727573742E636F6D2F55544E2D5553455246697273742D48617264776172652E63726C30310603551D25042A302806082B0601050507030106082B0601050507030506082B0601050507030606082B06010505070307300D06092A864886F70D0101050500038201010047190FDE74C69997AFFCAD285E758EEB2D67EE4E7B2BD70CFFF6DECB55A20AE14C546593606B9F129CAD5E832CEB5AAEC0E42DF400631DB8C06CF2CF49BB4D936F06A60A22B24962084EFFC8C814B288165DE701E41295E54534B38B69BDCFB4858F75519E7D3A383A144812C6FBA73B1A8D0D824007E8040890A189CB1950DFCA1C01BC1D04197B1076973BEE9090CAC40E1F166E75EF33F8D36F5B1E96E3E07477747B8AA26E2DDD76D6393082F0AB9C52F22AC7AF495E7EC768E58281C86A27F927882AD55850951FF03B1C57BB7D1439622B9AC994922AA3220CFF89267D5F232B47D7151DA96A9E510D2A519E81F9D43B5E70127F10329C1EBB9DF866A8
(PID) Process:(3692) updroots.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\58119F0E128287EA50FDD987456F4F78DCFAD6D4
Operation:writeName:Blob
Value:
53000000010000002600000030243022060C2B06010401B231010201050130123010060A2B0601040182373C0101030200C00B0000000100000014000000550053004500520054007200750073007400000009000000010000000C000000300A06082B0601050507030103000000010000001400000058119F0E128287EA50FDD987456F4F78DCFAD6D42000000001000000620400003082045E30820346A003020102021044BE0C8B500021B411D32A6806A9AD69300D06092A864886F70D0101050500308193310B3009060355040613025553310B3009060355040813025554311730150603550407130E53616C74204C616B652043697479311E301C060355040A131554686520555345525452555354204E6574776F726B3121301F060355040B1318687474703A2F2F7777772E7573657274727573742E636F6D311B30190603550403131255544E202D2044415441436F727020534743301E170D3939303632343138353732315A170D3139303632343139303633305A308193310B3009060355040613025553310B3009060355040813025554311730150603550407130E53616C74204C616B652043697479311E301C060355040A131554686520555345525452555354204E6574776F726B3121301F060355040B1318687474703A2F2F7777772E7573657274727573742E636F6D311B30190603550403131255544E202D2044415441436F72702053474330820122300D06092A864886F70D01010105000382010F003082010A0282010100DFEE5810A22B6E55C48EBF2E4609E7E0080F2E2B7A13941BBDF6B6808E650593001EBCAFE20F8E190D1247ECACADA3FA2E70F8DE6EFB5642159E2E5CEF23DE21B9057627190F4FD6C39CB4BE941963F2A6110AEB53489CBEF2293B16E81AA04CA6C9F4185968C070F25300C05E5082A5566F36F94AE04486A04D4ED6476E494ACB67D7A6C405B98E1EF4FCFFCDE736E09C056CB2332215D0B4E0CC17C0B2C0F4FE323F292A957BD8F2A74E0F547CA10D80B30903C1FF5CDD5E9A3EBCAEBC478A6AAE71CA1FB12AB85F42050BEC4630D1720BCAE9566DF5EFDF78BE61BAB2A5AE044CBCA8AC691597BDEFEBB48CBF35F8D4C3D1280E5C3A9F7018332077C4A2AF0203010001A381AB3081A8300B0603551D0F0404030201C6300F0603551D130101FF040530030101FF301D0603551D0E041604145332D1B3CF7FFAE0F1A05D854E92D29E451DB44F303D0603551D1F043630343032A030A02E862C687474703A2F2F63726C2E7573657274727573742E636F6D2F55544E2D44415441436F72705347432E63726C302A0603551D250423302106082B06010505070301060A2B0601040182370A030306096086480186F8420401300D06092A864886F70D01010505000382010100273597008A8B28BDC633301E29FCE2F7D598D440BB60CABFAB172C09367F50FA41DCAE963A0A233E8959C9A307ED1B37ADFC7CBE51495ADE3A0A54081645C299B187CD8C68E06903E9C44E98B23B8C16B30EA00C98509B93A97009C82CA38FDF02E4E0713AF1B42372A0AA01DFDF983E1450A03126BD28E95A302675F97B601C8DF3CD50266D04279ADFD50D4547296B2CE676D9A9297D32DDC9363CBDAE35F1119E1DBB903F12474E8ED77E0F62731D5226381C1849FD30749AC4E5222FD8C08DED917A4C008F727F5DDADD1B8B456BE7DD6997A8C5564C0F0CF69F7A9137F69782E0DD7169FF763F604D3CCFF799F9C657F4C9553978BA2C79C9A6882BF408
(PID) Process:(3692) updroots.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D29F6C98BEFC6D986521543EE8BE56CEBC288CF3
Operation:writeName:Blob
Value:
0B000000010000003400000054004300200054007200750073007400430065006E00740065007200200043006C00610073007300200034002000430041000000090000000100000016000000301406082B0601050507030406082B06010505070301030000000100000014000000D29F6C98BEFC6D986521543EE8BE56CEBC288CF32000000001000000600300003082035C308202C5A003020102020203EC300D06092A864886F70D01010405003081BC310B30090603550406130244453110300E0603550408130748616D627572673110300E0603550407130748616D62757267313A3038060355040A1331544320547275737443656E74657220666F7220536563757269747920696E2044617461204E6574776F726B7320476D624831223020060355040B1319544320547275737443656E74657220436C61737320342043413129302706092A864886F70D010901161A636572746966696361746540747275737463656E7465722E6465301E170D3938303330393131353935395A170D3131303130313131353935395A3081BC310B30090603550406130244453110300E0603550408130748616D627572673110300E0603550407130748616D62757267313A3038060355040A1331544320547275737443656E74657220666F7220536563757269747920696E2044617461204E6574776F726B7320476D624831223020060355040B1319544320547275737443656E74657220436C61737320342043413129302706092A864886F70D010901161A636572746966696361746540747275737463656E7465722E646530819F300D06092A864886F70D010101050003818D0030818902818100BF2F63D6367BB20DD355F5646CE6255DC6B4C814BA253883EB5662A555A965A3F42399C24BB9D0CD5467A6A3A0A3A9332B76E4BDAD77B2ED5C1274C3C5B60F529A729343906266150F45A5DDE0DDB86F406E57C17972A360AABA761D1289535AFC02BEE10913C54A2FDC3D8B19ADD78B2445FB4CF4CD5C351D294C51F3F26C550203010001A36B3069300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020186303306096086480186F842010804261624687474703A2F2F7777772E747275737463656E7465722E64652F67756964656C696E6573301106096086480186F8420101040403020007300D06092A864886F70D0101040500038181007211E595414532BA1CF88014FB66B7EBAE9ACE758351C0AE8ABB17D128E7761F13C62B4671A615770499E75EB291246F030C73E7239E76CABE0CC5CBC49018FC6D3A6EE056801BC3DF8C361347F965C18352D55C5CBDD94266E13521681210A460903E3F81E8C38CA1B015045ACEEB2C54564BF904792D9DEA8C592FAD79BD48
(PID) Process:(3692) updroots.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\838E30F77FDD14AA385ED145009C0E2236494FAA
Operation:writeName:Blob
Value:
0B000000010000003400000054004300200054007200750073007400430065006E00740065007200200043006C00610073007300200032002000430041000000090000000100000016000000301406082B0601050507030406082B06010505070301030000000100000014000000838E30F77FDD14AA385ED145009C0E2236494FAA2000000001000000600300003082035C308202C5A003020102020203EA300D06092A864886F70D01010405003081BC310B30090603550406130244453110300E0603550408130748616D627572673110300E0603550407130748616D62757267313A3038060355040A1331544320547275737443656E74657220666F7220536563757269747920696E2044617461204E6574776F726B7320476D624831223020060355040B1319544320547275737443656E74657220436C61737320322043413129302706092A864886F70D010901161A636572746966696361746540747275737463656E7465722E6465301E170D3938303330393131353935395A170D3131303130313131353935395A3081BC310B30090603550406130244453110300E0603550408130748616D627572673110300E0603550407130748616D62757267313A3038060355040A1331544320547275737443656E74657220666F7220536563757269747920696E2044617461204E6574776F726B7320476D624831223020060355040B1319544320547275737443656E74657220436C61737320322043413129302706092A864886F70D010901161A636572746966696361746540747275737463656E7465722E646530819F300D06092A864886F70D010101050003818D0030818902818100DA38E8ED3200297183010DBF8C01DCDAC6AD39A4A98A2FD58B5C685F50C662F566BDCA9122ECAA1D51D73DB351B2834E5DCB49B0F04C55E56B2DC7850B301C924E82D4CA02EDF76FBEDCE0E314B80553F29AF4568B5A9E8593D1B48256AE4DBBA84B5716BCFEF8589EF8298DB07BCD78C94FAC8B670CF19CFBFC579B575C4F0D0203010001A36B3069300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020186303306096086480186F842010804261624687474703A2F2F7777772E747275737463656E7465722E64652F67756964656C696E6573301106096086480186F8420101040403020007300D06092A864886F70D0101040500038181008452FB28DFFF1F7501BC01BE0456976A7442243183F946B1068A89CF962C33BF8CB55F7A72A18506CE86F8058EE8F925CADA838C06ACEB366D8591340436F442F0F8792E0A485CABCC514F7876A0D9AC19BD2AD169042891CA36102780575BD25CF5C25BAB6481637451F497BFCD1228F74D667FA7F01C012678B26647705164
(PID) Process:(3692) updroots.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7AC5FFF8DCBC5583176877073BF751735E9BD358
Operation:writeName:Blob
Value:
0B000000010000002A0000005300650063007500720065004E0065007400200043004100200043006C00610073007300200042000000090000000100000016000000301406082B0601050507030406082B060105050703010300000001000000140000007AC5FFF8DCBC5583176877073BF751735E9BD3582000000001000000DD020000308202D9308201C1A003020100020100300D06092A864886F70D0101040500302C310B3009060355040613026175311D301B060355040A13145365637572654E657420434120436C6173732042302617113939303633303030303030302B3130303017113039313031353233353930302B31303030302C310B3009060355040613026175311D301B060355040A13145365637572654E657420434120436C617373204230820122300D06092A864886F70D01010105000382010F003082010A0282010100A663D9C6155A76E74665C73491F97BDD56BBF896352E29CAA77D0A1EF73152E85AC8D3CF39014E5BF01FB1B84AD2B34743663F01404E3049E10FFDEB126378CCF6166218F56F69FD7E6E337621A3C0880FEAE625FCA997CC1872C731B60B9BCDC2C578616345AC34A6277868C4BD5268CE844DD224A5286C80E6CAE6CFE69A9E5078CEF336D2A3435A1C06AFCB20EED02CC44418906CB1916465B9B785834BA89199C5E09CF7B850D7D3B04F9AED63FB4DF4D428243A805B7B938CC50584AF3B86FE8131C7B69D5F1AEA907BB0465EB2085200570D55528378954AFD688F9ED950B64B53FAF28502954E38F583A796D4313F3FA7CA3753DCC52F6D1A74A6CCBF0203010001300D06092A864886F70D010104050003820101004B46A6225AE9D1A5E4108F4C5360E34D5486DEBA1CAA2A5A36081D4A0B49A1EFAABDBC2632A4FF734030240FECAB11D5CBAFC44B9BE71E1CC35085BA4F082B2F3F1423AAF6839986BE467811152B9AE4A3BF7DE98D7EF967DF3E7FE6AD46E76065675FE580F32CBB5367736FE0AE97126D49181C684CB32CF35AC13531F6ECE93EA7CBCD5450875845C014D548B6F3288E3A1829E89A99F1E0F5A3CB08B47D782513E134CE689BDAB722211B3452CBEF53E2F3D70C62DAB1454145B897582C086245230E5995351A0E44C751704E3F04AD26C21DED0F482D55131D71A2A70EB32F876FB0EEE5C7368B2C715140871ACE56143929EF250A800A199DF5569FDD8A
(PID) Process:(3692) updroots.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\99A69BE61AFE886B4D2B82007CB854FC317E1539
Operation:writeName:Blob
Value:
53000000010000002400000030223020060A6086480186FA6C0A010230123010060A2B0601040182373C0101030200C00B000000010000001000000045006E0074007200750073007400000009000000010000005E000000305C06082B0601050507030106082B0601050507030206082B0601050507030306082B0601050507030406082B0601050507030606082B0601050507030706082B0601050508020206082B06010505070308060A2B0601040182370A030403000000010000001400000099A69BE61AFE886B4D2B82007CB854FC317E15392000000001000000DC040000308204D830820441A0030201020204374AD243300D06092A864886F70D01010505003081C3310B300906035504061302555331143012060355040A130B456E74727573742E6E6574313B3039060355040B13327777772E656E74727573742E6E65742F43505320696E636F72702E206279207265662E20286C696D697473206C6961622E2931253023060355040B131C286329203139393920456E74727573742E6E6574204C696D69746564313A303806035504031331456E74727573742E6E657420536563757265205365727665722043657274696669636174696F6E20417574686F72697479301E170D3939303532353136303934305A170D3139303532353136333934305A3081C3310B300906035504061302555331143012060355040A130B456E74727573742E6E6574313B3039060355040B13327777772E656E74727573742E6E65742F43505320696E636F72702E206279207265662E20286C696D697473206C6961622E2931253023060355040B131C286329203139393920456E74727573742E6E6574204C696D69746564313A303806035504031331456E74727573742E6E657420536563757265205365727665722043657274696669636174696F6E20417574686F7269747930819D300D06092A864886F70D010101050003818B0030818702818100CD288334541B89F30FAF379131FFAF3160C9A8E8B21068ED9FE79336F10A64BB47F504173F23474DC5271981260C54720D882DD91F9A129FBCB371D380193F47667B8C3528D2B90ADF24DA9CD65079817A5AD337F7C24AD829922664D1E4986C3A008AF5349B65F8EDE310FFFDB84958DCA0DE82396B81B1161961B954B6E643020103A38201D7308201D3301106096086480186F8420101040403020007308201190603551D1F048201103082010C3081DEA081DBA081D8A481D53081D2310B300906035504061302555331143012060355040A130B456E74727573742E6E6574313B3039060355040B13327777772E656E74727573742E6E65742F43505320696E636F72702E206279207265662E20286C696D697473206C6961622E2931253023060355040B131C286329203139393920456E74727573742E6E6574204C696D69746564313A303806035504031331456E74727573742E6E657420536563757265205365727665722043657274696669636174696F6E20417574686F72697479310D300B0603550403130443524C313029A027A0258623687474703A2F2F7777772E656E74727573742E6E65742F43524C2F6E6574312E63726C302B0603551D1004243022800F31393939303532353136303934305A810F32303139303532353136303934305A300B0603551D0F040403020106301F0603551D23041830168014F0176213553DB3FF0A006BFB508497F3ED62D01A301D0603551D0E04160414F0176213553DB3FF0A006BFB508497F3ED62D01A300C0603551D13040530030101FF301906092A864886F67D074100040C300A1B0456342E3003020490300D06092A864886F70D01010505000381810090DC3002FA6474C2A70AA57C218D3417A8FB470EFF257C8D130AFBE498B5EF8CF8C5100DF792BEF1C3D5D5956A04BB2CCE263665C831C6E7EE3FE35775847A11EF464F18F4D398BBA88732BA72F63CE23D9FD71DD9C360438C580E22962F62A32C1FBAAD05EFAB327887A0547319B55C05F9523E6D2D450BF70A93EAED06F9B2
(PID) Process:(3692) updroots.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F44095C238AC73FC4F77BF8F98DF70F8F091BC52
Operation:writeName:Blob
Value:
0B000000010000003C000000430065007200740050006C0075007300200043006C00610073007300200033005400530020005000720069006D006100720079002000430041000000090000000100000016000000301406082B0601050507030406082B06010505070301030000000100000014000000F44095C238AC73FC4F77BF8F98DF70F8F091BC52200000000100000087030000308203833082026BA003020102021100AF3F646B56028666C6D843F94B7D96CF300D06092A864886F70D0101050500303F310B30090603550406130246523111300F060355040A130843657274706C7573311D301B06035504031314436C61737320335453205072696D617279204341301E170D3939303730373137313430305A170D3139303730363233353935395A303F310B30090603550406130246523111300F060355040A130843657274706C7573311D301B06035504031314436C61737320335453205072696D61727920434130820122300D06092A864886F70D01010105000382010F003082010A0282010100BD659A2343003CF9250143985B4634376737F45B578EA3DECD8C2F41B3153DE5988BF2CC5CA7C7AF35C7B3A74FC7102957E903898372067652C170023740EDF0CE8BB1B189AC02A85BDDDCD5434506DC28B6E9511B6AEEF37B48C59D11AE8DA67293C0254291A83E46E2684C8140B042D37ABE7B47D247500CA412A6CAE412D0C07C3A3C01A9CA0296DE825AC5FB19BA3C9CD80F741F9818AE945032075210114A4BEC58552CD49E4B947B05D272DF06F08DCB089EE4EEB444AD82F11B616AF1B3F81631364224BA90BFB57E616EC2590C5479B44C88281ECC1BDF848B23C8BEAF07F291B2DA8DCA8C5F7C283C7C896C0659BD3ECEC582D36AC9AC6855EEC5AF0203010001A37A3078300F0603551D13040830060101FF02010A300B0603551D0F040403020106301D0603551D0E04160414A2760E39786B8FBA2D714A08F7A27B6E00A2642530390603551D1F04323030302EA02CA02A8628687474703A2F2F7777772E63657274706C75732E636F6D2F43524C2F636C6173733354532E63726C300D06092A864886F70D01010505000382010100B59F689CC492F0777C13C215BC1CD40E6E7428A1FA86D2081B25FCE47BD97DD30258676F046E50EE7B4A010263BF4236D6BE0CFE220C993D8EF3AE1D94D6AAEAA63DE3439E47BB09C9CBEECEA12C0FAA7CDF7C7392E54BB904C43BDB20FE60F90C6E781A3D48D7274898B591ACA4DC22B3E79D5FECE54062268F7A17C6EAFB0AD6435B90DB3616ED982E9E5FAC1407822A50BFA6BF6FA6073472B66168EC5198195377E8C8BFF6217BBCB0DE7F743AF91534389AFB8933F0120D9FE8F1966DF61D487E3E12EFFA066759DEB3B2D6970B3B405742B2C17BC66DD826523425D285B6A10A0ADDAA94AA4E7B2093DDA4804356CFB6C4E058E96C958F626E5806AF78
(PID) Process:(3692) updroots.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D2EDF88B41B6FE01461D6E2834EC7C8F6C77721E
Operation:writeName:Blob
Value:
0B0000000100000038000000430065007200740050006C0075007300200043006C006100730073002000330020005000720069006D006100720079002000430041000000090000000100000016000000301406082B0601050507030406082B06010505070301030000000100000014000000D2EDF88B41B6FE01461D6E2834EC7C8F6C77721E2000000001000000950300003082039130820279A003020102021059DFAC7E8A661511E58824CEEFA9BCA9300D06092A864886F70D0101050500303D310B30090603550406130246523111300F060355040A130843657274706C7573311B301906035504031312436C6173732033205072696D617279204341301E170D3939303730373137303830305A170D3139303730363233353935395A303D310B30090603550406130246523111300F060355040A130843657274706C7573311B301906035504031312436C6173732033205072696D61727920434130820122300D06092A864886F70D01010105000382010F003082010A0282010100B794306ED04CD97E5E60E56FBB26CA526F6B6C8599A50BEF001A6F1B4D58B51807FADD7BF8CB2C52DDFC9CB88D52E9B9B20B7CF58F5B99480958DECD4895862589053427300B57B60C776329CB6CAA3EB99951120D987076474CF949962208F96BEAAA0036A315A71C1E9F8CCA5A797B21DA891F637E799250090428ADCEE36D04494A99B13F4509785820EF8DFE80C804ED292CA0588D840225973FA013D77B8B23E39FB8C7B84240381B924ABD4A9455C756150D8177CC9FA237892B5B850D8B77F8C48BFB10CB94C7E91A5612976614C4BBD77D6D021BBF71622618E9498AFAA3DEE184AD80CA4AE2228C6A086183B222C7098838565DD131ABF0099F13590203010001A3818C308189300F0603551D13040830060101FF02010A300B0603551D0F040403020106301D0603551D0E041604146A643676509C4EF4F74F15F50DED332560ECCB20301106096086480186F842010104040302010630370603551D1F0430302E302CA02AA0288626687474703A2F2F7777772E63657274706C75732E636F6D2F43524C2F636C617373332E63726C300D06092A864886F70D010105050003820101009AA13E38AEE152D2450DD1E98363AD8C80F493C3B8C23A229727B251863ED2F297DE7CBBD7964053CA52AA8A6C63CCBA718AE2F0F0108A17B04F8FC6EF0E31305A8DAD04C7AB8C5F1A08CF9A179946BE8E6B4A6A7F0147692518F84E3C4A042B06F210003DFF3EA5E80ECF703886BBC58E0CD6E24B4B66F3735F80B53BF11229EA73BC689E1C60F7F3AA42D816C868DE730B3F40C17777541D94572901935B98C36B04FA7C298DAC47F0FE55154BAF7123F5C3CE0167932680ACF4828AC41B404ADCC6390A6E63B6644D7ACE90AA99BD36FD59FC2FFC45BEDE8E3359FA8A0B0F30364DE35BB5D69650D7BFFE85DCDAB4822BCC1B083FF19A4EB5E18F08612416
Executable files
2
Suspicious files
4
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
2288rootsupd.exeC:\Windows\INF\setupapi.app.logtext
MD5:—
SHA256:—
2288rootsupd.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\authroots.sstbinary
MD5:648E05667223F8F1811F90B810EEB221
SHA256:298C610DE05B985B82AE7CABA3E18C9D235A5DB9075359590512FEFBE9CEF6E1
2288rootsupd.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\roots.sstbinary
MD5:8F5456AB98435524296B4DC4C4F82085
SHA256:F66076A44618B4C21ABEDD1C792C79F7B3B11BC953A77D182AA3C821FF2D4A27
2288rootsupd.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\rootsupd.infini
MD5:EBFDCBB367D2866D7AF432142A4DD351
SHA256:A7642657E3F441D6CACA66C41A973577B407BA856A7093A0089118060A16B623
2288rootsupd.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\delroots.sstbinary
MD5:02FA878DA028E0765C8EC26C70987F77
SHA256:F79A886D8976BD31A0236395C169FA196789CAC97E260507DD7221AB364E2AD7
2288rootsupd.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLLexecutable
MD5:E98CE891B708859E0CED9D2A0EF5A24B
SHA256:7735DFB067C97033031D45593C320D1229F3ACBA896C1A4E815A2D1BFD786B11
2288rootsupd.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\updroots.exeexecutable
MD5:9C18AE971CBFFB096952177F6804EA31
SHA256:2703C25453B09C40EE81FDC458B8CC24712E387A12D15FF94E12B02921FE98CB
2288rootsupd.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\updroots.sstbinary
MD5:962BD62C053645CF096F643380DA5A82
SHA256:50A13AF4175490AA1CDC7C6255AA18A66D2998260F41F2A075FE17106143D79A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
rootsupd.exe